Cribl acquires CardinalOps
Analysis based on 9 articles · First reported Jul 14, 2026 · Last updated Jul 14, 2026
The acquisition strengthens Cribl's position in the cybersecurity market by adding AI-driven detection engineering, potentially accelerating its path to IPO. It also signals consolidation in the SIEM replacement space, which may impact competitors like Splunk and Palo Alto Networks.
Cribl, the AI Platform for Telemetry, announced on July 14, 2026, that it is acquiring CardinalOps, an Agentic Detection Engineering solution. The acquisition adds detection engineering capabilities to help customers improve threat coverage, lower data costs, and strengthen their SOCs, creating a flexible path toward replacing legacy SIEM architectures. CardinalOps was founded in 2020 and is led by Michael Mumcuoglu and Yair Manor, veterans of IDF's Unit 8200, whose previous companies were acquired by Palo Alto Networks and Microsoft. As part of the acquisition, Cribl will establish a new office in Israel — Tel Aviv, Israel, to tap into local cybersecurity talent. The integration of CardinalOps technology into the Cribl platform will bring Cribl's security capabilities together into a complete, open alternative to legacy SIEM architectures.
Set up alerts, explore entity relationships, search across thousands of events, and build custom intelligence feeds.
Open Dashboard