Cribl Acquires CardinalOps In Move To Expand Into Security Operations
CriblAcquirer
CardinalOpsTarget
Telemetry data platform Cribl announced on July 14, 2026 that it is acquiring detection‑engineering startup CardinalOps; deal terms were not disclosed. The acquisition adds AI‑driven detection capabilities to Cribl’s suite and positions the company to offer an open alternative to legacy SIEM stacks as it approaches a $300 million ARR milestone.
Cribl, the San‑Francisco‑based telemetry data platform provider, disclosed on July 14, 2026 that it is acquiring Israeli detection‑engineering startup CardinalOps, though the financial terms were not disclosed. The deal expands Cribl’s security operations portfolio by embedding CardinalOps’ AI‑powered detection layer into its existing data‑routing and observability products.
Deal Terms
The acquisition adds CardinalOps’ technology to Cribl’s cloud‑native suite, which includes Cribl Stream, Edge, Search and Lake. While the purchase price remains private, the transaction signals Cribl’s intent to deepen its foothold in the cybersecurity market as it scales beyond its core observability use cases. Cribl reported $300 million in annual recurring revenue (ARR) for 2025, up from $200 million a year earlier, underscoring the revenue runway that can support a strategic buy.
Strategic Rationale
CardinalOps brings an AI‑driven detection‑engineering platform that continuously maps security controls against adversary behavior, automates rule creation, and surfaces coverage gaps. By integrating this capability, Cribl aims to give security teams a unified path to replace legacy SIEM solutions, lower data ingestion costs, and accelerate the conversion of raw telemetry into actionable alerts. The combined offering promises a “complete, open alternative” to traditional SIEM stacks, leveraging Cribl’s real‑time data processing at scale with CardinalOps’ detection intelligence.
The acquisition also opens a new Cribl office in Tel Aviv, tapping Israel’s deep cybersecurity talent pool. Founders of CardinalOps, Michael Mumcuoglu and Yair Manor, bring experience from Israel Defense Forces Unit 8200 and prior exits to Palo Alto Networks and Microsoft, adding credibility to the merged security roadmap.
Overall, the move positions Cribl to transition from a pure observability platform to a broader security operations platform, potentially broadening its addressable market and strengthening its narrative ahead of a contemplated IPO.
Why It Matters
For Cribl, the acquisition accelerates its shift from a data‑routing specialist to a full‑stack security operations provider, directly challenging legacy SIEM vendors such as Splunk and IBM QRadar. By embedding detection engineering into its telemetry pipeline, Cribl can offer customers a lower‑cost, data‑efficient alternative that reduces the need for multiple point solutions. CardinalOps benefits from Cribl’s larger go‑to‑market engine and the ability to scale its AI detection engine across a broader enterprise base, while its founders gain a platform to broaden their product vision.
Competitors that rely on siloed observability or SIEM products now face a more integrated threat‑detection stack from Cribl, potentially prompting them to pursue similar acquisitions or accelerate their own AI‑driven detection roadmaps. The deal also signals to investors that consolidation in the security‑ops niche is gaining momentum, with data‑centric platforms seeking to bundle detection capabilities to capture higher‑margin, recurring revenue streams.
Key Points
- Cribl announced the acquisition of CardinalOps on July 14, 2026; deal terms were not disclosed.
- CardinalOps adds AI‑driven detection‑engineering capabilities to Cribl’s telemetry platform.
- Cribl reported $300 million ARR for 2025, up from $200 million in 2024.
- The combined solution aims to replace legacy SIEM systems with an open, data‑efficient alternative.
- Cribl will open a new office in Tel Aviv to leverage Israel’s cybersecurity talent pool.
Analysis
The Cribl‑CardinalOps deal illustrates how data‑infrastructure providers are moving up the security stack to capture higher‑margin SaaS revenue. With Cribl’s ARR now at $300 million, the company can likely justify a purchase price in the low‑single‑digit‑digit‑multiple range of ARR, a common valuation metric for high‑growth security SaaS firms. By integrating AI‑native detection engineering, Cribl can differentiate its platform from pure observability tools and from traditional SIEM vendors that still rely on heavyweight data ingestion models. This hybrid approach aligns with a broader market trend where operators seek to consolidate telemetry ingestion, processing, and detection into a single, cost‑effective stack. For investors, the transaction signals that capital will continue to flow toward companies that can combine data handling with actionable security intelligence, a combination that promises strong net‑revenue retention and expansion revenue as existing customers upgrade to more comprehensive security suites. The move also underscores the strategic importance of Israeli cyber talent, suggesting that future deals may increasingly target niche AI security startups to accelerate product roadmaps ahead of IPOs or larger exit events.