Cribl Buys CardinalOps to Close the Gap Between Collecting Security Data and Acting on It
The $3.5 billion data-pipeline company moves beyond simply gathering security information, adding AI-powered tools that tell defenders where their defences are actually failing.
Key points
- Cribl, a San Francisco security-data company valued at $3.5 billion, announced the acquisition of CardinalOps on Tuesday.
- CardinalOps uses AI to find gaps in a company's detection rules and map them to MITRE ATT&CK, a widely used catalogue of real-world hacking techniques.
- Cribl's platform is used by more than half of the Fortune 100 and 35% of the Fortune 500.
- Cribl grew from $1 million to over $300 million in annual recurring revenue in under seven years.
- An industry analyst warns the deal only delivers value if the two products are tightly integrated, not simply bundled.
Cribl built its name solving a surprisingly expensive problem: companies collect enormous amounts of security data, send it to too many different tools, and pay a fortune to store information they can't properly use. More than half of America's hundred biggest companies now run Cribl's platform to sort and route that data flood.
Buying CardinalOps is a different kind of move. It pushes Cribl from the plumbing into the decision-making.
What does CardinalOps actually do for ordinary security teams?
CardinalOps uses AI to inspect a company's detection rules, the instructions a security system uses to recognise an attack, and checks whether those rules cover the full range of known criminal tactics. It does this by mapping those rules to MITRE ATT&CK, a publicly maintained catalogue of hacking techniques used by security teams worldwide as a benchmark for measuring how well-protected they are.
When a rule is broken or generating so many false alarms that staff ignore it, CardinalOps flags it. Nicole Beckwith, Cribl's senior director of security engineering and operations, puts the result plainly: "They find and fix those broken and noisy rules and then unlock the value of your entire security stack."
Beckwith previously ran detection and response at Kroger, the US grocery giant, which used both products before the deal. She told Dark Reading she "jumped at" the chance to join Cribl because she believed in the company's roadmap.
Sean Sosnowski, research director at Software Analyst Cyber Research, considers the acquisition strategically sound. Combining data control with detection-gap analysis, he says, helps security teams move from the vague complaint of "we have too much data" to the specific answer of "we know which data matters for the detections we need." That's a meaningfully stronger position for a security operations centre (SOC), the team inside an organisation responsible for spotting and responding to attacks. Our 1 July piece on detection engineering laid out exactly why that shift is overdue.
Sosnowski adds a practical caution. If the two products stay loosely connected rather than becoming a genuinely unified tool, real-world benefit will be limited. Integration depth is what matters.
Should you worry about the valuation?
Cribl was founded in 2018 by former Splunk architects. It crossed $100 million in annual recurring revenue in under four years, then kept climbing past $200 million and later $300 million. A 2024 funding round led by GV raised roughly $320 million, setting the valuation at $3.5 billion. CEO Clint Sharp has said publicly he sees Cribl eventually going public.
For teams running Cribl or CardinalOps, the practical upshot is straightforward: expect new tools designed to surface detection blind spots automatically, ideally before attackers find them first. Whether Cribl delivers on that or just ships a fancier dashboard is the only question worth tracking.
