Cribl has announced the acquisition of CardinalOps, an agentic detection engineering provider, expanding Cribl’s capabilities into security operations. The addition of CardinalOps technology strengthens detection engineering across SIEM, data lake, and XDR environments, helping organizations improve threat coverage, reduce data costs, and modernize security operations while creating a flexible path away from legacy SIEM architectures.
Security teams are under pressure to process more telemetry, move faster against threats, and control the rising cost and complexity of their environments. With CardinalOps, Cribl can help customers connect those priorities: use telemetry more intelligently, continuously validate and improve detections, and do it in a way that lets customers modernize at their own pace, using the tools and architectures that make the most sense for their environment.
“Security teams do not need more disconnected tools. They need a better way to turn telemetry into effective detections and outcomes,” said Clint Sharp, co-founder and CEO of Cribl. “CardinalOps strengthens our AI Platform for Telemetry by adding deep detection engineering capabilities to the open data infrastructure our customers already rely on and serves as the foundation for a complete, open alternative to the SIEM stack they’ve outgrown.”
The acquisition reinforces Cribl’s platform-first approach to the market. Rather than offering another rigid, all-or-nothing security stack, Cribl gives customers an open, vendor-agnostic platform to analyze, collect, move, store, and act on telemetry across their environments. With CardinalOps,
Cribl is adding foundational detection engineering capabilities to the AI platform, and bringing the same open, AI-native model to the SIEM category itself: everything a SIEM does, on telemetry infrastructure customers already own. Over time, Cribl will continue to layer security and observability solutions on the same shared telemetry foundation, giving customers more flexibility and better economics as they modernize their environments in the AI era.
Founded by cybersecurity veterans Michael Mumcuoglu and Yair Manor, CardinalOps uses AI to help organizations continuously assess and improve detection coverage by mapping security controls against real-world adversary behavior. Its technology automates detection engineering tasks, helping teams identify and eliminate coverage gaps, find and fix broken or noisy rules, and unlock the full value of their existing security stack. Combined with Cribl’s ability to manage telemetry at scale, CardinalOps adds the detection layer that helps customers move faster from raw data to actionable insights that improve security outcomes.
“We built CardinalOps to bring automation and rigor to detection engineering,” said Michael Mumcuoglu, co-founder and CEO of CardinalOps. “Joining Cribl gives us the opportunity to bring that capability into a broader telemetry platform and help customers correlate and improve detections across the SIEM, data lake, and other security tools already in their environment.”
By bringing CardinalOps into the Cribl platform, Cribl is expanding its footprint in security operations while staying true to what differentiates the company in the market: an open platform, lighter-weight solutions on top, and the freedom for customers to adopt what they need without lock-in. The acquisition also creates a stronger foundation for future security offerings built on the Cribl platform.
The integration of CardinalOps technology into the Cribl platform is underway, bringing Cribl’s security capabilities together into a complete, open alternative to legacy SIEM architectures.
To learn more, visit cribl.io.
Related News:
10ZiG and Cendio Deliver Secure Linux Remote Desktop Solution
Polygraf Launches Meeting Guard to Combat AI Fraud in Enterprise Meetings
