Cribl, Swimlane detail AI-focused security operations moves

Cribl said the purchase covers the intellectual property behind Radiant's software that triages, investigates and resolves security alerts on its own. Terms were not disclosed. Cribl is adapting the technology to run as an application on its telemetry platform, where the AI works against data the platform already collects and routes. Rather than the prebuilt playbooks most tools rely on, Radiant's software builds triage logic on the fly for each alert that arrives, then runs the investigation directly against telemetry wherever that data sits, according to Cribl. The combination should cut false positives and speed up threat detection, the company said.

“Too much of the $121 billion security market is trapped in data silos, giving security teams incomplete information,” said Clint Sharp, co-founder and chief executive of Cribl. “By pairing AI SOC technology with Cribl’s open telemetry platform, we’re ending the era of siloed solutions and giving security teams the intelligence they need, right when AI is reshaping the entire operations landscape.”

This is Cribl’s second security deal of 2026. In July, it bought Israeli detection engineering startup CardinalOps Ltd., whose platform maps a customer’s detection rules to the MITRE ATT&CK framework and flags where coverage is missing. Cribl has argued that capabilities that once justified a standalone product now make more sense running on shared telemetry infrastructure. Another disconnected tool, in that reading, just spawns another data silo. Andrew Braunberg, principal analyst at Omdia, said Cribl’s approach centers on “transforming raw telemetry into a unified foundation for AI-driven applications.” Radiant Security’s platform automates alert triage and investigation, connecting to security tools a customer already runs. Next47 led a $15 million Series A round into the company in November 2023. Cribl was valued at $3.5 billion as of its last funding round in August 2024.

Swimlane, a company focused on agentic AI cybersecurity automation, said its new capability enables routing of incoming alerts to different paths: deterministic automation, AI-assisted investigation or agentic automation. The front-end triage allows the system to assess the complexity of the work and the level of AI involvement needed, without defaulting every task to expensive AI models.

“As AI consumption continues to rise, the next generation of the SOC will not be able to run every task through AI by default. It will know which work actually needs AI,” said co-founder and Chief Executive Cody Cornell. He said at the scale of hundreds of thousands of investigations, $5 to $10 for each investigation piles up quickly. Routing each alert to the appropriate model for the appropriate level of reasoning is meant to provide the correct layer of assistance without breaking the bank. If a simple alert routed to deterministic automation turns out to be more complex, the security team can still route it to a higher-reasoning model, meaning humans remain in control.

“Customers can expand what their SOC can handle without replacing an analyst-capacity problem with an AI-spend problem,” Cornell said. Swimlane said the router helps prevent everything from being processed by high-reasoning AI models, since some alerts are false positives or can be handled by scripts. The system learns what alerts the team wants evaluated and turns them into repeatable playbooks. A healthcare customer investigating more than 180 threats a day achieved a 90% cost savings by using intelligent routing, reserving agentic AI evaluation for only the most complex 10% of threats.

“Swimlane pairs the speed and predictability of automation with AI where reasoning and judgment create real value,” said Cornell. More additions to Cribl’s platform are due at CriblCon, its annual user conference, on Sept. 28.