Cribl acquires Radiant Security's AI SOC tech to run on its telemetry platform

Cribl, the telemetry data company valued at $3.5 billion, has acquired technology assets from Radiant Security, an AI-native security operations center startup. The deal brings Radiant's autonomous alert triage and investigation software into Cribl's platform, where it will run as an application against the telemetry data Cribl already collects and routes. This is Cribl's second security acquisition of 2026, following the July purchase of CardinalOps.

How Radiant's AI triage works differently

Most security tools rely on prebuilt playbooks for alert response. Radiant's software builds triage logic on the fly for each alert that arrives, then runs the investigation directly against telemetry data wherever it sits. Cribl says this approach should cut false positives and speed up threat detection. The system connects to the security tools a customer already runs, so it doesn't require replacing existing infrastructure.

Why running on Cribl's telemetry platform matters

Cribl's core business is collecting, routing, and managing telemetry data from across an organization. By adapting Radiant's AI SOC technology to run as an application on that platform, Cribl argues it can eliminate the data silos that plague security operations. CEO Clint Sharp said, "By pairing AI SOC technology with Cribl's open telemetry platform, we're ending the era of siloed solutions and giving security teams the intelligence they need." Andrew Braunberg of Omdia described Cribl's approach as "transforming raw telemetry into a unified foundation for AI-driven applications."

For builders, this means the AI triage engine has direct access to the full telemetry stream without needing to ingest data through another pipeline. That reduces latency and operational complexity.

Cribl's broader security strategy

The Radiant acquisition follows Cribl's July 2026 purchase of CardinalOps, whose platform maps detection rules to the MITRE ATT&CK framework and identifies coverage gaps. Together, the two acquisitions give Cribl both detection engineering and automated incident response capabilities on a shared telemetry foundation. Cribl's argument is that standalone security tools create their own data silos, and running them on a common telemetry platform avoids that problem.

What's next and caveats

Cribl plans to reveal more platform enhancements at its CriblCon user conference on September 28. The acquisition terms were not disclosed. Radiant Security had raised a $15 million Series A led by Next47 in November 2023. Cribl's last funding round in August 2024 valued the company at $3.5 billion.

A few things to watch: The technology is being adapted to run on Cribl's platform, so integration timelines and feature parity with Radiant's standalone product are not yet clear. Cribl has not published benchmarks or independent validation of the AI triage accuracy. The company's claims about reducing false positives and speeding detection are vendor statements, not independently verified results. Security teams evaluating the platform should test against their own telemetry and alert volumes.