Cribl acquires CardinalOps to build open SIEM alternative
Cribl, the San Francisco-based telemetry platform vendor, has announced the acquisition of CardinalOps, an AI-driven detection engineering company, as it pushes deeper into security operations. The deal adds continuous detection validation and coverage-gap analysis to Cribl's existing data pipeline capabilities, and the combined company is positioning the result as an open, vendor-agnostic alternative to traditional SIEM stacks.
Financial terms were not disclosed. CardinalOps was founded in early 2020 by Michael Mumcuoglu and Yair Manor, both veterans of the Israeli Defence Forces' signals intelligence Unit 8200 and serial entrepreneurs whose earlier companies were acquired by Palo Alto Networks and Microsoft respectively. As part of the transaction, Cribl will open a new office in Tel Aviv.
The deal
CardinalOps uses AI to map an organisation's security controls against real-world adversary behaviour, automate detection-rule maintenance, and surface broken or overly noisy rules without requiring manual analyst review. Cribl's existing platform handles telemetry ingestion, routing and storage at scale. The companies argue that putting detection engineering directly on top of a shared telemetry layer removes the need for a separate, monolithic SIEM and its associated per-gigabyte ingestion costs.
Clint Sharp, co-founder and chief executive of Cribl, said the acquisition was designed to give customers "a better way to turn telemetry into effective detections and outcomes," rather than yet another standalone tool. Javier García Quintela, Global CISO of energy group Repsol, was named as a reference customer, saying the combination helps his distributed SOC "move faster, reduce risk, and increase effectiveness" while containing cost and complexity.
Market context
The SIEM market has been under structural pressure for several years. Legacy platforms from IBM (QRadar), Splunk and LogRhythm were built around centralised log ingestion at a time when data volumes were manageable; the explosion in cloud, endpoint and network telemetry has made volume-based pricing increasingly untenable for large enterprises. Microsoft Sentinel and Google Chronicle have tried to address this with cloud-native, consumption-flexible models, while a crop of data-pipeline vendors, including Cribl itself, have argued that separating the transport and storage layer from the analytics layer is the more durable architecture.
Cribl claims its platform is trusted by half of the Fortune 100, though the company remains privately held and has not disclosed revenue. The Tel Aviv office positions it alongside a cluster of well-funded Israeli cybersecurity firms, many of which also draw on Unit 8200 alumni networks. Detection engineering as a discipline has attracted specialist vendors including Panther Labs, Anvilogic and Hunters, which will now compete more directly with a better-capitalised Cribl-CardinalOps combination.
Regulatory and standards read-across
Enterprise buyers evaluating SIEM replacements face obligations under a range of frameworks, including NIS2 in Europe (which mandates incident detection and reporting capabilities for operators of essential services) and DORA for financial services, both of which require demonstrable, auditable detection coverage. CardinalOps's continuous coverage-validation approach maps well onto those requirements, giving compliance teams a structured evidence trail that point-in-time rule audits do not provide.
US federal buyers are additionally subject to CISA guidance on logging and detection standards under the post-SolarWinds executive orders, which mandate centralised log retention and threat-hunting capabilities. Cribl's federated model, which allows search across telemetry without forcing it into a single repository, may require additional scrutiny to satisfy FedRAMP-level data-handling requirements, a question the company has not yet addressed publicly.
The next milestones to watch are the pace of CardinalOps technology integration into the Cribl product roadmap, any customer wins attributed explicitly to the combined platform, and whether Cribl moves toward a public offering as its enterprise footprint grows.