Cribl announced that it is acquiring CardinalOps, an agentic detection engineering company. The acquisition expands Cribl’s AI Platform for Telemetry into security operations.
CardinalOps adds detection engineering capabilities designed to help customers improve threat coverage, lower security data costs, and strengthen security operations centers. Cribl said the deal creates a more flexible path for customers looking to modernize or replace legacy SIEM architectures.
Security teams are under pressure to process growing volumes of telemetry, move faster against threats, and manage the rising cost and complexity of their environments. Cribl said CardinalOps will help customers use telemetry more intelligently, continuously validate detections, and improve outcomes without forcing them into a rigid security stack.
Cribl’s platform is built to help organizations analyze, collect, move, store, and act on telemetry across their environments. The company emphasizes an open, vendor-agnostic model that allows customers to work with telemetry where it already lives rather than requiring all data to be centralized in another system.
By adding CardinalOps, Cribl is bringing detection engineering into that telemetry layer. The company said the combination supports an open, AI-native alternative to traditional SIEM models by giving security teams SIEM-like capabilities on top of telemetry infrastructure they already own.
CardinalOps was founded in 2020 and is led by Michael Mumcuoglu and Yair Manor, serial entrepreneurs and veterans of IDF Unit 8200. Their previous companies were acquired by Palo Alto Networks and Microsoft.
CardinalOps uses AI to help organizations assess and improve detection coverage by mapping security controls against real-world adversary behavior. The platform automates detection engineering tasks, including identifying coverage gaps, finding broken or noisy rules, and helping teams improve the value of their existing security tools.
Combined with Cribl’s ability to manage telemetry at scale, CardinalOps adds a detection layer that helps customers move from raw data to actionable security insights. Cribl said this can help security teams improve protection while reducing noise, complexity, and unnecessary data movement.
The acquisition also expands Cribl’s footprint in security operations while reinforcing its platform-first approach. Rather than offering an all-or-nothing security stack, Cribl said it will continue to allow customers to adopt only what they need, without lock-in.
As part of the acquisition, Cribl will establish a new office in Tel Aviv. The move gives the company a strategic presence in one of the world’s most active cybersecurity innovation hubs and access to Israel’s cybersecurity talent base.
Cribl said the integration of CardinalOps technology will bring its security capabilities together into a complete, open alternative to legacy SIEM architectures. The acquisition also creates a foundation for future security offerings built on the Cribl platform.
KEY QUOTES:
“Security teams do not need more disconnected tools. They need a better way to turn telemetry into effective detections and outcomes. CardinalOps strengthens our AI Platform for Telemetry by adding deep detection engineering capabilities to the open data infrastructure our customers already rely on and serves as the foundation for a complete, open alternative to the SIEM stack they’ve outgrown.”
Clint Sharp, Co-Founder and CEO of Cribl
“Too many security teams have good data, powerful tools, and endless alerts, but no real confidence that they are actually protected. We built CardinalOps so SOC teams could understand and improve coverage instead of just managing more noise. Joining Cribl lets us bring that directly into the telemetry layer and build what the market needs next: an open, AI-native alternative to the SIEM, where customers pay for better protection, not more data volume. That’s what we’re building next.”
Michael Mumcuoglu, Co-Founder and CEO of CardinalOps
“At Repsol, we operate across a diverse and distributed security environment, so improving detection coverage while controlling cost and complexity is critical to how we justify security investment at the board level. CardinalOps and Cribl are a strong combination for that: CardinalOps strengthens our detection posture across platforms, and Cribl gives us the flexibility to manage and analyze telemetry efficiently across that same environment. Together, they help our SOC teams move faster, reduce risk, and increase effectiveness.”
Javier García Quintela, Global CISO of Repsol
