Cribl is acquiring CardinalOps, a cybersecurity company specializing in AI-driven detection engineering, as the telemetry software provider expands deeper into security operations. Announced on July 14, 2026, the transaction will bring CardinalOps’ technology into Cribl’s AI Platform for Telemetry, with the goal of helping enterprises improve threat coverage, manage security data costs, and modernize security information and event management environments. Financial terms of the acquisition were not disclosed.
Expanding Cribl’s Security Operations Strategy
The acquisition extends Cribl beyond the collection, routing, storage, and analysis of telemetry by adding technology designed to evaluate whether security detections are working effectively. Cribl said the combined platform will allow customers to use existing security tools and data infrastructure while continuously assessing detection quality across distributed environments. The company is positioning this approach as a more flexible alternative to traditional SIEM systems that often require organizations to centralize growing volumes of data and pay rising ingestion and indexing costs.
CardinalOps Brings Automated Detection Engineering
Founded in early 2020, CardinalOps was established by Michael Mumcuoglu and Yair Manor, cybersecurity entrepreneurs and veterans of the Israeli military’s Unit 8200. Its platform uses AI to map an organization’s security controls and detection rules against real-world adversary techniques, helping security teams identify gaps that could leave attacks unnoticed. The software also automates labor-intensive detection engineering tasks, including finding broken rules, reducing noisy alerts, and improving the effectiveness of existing SIEM, data lake, and extended detection and response tools.
Aiming to Modernize Legacy SIEM Architectures
Cribl argues that security operations centers increasingly face a mismatch between rapidly expanding telemetry volumes and budgets that cannot grow at the same pace. By combining CardinalOps’ detection layer with its vendor-neutral telemetry infrastructure, the company plans to help customers shape and analyze data before it creates unnecessary costs, search across systems without moving everything into one repository, and strengthen detections over time. Cribl CEO and co-founder Clint Sharp described the acquisition as a foundation for an open, AI-native alternative to legacy SIEM stacks rather than another closed, all-or-nothing security platform.
Supporting Existing Tools and Customer Choice
A central element of the strategy is maintaining compatibility with the security products and architectures customers already operate instead of requiring a complete technology replacement. CardinalOps’ capabilities are intended to work across different platforms, allowing organizations to evaluate coverage and improve rules while Cribl manages the underlying telemetry across multiple locations and systems. This federated model could appeal to large enterprises seeking to modernize security operations gradually while preserving control over data location, vendor selection, and infrastructure spending.
Establishing a Cybersecurity Base in Tel Aviv
Cribl will establish a new office in Tel Aviv through the acquisition, creating a permanent presence in one of the world’s most established cybersecurity development hubs. The location will give the San Francisco-based company access to CardinalOps’ team and Israel’s broader pool of security engineering talent as it develops additional products for security operations. CardinalOps co-founder and CEO Michael Mumcuoglu said joining Cribl would allow the company’s detection engineering technology to be integrated directly into a broader telemetry platform and deployed across the tools customers already use.
The CardinalOps acquisition marks a significant step in Cribl’s effort to move from telemetry management infrastructure into a broader role within enterprise security operations. Its success will depend on how effectively the companies integrate automated detection engineering with Cribl’s existing platform and whether customers view the combined offering as a credible replacement or complement to established SIEM products. For security teams under pressure to improve protection while controlling data costs and complexity, the deal introduces another potential path toward a more open and adaptable operating model.