Cribl buys AI-native threat detection engineering startup CardinalOps

Data observability and telemetry management company Cribl Inc. says it’s extending its capabilities into security operations after acquiring the artificial intelligence-native security engineering startup CardinalOps Ltd. for an undisclosed price.

Cribl said that buying CardinalOps will give it advanced “detection engineering capabilities” that will help its enterprise customers to detect more sophisticated cybersecurity threats. It will also give them an easy way to beef up their security information and event management, data lake and extended detection and response systems, the company said.

CardinalOps has built an array of AI tools and systems designed to help enterprises identify, manage and reduce their threat exposure level. It does this by enhancing their ability to detect potential issues across all of their security tools, supporting continuous threat exposure management. Its technology works by mapping security controls against the real-world behavior of cyber adversaries, automating detection engineering tasks and helping teams to find and eliminate coverage gaps and broken or noisy rules that could be exploited by attackers.

According to Cribl, this kind of thing is just what the doctor ordered for many organizations today. It said businesses are under increased pressure to process and scan more of their telemetry data to identify advanced threats, while also keeping a lid on the spiraling costs of these security environments.

With CardinalOps’ technologies, Cribl believes it will be the ideal partner to help organizations do this. While it handles telemetry management at scale, CardinalOps adds a detection layer that can help businesses to generate actionable insights from that raw data.

Cribl thinks it will be able to help businesses in several ways. They’ll be able to use their telemetry more intelligently, continuously validating and improving threat detection while still using their preferred security tools.

“Security teams need a better way to turn telemetry into effective detections and outcomes,” said Cribl co-founder and Chief Executive Clint Sharp. “CardinalOps strengthens our AI Platform for Telemetry by adding deep detection engineering capabilities to the open data infrastructure our customers already rely on and serves as the foundation for a complete, open alternative to the SIEM stack they’ve outgrown.”

The addition of CardinalOps’ capabilities underscores Cribl’s novel platform-based approach to security, which enables companies to collect, merge, analyze and act on telemetry data from multiple computing environments. With CardinalOps, it’s gaining advanced detection engineering capabilities that it will be able to layer into its telemetry foundation, ensuring customers have the flexibility to modernize their security environments as they see fit.

“We built CardinalOps to bring automation and rigor to detection engineering,” said CardinalOps co-founder and CEO Michael Mumcuoglu. “Joining Cribl gives us the opportunity to bring that capability into a broader telemetry platform and help customers correlate and improve detections across the SIEM, data lake and other security tools already in their environment.”

Those are all future plans, and nothing has changed yet. But Cribl said it’s already going full speed ahead as it races to integrate CardinalOps’ capabilities into its telemetry management platform, and so customers can expect to see a major update rolling out soon.

Image: CardinalOps