Cribl Acquires CardinalOps to Add TTP-Based Detection Engineering

Cribl announced on July 14, 2026 that it is acquiring CardinalOps, a Tel Aviv-founded startup specializing in agentic detection engineering, in a deal reportedly valued at around $100 million. The move extends Cribl's AI Platform for Telemetry directly into security operations, giving customers automated tools to continuously measure MITRE ATT&CK coverage and manage detection quality across their existing security stack.

CardinalOps brings: The company uses AI to map an organization's security controls against real-world adversary tactics, techniques, and procedures (TTPs), continuously testing whether detections actually work as intended. It can flag broken or noisy rules, surface gaps where threats might slip through undetected, and help SOC teams improve coverage without manually auditing every control, work that has traditionally required significant manual detection-engineering effort.

The strategic logic: Cribl frames this as building "a complete, open alternative to the SIEM stack" customers have outgrown, rather than forcing them into another rigid, all-or-nothing platform. Cribl's existing strength is collecting, routing, storing, and searching telemetry across an organization's environment; CardinalOps adds the detection layer on top of that same data, letting customers move from raw telemetry to validated, actionable detections without replacing tools they already rely on. CEO Clint Sharp said the goal is giving security teams "a better way to turn telemetry into effective detections and outcomes."

CardinalOps was founded in 2020 by Michael Mumcuoglu (CEO) and Yair Manor (CIO), both veterans of IDF Unit 8200 with a track record of building companies later acquired by Palo Alto Networks and Microsoft. Mumcuoglu framed the company's mission as addressing a common SOC problem: "Too many security teams have good data, powerful tools, and endless alerts, but no real confidence that they are actually protected." Following the deal, CardinalOps' team joins Cribl, which will open a new Tel Aviv office and expand its Israeli operations, tapping further into the region's cybersecurity talent pool.

In summery, Cribl is one of the fastest-growing US cybersecurity infrastructure companies, with annual recurring revenue exceeding $300 million. This acquisition marks its first major move from pure telemetry management into the detection-engineering layer of security operations, positioning it more directly against traditional SIEM vendors while framing its approach as open and vendor-agnostic rather than a closed replacement platform.