Cribl Acquires CardinalOps to Further Expand Its AI Platform into Security Operations

Acquisition brings AI-enabled detection engineering to Cribl, helping customers improve threat coverage, reduce security data costs, and replace legacy SIEM architectures

SAN FRANCISCO, July 14, 2026 (GLOBE NEWSWIRE) -- Cribl, the AI Platform for Telemetry, today announced it is acquiring CardinalOps, an Agentic Detection Engineering solution. The acquisition adds detection engineering capabilities that help customers improve threat coverage, lower data costs, and strengthen their SOCs. This creates a flexible path toward replacing legacy SIEM architectures.

Security teams are under pressure to process more telemetry, move faster against threats, and control the rising cost and complexity of their environments. With CardinalOps, Cribl can help customers connect those priorities: use telemetry more intelligently, continuously validate and improve detections, and do it in a way that lets customers modernize at their own pace, using the tools and architectures that make the most sense for their environment.

“Security teams do not need more disconnected tools. They need a better way to turn telemetry into effective detections and outcomes,” said Clint Sharp, co-founder and CEO of Cribl. “CardinalOps strengthens our AI Platform for Telemetry by adding deep detection engineering capabilities to the open data infrastructure our customers already rely on and serves as the foundation for a complete, open alternative to the SIEM stack they've outgrown.”

The acquisition reinforces Cribl’s platform-first approach to the market. Rather than offering another rigid, all-or-nothing security stack, Cribl gives customers an open, vendor-agnostic platform to analyze, collect, move, store, and act on telemetry across their environments. That includes a federated model that lets customers search and work across telemetry where it already lives, without forcing everything into another centralized system. With CardinalOps, Cribl is adding foundational detection engineering capabilities to its AI platform, bringing the same open, AI-native model to the SIEM category itself: everything a SIEM does, on telemetry infrastructure customers already own. That federated foundation also allows Cribl to layer new security and observability solutions on the same shared telemetry foundation, giving customers more flexibility and better economics as they modernize their environments in the AI era.

Founded in early 2020, CardinalOps is led by serial entrepreneurs and veterans of IDF's Unit 8200, Michael Mumcuoglu and Yair Manor, whose previous companies were acquired by Palo Alto Networks and Microsoft. CardinalOps uses AI to help organizations continuously assess and improve detection coverage by mapping security controls against real-world adversary behavior. It automates detection engineering tasks, helping teams identify and eliminate coverage gaps, find and fix broken or noisy rules, and unlock the full value of their existing security stack. Combined with Cribl's ability to manage telemetry at scale, CardinalOps adds the detection layer that helps customers move faster from raw data to actionable insights that improve security outcomes.

“Too many security teams have good data, powerful tools, and endless alerts, but no real confidence that they are actually protected,” said Michael Mumcuoglu, co-founder and CEO of CardinalOps. “We built CardinalOps so SOC teams could understand and improve coverage instead of just managing more noise. Joining Cribl lets us bring that directly into the telemetry layer and build what the market needs next: an open, AI-native alternative to the SIEM, where customers pay for better protection, not more data volume. That's what we're building next."

With this acquisition, Cribl will also establish a new office in Tel Aviv, creating a strategic presence in one of the world’s most active cybersecurity innovation hubs. The move will allow Cribl to tap into Israel’s deep pool of cybersecurity talent and further accelerate the development of its modern security solutions.

By bringing CardinalOps into the Cribl platform, Cribl is expanding its footprint in security operations while staying true to what differentiates the company in the market: an open platform, lighter-weight solutions on top, and the freedom for customers to adopt what they need without lock-in. The acquisition also creates a stronger foundation for future security offerings built on the Cribl platform.

“At Repsol, we operate across a diverse and distributed security environment, so improving detection coverage while controlling cost and complexity is critical to how we justify security investment at the board level,” said Javier García Quintela, Global CISO of Repsol. “CardinalOps and Cribl are a strong combination for that: CardinalOps strengthens our detection posture across platforms, and Cribl gives us the flexibility to manage and analyze telemetry efficiently across that same environment. Together, they help our SOC teams move faster, reduce risk, and increase effectiveness.”

The integration of CardinalOps technology into the Cribl platform will bring Cribl's security capabilities together into a complete, open alternative to legacy SIEM architectures.

To learn more, visit cribl.io.

About Cribl
Cribl, the AI Platform for Telemetry, empowers enterprises to manage and analyze telemetry for both humans and agents. Trusted by organizations worldwide, including half of the Fortune 100, Cribl bridges the gap between AI ambition and infrastructure reality. No lock-in. No data loss. No compromises. Cribl’s vendor-agnostic platform ensures data remains portable and interoperable. By cost-effectively handling increasing data volume and variety without delay, Cribl gives enterprises the choice, control and flexibility to build what’s next. Founded in 2018, Cribl is a remote-first workforce with an office in San Francisco, CA.

About CardinalOps
CardinalOps is the Agentic Detection Engineering Platform for enterprise security teams. Powered by Cardinal AI, CardinalOps continuously validates and expands threat detection coverage, fixes broken and noisy detections, operationalizes threat intelligence, and enables agentic workflows that help SOC teams scale detection engineering without adding headcount. By maximizing the value of existing SIEM and EDR tools, CardinalOps helps organizations reduce noise, close coverage gaps, accelerate response, and protect against the threats that matter most. Learn more at www.cardinalops.com.

Learn more: cribl.io
Try Cribl
Join us: Slack community
Follow us: LinkedIn and X

Media Contact:
press@cribl.io