The list. Scanner made the 2026–2027 Fortune Cyber 60 in the early-stage group. Fortune’s profile lists it in San Francisco with 39 employees and CEO Cliff Crosland, and says it was founded in 2021 (Sequoia’s page says 2022). Fortune reports $22 million in funding. That matches the Series A Sequoia led in March 2026, with CRV and Mantis VC joining. Angels include Vanta CEO Christina Cacioppo and Tom Killalea, Amazon’s first CISO. In July, SVCI, a syndicate of working CISOs, also invested; the amount was not disclosed. Valuation and revenue are Undisclosed. Lightspeed, which helps run the Cyber 60, is not listed as an investor.
The problem, in plain words. Every security team keeps logs: logins, cloud API calls, firewall and EDR events. A SIEM makes those logs searchable, but it charges by how much you send in. So teams send in a slice and keep the rest in cheap cloud storage like Amazon S3. Scanner says most teams can watch only about 10% of their telemetry. That is a company claim, but every SOC lead will recognize it. The other 90% sits in storage where a search can take hours. When a new threat report lands, the question is “were we hit six months ago?” The honest answer is often “we can’t check fast enough.”
The unique part: an index built for slow storage. Scanner doesn’t move your logs into its own system. It reads each log once and writes a compact search index back into object storage in your cloud account. Scanner says that index comes in around 15% of the raw volume. The trick is the read pattern. A normal search index makes many small reads, which is fast on a local disk and painfully slow on S3, where each request takes hundreds of milliseconds to start. Scanner flips it: a few large reads, spread across many short-lived workers that spin up for a query and scale to zero after. Standing detection rules run as data arrives, not by re-scanning old data on a timer. The engine is written in Rust. Its new V6 storage format, released October 28, is about 25% smaller and runs 1.5 to 3 times faster on real CloudTrail logs, by Scanner’s own benchmark. Your data stays in your bucket, which matters to anyone who has tried to leave a SIEM.
Why it’s winning now: agents. This is the part that got Scanner on the list. In March, Scanner said AI agents had become its most active users in just 12 weeks. By July it said agents generate more than 80% of query volume. An AI agent investigating one alert may run dozens of searches. If each takes minutes, or costs money per scan, the agent is useless. Notion built a security agent called Scruff that pulls log history from Scanner through MCP, the standard way agents call tools, alongside Wiz and CrowdStrike. Scanner cites an 84% cut in investigation time. That is a customer number relayed by the vendor. Named customers include Notion, Ramp, BeyondTrust, Lemonade, Postman and Benchling, per Scanner.
The risk: everyone wants the data layer. Scanner is not alone. Cribl now sells its own SIEM, Cribl Detect, and bought its third company in four months this week. Splunk, Microsoft and Google all push their own data lakes. Snowflake and Databricks court security teams directly. Scanner’s answer is speed on cheap storage, plus an API that agents like. A $22 million company has to prove its index holds up at hundreds of terabytes a day before a bigger platform ships good enough.
Our read. The AI SOC is crowded. Scanner itself counts more than 100 vendors pitching one. Most are a chat window on top of the same slow data. Scanner is betting the opposite way: the agent is a commodity, and the data under it is the moat. We think that is right. A smart agent with 30 days of logs loses to an average agent with two years of logs it can search in seconds. The open question is pricing. If agents run most queries, Scanner earns on compute, not seats. That is a better model, but a harder one to forecast.
For practitioners. List the log sources you don’t send to your SIEM because of cost. VPC flow logs, DNS and raw EDR telemetry usually top the list. Those are the blind spots an attacker, or an attacker’s agent, will use.
Which logs are you paying to store but can’t realistically search today?