The combination of Cribl’s AI Platform for Telemetry and CardinalOps’ agentic detection software provides an alternative for legacy SIEM architectures, helping clients improve threat coverage and strengthen SOCs, according to the companies.
Telemetry data platform provider Cribl is acquiring CardinalOps, a developer of agentic detection engineering software, in a move Cribl said will expand its capabilities into security operations.
Fast-growing Cribl said the acquisition adds detection engineering capabilities to its technology portfolio that will help customers improve security threat coverage, lower data costs and bolster their security operations centers (SOCs).
With the addition of the CardinalOps technology, the Cribl platform will offer businesses and organizations “a flexible path forward” toward replacing legacy SIEM (security information and event management) systems.
[Related: The Coolest Data Observability Companies Of The 2026 Big Data 100]
“Security teams do not need more disconnected tools. They need a better way to turn telemetry into effective detections and outcomes,” said Cribl co-founder and CEO Clint Sharp (pictured), in a news release.
“CardinalOps strengthens our AI Platform for Telemetry by adding deep detection engineering capabilities to the open data infrastructure our customers already rely on and serves as the foundation for a complete, open alternative to the SIEM stack they’ve outgrown,” Sharp said.
Terms of the acquisition were not disclosed.
Cribl’s platform manages, processes and routes IT and cybersecurity telemetry data—including logs, metrics, traces and events—in real time. The company’s cloud-based product suite includes Cribl Stream, Cribl Edge, Cribl Search and Cribl Lake.
Cribl, founded in 2018 and headquartered in San Francisco, reported in February that it surpassed $300 million in annual recurring revenue in 2025, up from the $200 million in ARR it reported in December 2024. The company is widely seen as positioning itself for an IPO at some point over the next few years.
The CardinalOps Story
CardinalOps, founded in 2020 and based in Tel Aviv, Israel, is led by Michael Mumcuoglu and Yair Manor, veterans of the Israeli Defense Force’s Unit 8200. Previous startups founded by Mumcuoglu and Manor were acquired by Palo Alto Networks and Microsoft.
“Too many security teams have good data, powerful tools and endless alerts, but no real confidence that they are actually protected,” Mumcuoglu said in the news release.
“We built CardinalOps so SOC teams could understand and improve coverage instead of just managing more noise. Joining Cribl lets us bring that directly into the telemetry layer and build what the market needs next: an open, AI-native alternative to the SIEM, where customers pay for better protection, not more data volume. That’s what we’re building next,” he said.
The CardinalOps platform uses AI to continuously assess and improve threat detection coverage by mapping security controls against real-world adversary behavior. It automates detection engineering tasks, helps security teams identify and eliminate coverage gaps, finds and fixes broken rules, and unlocks “the full value of their existing security stack,” Cribl said.
The combination of the two companies’ products pairs Cribl’s ability to manage telemetry data at scale with the CardinalOps detection layer, making it possible for clients to more quickly move from raw data to actionable insights, Cribl said.
The integration of the CardinalOps technology with the Cribl platform will provide a complete alternative to legacy SIEM platforms, Cribl said, and create a stronger foundation for future security offerings built on the Cribl platform.
Cribl also said that with the acquisition the company will establish a new office in Tel Aviv, allowing it to tap into Israel’s “deep pool of cybersecurity talent” and accelerate its security development efforts.
