The deal. On November 10, Cribl said it acquired Tero, a seed-stage startup that measures how much of a company’s telemetry is waste and lets engineers cut it. Terms were not disclosed. Tero’s founders join to lead Cribl’s work on host monitoring, application performance monitoring and AI-native observability. CEO Ben Johnson becomes Cribl’s VP of Observability. He previously co-founded Timber, which built the open-source Vector pipeline and was bought by Datadog in 2021. Cribl calls it its third acquisition in four months.
The pattern. Look at the sequence. July 14: Cribl buys CardinalOps, which maps detection rules to MITRE ATT&CK and finds gaps. Calcalist put the price at about $100 million; Cribl did not disclose terms. August 19: Cribl buys Radiant Security’s AI SOC technology, the assets and IP rather than the company. September 29: Cribl launches Cribl Detect, a complete SIEM it says costs up to 50% less than rivals. Cribl also says that move takes it into an $8.2 billion SIEM market. Both are Cribl’s figures. November 10: Tero, for observability. In four months, Cribl went from moving the data to selling the products that analyze it.
Why that matters. Cribl’s original pitch was simple. Put us between your sources and your tools, and we will trim, route and reshape the data so you send less to Splunk or Datadog. Buyers loved it because Cribl was neutral. It made money when you spent less with someone else. Cribl says half the Fortune 100 now run it. That neutrality was the product. A router that also sells a SIEM has a new incentive. Every routing decision is now also a sales decision.
Our point of view. This was always going to happen. The pipe sees every byte, knows what each customer pays downstream, and already sits in the budget. Datadog bought Timber, a pipeline company, in 2021. Own the pipeline, own the account. Cribl is doing it in reverse, starting from the pipe and moving up into the tools. It is a smart business move. It is also the end of Cribl as a neutral party. Buyers should treat it that way.
The money question. Cribl’s last public valuation was $3.5 billion, set in a $319 million Series E in August 2024. Nothing newer has been disclosed, so today’s value is Undisclosed. Three deals in four months, a SIEM launch and a new observability line read like a company building a bigger story for its next raise or an IPO. Platform stories get platform multiples. That only works if customers actually buy the new products, not just the pipe. Cribl has not disclosed attach rates for Detect.
Why Thursday matters. Cisco reports first-quarter fiscal 2027 results on Thursday, November 12, after the close. Cisco paid about $28 billion for Splunk in 2024. Splunk is the SIEM Cribl was born to make cheaper, and now competes with directly. Don’t expect Cisco to name Cribl on the call. Listen instead for how Cisco describes Splunk renewals, ingest-based pricing and data that customers keep outside Splunk. Any move to federated search or lower data costs is a response to the pipeline vendors.
What would change our mind. If Cribl keeps Stream, its routing product, priced and sold separately, keeps sending data to rival SIEMs without friction, and publishes that commitment, neutrality survives. If Detect starts showing up as a discount bundled with Stream renewals, it does not.
For practitioners. If Cribl sits in your pipeline, read your contract today. Check who owns the routing rules, what exporting your configs costs, and whether you can still send full-fidelity data to any destination at the same price. Write that into the next renewal before you are asked to buy Detect.
If your log pipeline vendor also sold you a SIEM, would you still trust it to decide which data goes where?