Telemetry vendor Cribl has acquired the technology assets of Radiant Security’s AI-native security operations center product. The automated alert-triage capabilities are set to run as an application on the Cribl platform — the company’s second security acquisition this year after CardinalOps in July.
Cribl, a telemetry platform provider, has acquired the technology assets of Radiant Security’s AI-native security operations center (SOC) product. According to the company, the deal includes the intellectual property behind the process for autonomous triage, investigation and resolution of security alerts. It is Cribl’s second security technology acquisition this year, following its purchase of CardinalOps in July. Financial terms of the transaction were not disclosed.
Cribl plans to adapt the acquired AI-SOC technology so it runs as an application on its own telemetry data platform rather than continuing as a standalone product. The company states that its platform makes telemetry data operational regardless of where it is stored, which it says enables faster and more precise threat analysis. The acquired AI-SOC capabilities generate individual triage logic for each alert on the fly, instead of relying on predefined playbooks, and run these analyses directly against telemetry data wherever it resides. Security teams should be better able to identify threats and reduce false positives as a result. Cribl also says the change should make incident response a more integrated part of day-to-day operations, rather than a separate process with its own toolset.
Clint Sharp, co-founder and CEO of Cribl, frames the move as a response to fragmentation in the security market. According to Sharp, much of the information within what he described as a $121 billion security market is locked in data silos, leaving security teams with an incomplete picture. By combining AI-SOC technology with Cribl’s open telemetry platform, the company aims to replace isolated point solutions and give security teams the information it says they need as AI reshapes operations.
The acquisition fits a broader trend in which capabilities previously sold as standalone security products increasingly run on a shared telemetry platform. Cribl argues that separate tools with their own data stores tend to create new silos, while a shared platform is intended to avoid that outcome. For resellers and systems integrators in the DACH region, which have typically equipped customers with individual SOC and SIEM tools from different vendors, this kind of consolidation could over time affect portfolio and advisory strategies, as functions that were previously procured and operated separately converge.
Andrew Braunberg, principal analyst at Omdia, offers an outside perspective on the move, saying Cribl’s approach centers on transforming raw telemetry data into a unified foundation for AI-powered applications. By building AI SOC, threat detection and observability on top of its open data platform, he says Cribl allows organizations to customize their security stacks and make better use of data they already hold.
According to Cribl, the acquisition marks only the beginning of the platform’s expansion into security, with further additions to be announced at CriblCon on September 28, 2026. The company did not specify how the Radiant Security technology will be integrated into existing Cribl products or when it will become available to customers.
Cribl was founded in 2018, says it employs a largely remote workforce, and maintains an office in San Francisco. The company states that half of the Fortune 100 use its platform and describes it as vendor-agnostic, aiming to keep data portable without vendor lock-in.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de