The news
Cribl, which built its business routing security and IT logs between tools, launched the Cribl Detect SIEM on September 29. The company says Detect delivers a complete security information and event management system at up to 50% less cost than other companies.
A SIEM collects logs and alerts from across an organization and analyzes them to spot attacks. Cribl said Detect is built on its existing data platform and adds AI-driven detection, triage and investigation. According to Cribl and Security Boulevard, Detect can run detections on data as it moves through pipelines and can search data where it already sits, in data lakes and object storage, rather than requiring it to be copied into one central store first.
Detect also includes detection posture management, which maps a team's detection rules against MITRE ATT&CK, a public catalog of attacker techniques, to show coverage gaps, broken or noisy rules and missing data, Cribl said.
The pricing model is the main pitch. Cribl says Detect is priced on the infrastructure it runs on rather than on the volume of data analyzed, so teams can re-run searches without paying again each time. Nicole Beckwith, Cribl's senior director of security engineering and operations, told TechTarget that at list price this works out to roughly $18,000 to $20,000 per terabyte per month, and that it scales down with volume.
Detect is available now for Cribl.Cloud customers, the company said. TechTarget reported that it is not yet supported on-premises or in self-managed environments, which the outlet described as a showstopper for potential customers in regulated industries. The product was announced at Cribl's CriblCon event, according to Security Boulevard.
The launch builds on two acquisitions: CardinalOps in July and Radiant Security in August, TechTarget reported. Cribl put the SIEM market at $8.2 billion. Clint Sharp, Cribl's co-founder and CEO, said in the announcement: "Customers don't want the SIEM they have today." Cribl says over half of the Fortune 100 use its products.
The numbers
- Claimed cost versus other SIEMs (Cribl)
- Up to 50% less
- List price cited by Cribl's Nicole Beckwith (via TechTarget)
- Roughly $18,000–$20,000 per TB per month, lower at volume
- SIEM market size (Cribl figure)
- $8.2 billion
- Share of Fortune 100 using Cribl (company claim)
- Over half
Why CEOs should care
For CISOs, the biggest change is the billing model. Traditional SIEMs are typically priced on the volume of data ingested, queried or analyzed, as TechTarget and Security Boulevard described them; Cribl is charging for the infrastructure instead. Before taking the 50% claim at face value, ask Cribl to model your own data volumes, retention periods and search habits, and compare that figure with your current bill. The list price Beckwith gave TechTarget is a starting benchmark, not a quote.
Test the hard parts early. Steve Koelpin, a principal AI observability engineer at a Fortune 50 company who spoke to TechTarget without naming his employer, said the feature to take seriously is federation, and that the test that matters is search performance on cold storage across months of data. He also said Cribl's assisted translation of Splunk and Sigma rules still leaves migration a real project rather than a switch. Budget for that time, and confirm whether your compliance rules allow a cloud-only SIEM, since self-managed deployment is not yet supported.
For CFOs and procurement teams, a credible new entrant is leverage even if you never switch. If your SIEM contract renews in the next year, use Cribl's infrastructure-based pricing as a reference point and ask your incumbent whether it will stop charging for re-analysis of data you already pay to store. Existing Cribl customers should also ask a direct question: will Cribl keep routing data to rival SIEMs as well as it does today, now that it sells one of its own?
The bigger picture
Cribl started as a tool that cut the amount of data companies sent to Splunk, which prompted a Splunk lawsuit that was eventually settled, TechTarget noted. Selling a SIEM puts Cribl in direct competition with the platforms it has fed for years. It is not the first to try federated search, which leaves data in place: IDC's Michelle Abraham told TechTarget that an earlier wave of federated tools came from vendors such as Panther and Hunters. Security Boulevard noted it is not clear how quickly security teams will be willing to replace their existing SIEMs.
What’s next
Watch for on-premises and self-managed support, which would open Detect to regulated buyers, and for named customers willing to share real cost comparisons. Also watch how incumbent SIEM vendors respond on pricing at renewal time.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
