Cribl announced on July 14, 2026 that it is acquiring CardinalOps, an AI-native threat detection engineering startup, for an undisclosed price. The Cribl CardinalOps acquisition matters to CTOs, CISOs, SOC leaders, and platform teams because Cribl says the deal adds detection engineering aimed at threat coverage, lower data costs, and SIEM modernization.
What changed
Cribl said it is acquiring CardinalOps and that the purchase price was not disclosed. Calcalist Tech reported the deal is estimated at approximately $100 million, a figure the companies have not confirmed. Cribl also said it will establish a new office in Tel Aviv.
CardinalOps was founded in early 2020 and is led by Michael Mumcuoglu and Yair Manor. SiliconANGLE reported that CardinalOps built AI tools for identifying, managing, and reducing threat exposure, and that it automates detection engineering while helping teams find coverage gaps and noisy rules.
Why B2B teams should care
Cribl says the acquisition extends its AI Platform for Telemetry into security operations, and that CardinalOps adds detection engineering capabilities to improve threat coverage and lower data costs across SIEM, data lake, and XDR systems.
Cribl also says the combination supports a complete, open alternative to legacy SIEM architectures, and that customers can modernize at their own pace using preferred tools and architectures. Every claim about what the combined platform will do is, at this stage, Cribl’s own — no independent evaluation of the integrated product exists yet.
Who is affected
The clearest audience is security operations centers, CISOs, detection engineering teams, and enterprise platform owners running or reworking SIEM programs.
Existing CardinalOps staff are also affected. Calcalist Tech reported that CardinalOps employs approximately 25 people and has raised about $40 million, and that its employees will join Cribl.
Cribl’s announcement quotes Repsol Global CISO Javier García Quintela, who said the combination improves detection posture and telemetry management.
What teams should check now
- Whether current SIEM, data lake, and XDR deployments depend on separate detection engineering workflows that CardinalOps is designed to automate.
- Whether teams have known coverage gaps or high volumes of noisy detection rules, which SiliconANGLE reported CardinalOps is built to identify and reduce.
- Whether telemetry management and detection engineering are owned by separate teams today, since Cribl says CardinalOps adds a detection layer on top of its telemetry infrastructure.
What remains unclear
- Not yet confirmed: the acquisition price, which the companies did not disclose.
- Not yet confirmed: whether the roughly $100 million figure reported by Calcalist Tech reflects a company-confirmed valuation.
- Not yet confirmed: when the transaction will close.
- Not yet confirmed: when CardinalOps capabilities will be integrated into Cribl’s platform, which Cribl describes only as soon.
What to watch next
The next concrete signal is product integration: Cribl said it is integrating CardinalOps capabilities into its platform soon, without giving a schedule. The Tel Aviv office Cribl said it will open is the second observable marker that the deal is being executed rather than announced.
