Cribl, an AI platform for telemetry, has recently acquired CardinalOps, an Agentic Detection Engineering solution.
Expanding its Cribl AI platform into SecOps
The acquisition extends Cribl’s platform into security operations to add detection engineering capabilities.
This extension will help customers improve threat coverage, lower data costs, and enhance SIEM, data lake, and XDR environments, creating a flexible path toward replacing legacy SIEM architectures.
By adding CardinalOps to the fold, Cribl aims to help customers use telemetry more intelligently and continuously validate and improve detections, enabling them to modernize at their own pace with tools and architectures that make the most sense for their environments.
Open model for SIEM and detection engineering
Further, Cribl is adding foundational detection engineering capabilities to the AI platform with CardinalOps, bringing the same open, AI-native model to the SIEM category.
Cribl will also continue to layer security and observability solutions onto the same shared telemetry foundation, giving customers greater flexibility and better economics as they modernize their environments for AI.
“Security teams do not need more disconnected tools. They need a better way to turn telemetry into effective detections and outcomes,” said Clint Sharp, co-founder and CEO of Cribl. “CardinalOps strengthens our AI Platform for Telemetry by adding deep detection engineering capabilities to the open data infrastructure our customers already rely on and serves as the foundation for a complete, open alternative to the SIEM stack they’ve outgrown.”
CardinalOps founders celebrate new opportunities ahead
CardinalOps was founded by Michael Mumcuoglu and Yair Manor and uses AI to help organizations assess and improve detection coverage by mapping security controls to real-world adversary behavior.
“We built CardinalOps to bring automation and rigor to detection engineering,” said Mumcuoglu, co-founder and CEO of CardinalOps. “Joining Cribl gives us the opportunity to bring that capability into a broader telemetry platform and help customers correlate and improve detections across the SIEM, data lake, and other security tools already in their environment.”
Combining CardinalOps’ capabilities with Cribl’s ability to manage telemetry at scale adds a detection layer, helping customers move quickly from raw data to actionable insights that improve security outcomes.
June was filled with mergers and acquisitions, including a billion-dollar deal by Salesforce. Read more about the moves that wrapped Q2 of 2026.