Cribl acquires Israeli cyber startup CardinalOps for around $100 million
The U.S. telemetry company will establish a Tel Aviv office after buying the AI-powered detection engineering startup. The acquisition marks Cribl’s push into security operations and its effort to challenge traditional SIEM platforms.
Cribl, a U.S. technology company specializing in telemetry management, announced on Tuesday the acquisition of Israeli startup CardinalOps, which develops agentic detection engineering solutions. The companies did not disclose the purchase price, but the deal is estimated at approximately $100 million. Following the acquisition, CardinalOps employees will join Cribl, which will establish a new office in Tel Aviv and is expected to expand its Israeli operations.
Cribl develops an AI-powered telemetry platform for cybersecurity and IT teams and is considered one of the fastest-growing technology companies in the U.S., with annual recurring revenue of more than $300 million.
The acquisition will extend Cribl’s platform into security operations by adding detection engineering capabilities designed to help customers improve threat coverage, reduce data costs, and strengthen their security operations centers (SOCs). The move will allow Cribl to offer customers a more flexible alternative to traditional SIEM (Security Information and Event Management) architectures.
Security teams are increasingly under pressure to process growing volumes of telemetry, respond faster to threats, and manage the rising costs and complexity of their environments. Through CardinalOps, Cribl will enable customers to use telemetry more intelligently, continuously validate and improve detection mechanisms, and modernize their security infrastructure at their own pace while maintaining flexibility over the tools and architectures they use.
The acquisition reinforces Cribl’s strategy of building an open, vendor-agnostic platform rather than another closed security stack. The company’s platform allows organizations to collect, analyze, move, store, and act on telemetry across their environments. By adding CardinalOps’ detection engineering capabilities, Cribl aims to create a broader alternative to legacy SIEM solutions based on the telemetry infrastructure customers already operate.
“Security teams do not need more disconnected tools. They need a better way to turn telemetry into effective detections and outcomes,” said Clint Sharp, co-founder and CEO of Cribl. “CardinalOps strengthens our AI Platform for Telemetry by adding deep detection engineering capabilities to the open data infrastructure our customers already rely on and serves as the foundation for a complete, open alternative to the SIEM stack they've outgrown.”
Founded in early 2020, CardinalOps is led by serial entrepreneurs and veterans of the IDF’s Unit 8200, Michael Mumcuoglu (CEO) and Yair Manor (CIO). The founders previously built companies that were acquired by major cybersecurity and technology companies, including Palo Alto Networks and Microsoft.
CardinalOps uses artificial intelligence to help organizations continuously assess and improve their threat detection coverage by mapping security controls against real-world attacker behavior. Its technology automates detection engineering tasks, enabling security teams to identify and close coverage gaps, fix broken or overly noisy rules, and maximize the value of their existing security infrastructure.
Combined with Cribl’s ability to manage telemetry at scale, CardinalOps adds a detection layer designed to help customers move faster from raw security data to actionable insights and improve their overall security posture.
“Too many security teams have good data, powerful tools, and endless alerts, but no real confidence that they are actually protected. We built CardinalOps so SOC teams could understand and improve coverage instead of just managing more noise,” said Michael Mumcuoglu, co-founder and CEO of CardinalOps. “Joining Cribl lets us bring that directly into the telemetry layer and build what the market needs next: an open, AI-native alternative to the SIEM, where customers pay for better protection, not more data volume. That’s what we’re building next.”
CardinalOps currently employs approximately 25 people, most of them in Israel. To date, the company has raised about $40 million from investors including Viola Ventures, Glilot Capital, Battery Ventures, In Venture, XT Hi-Tech, Gefen Capital, Symbol, and others.
