Follow the Acquisitions: Security's Real Fight Is Over the Data Layer

Every vendor briefing I’ve sat through this year opens the same way. There’s a slide about agentic AI, then a demo of an assistant writing a query, then a promise that triage gets faster. Then I ask where my data lives, who decides what gets kept, and what it costs to leave. The room gets quieter.

Press releases can say anything. Acquisitions are harder to fake, because they cost real capital and are hard to undo. Read the last two years of security deals and you’ll see the money went into the plumbing (telemetry pipelines, observability platforms, security data lakes) far more than into detection logic or AI models. The real fight is over who controls your security data layer.

This matters most if you’re about to sign a multi-year SIEM, platform or MSSP contract. A telemetry pipeline is the layer that collects logs and events, then filters, reshapes and routes them before anything stores or analyzes them. Whoever owns that layer decides what you keep, what you pay to keep it and how hard it is to leave. Pick a vendor on the strength of an AI demo and two years later you may find the demo was the easy part. The data layer is the part of the contract you can’t get out of.

The deal trail points one way

Here’s the trail, oldest first. Values are what the buyer or seller disclosed. Where the final number differs from the headline, the table says so.

Deal	Completed	What the buyer got	Disclosed value
Cisco acquires Splunk	Mar 2024	Enterprise-scale machine-data search and analytics	About $28B equity value
Exabeam and LogRhythm merge	Jul 2024	Scale for two SIEM vendors under one name	Not disclosed
Palo Alto Networks buys IBM’s QRadar SaaS	Aug 2024	QRadar SaaS customers and assets (IBM kept QRadar on-premises)	$500M upfront, plus payments tied to migrating customers
CrowdStrike agrees to buy Onum	Agreed Aug 2025	Real-time telemetry pipeline	About $290M, per CrowdStrike’s 10-Q
SentinelOne buys Observo AI	Sep 2025	Security data pipeline	About $185M purchase consideration, per SentinelOne’s 10-K
Palo Alto Networks buys Chronosphere	Jan 2026	Observability data platform for metrics, logs and traces at cloud scale	Agreed at $3.35B in cash and equity
Cribl buys CardinalOps	Announced Jul 2026	AI-driven detection engineering	Not disclosed
Databricks buys Panther	Aug 2026	An AI SOC platform for its security lakehouse	Not disclosed
Cribl buys Radiant Security’s AI SOC technology	Announced Aug 2026	Automated alert triage and investigation	Not disclosed

The headline figures give you the scale. The direction matters more. The table runs from 2024 consolidation, to 2025 pipeline purchases, to 2026 data companies buying detection. Every step either takes control of where security data flows or attaches something to whoever already controls it.

Pipelines were bought, not built

The 2024 deals looked like classic consolidation. Splunk was a data platform before it was a security brand. Most of its value is the ability to ingest and search huge volumes of machine data, and security happens to be one of the heaviest uses. When Palo Alto took over QRadar SaaS, the payment structure (upfront cash plus amounts tied to migrating customers) tells you what was being bought. In my reading, it was the installed base and its data flows, more than the detection content.

2025 is where the pattern sharpened. Two endpoint vendors, CrowdStrike and SentinelOne, each bought a telemetry pipeline company within weeks of each other: CrowdStrike’s agreement for Onum in August, and Observo AI for SentinelOne in September. Both already had data platforms. What they lacked was control of the data before it lands, which is the point where you decide what’s worth paying to store.

Then Palo Alto completed the Chronosphere deal in January 2026. It’s the largest number in the recent set, and Chronosphere isn’t a detection company. It’s an observability data platform.

That’s not a coincidence. It’s a bet on where the margin and the lock-in live.

In 2026 the pipeline vendor moved up

I’d been expecting a pipeline company to move up into analytics rather than wait to be bought. This year it happened. Cribl, the best-known independent pipeline vendor, announced it was acquiring CardinalOps in July. CardinalOps uses AI to test how well your detections cover real attacker techniques. In August Cribl bought Radiant Security’s AI SOC technology, which triages and investigates alerts. On September 29 it launched Cribl Detect and positioned it as a SIEM.

The data platforms are making the same move. Databricks announced in June that it would acquire Panther, and completed the deal in August. Databricks describes Panther as an AI SOC platform and is pairing it with Lakewatch, its own SIEM built on a security lakehouse. A security lakehouse keeps security data in open formats in a data lake and runs detection and search on top of it, instead of inside a SIEM’s proprietary store.

So the deals come from both directions. Security vendors buy pipelines. Pipeline and data companies buy detection and triage. In this trail, nobody bought detection as a standalone business. Detection gets bolted onto whoever holds the data.

What I see on the buyer side

The deal trail is public. Here’s what it looks like from the side of the table that signs the contract.

When I’ve evaluated MSSPs recently, more of them are building their own data pipelines for faster detection instead of routing everything to your SIEM first. That can be a real improvement. It also means the provider now owns part of your data layer: the parsing, the routing logic, the decisions about what gets dropped. The contract has to spell out what you get back when the relationship ends.

Your SIEM provider is building a pipeline too. In my experience it’s usually limited in what it can do, or it’s billed in a way that stops you scaling it into a real pipeline. If filtering and routing are priced on the same per-volume meter as storage, the feature that’s supposed to cut your costs gets more expensive the more you use it.

Dedicated pipeline tools are the third option, and they aren’t cheap either. The ROI case is almost always built on savings, which means you have to be moving a lot of data before the tool pays for itself. They also need ongoing care: parsers break when sources change, and routes drift. In my experience that maintenance pushes total cost of ownership well past the license line.

None of these options is wrong. Each one just hands the data layer to somebody, and the acquisitions say the vendors know that’s the valuable part. I’ve written before about why the SIEM’s storage economics push teams toward a data lake. The deal trail is the vendors’ side of that same argument.

Ask these before the AI demo

AI features are table stakes in every briefing now, because every vendor has to have an AI story. The AI can only work with the data it can reach. That’s why I’d put these questions ahead of the demo:

Question	What a specific answer looks like	What should worry you
Can you ingest what my environment actually produces, at a cost that doesn’t force constant trade-offs?	Pricing modeled on your real sources and volumes	“We’ll size it after onboarding”
Can I filter, route and transform data before it’s billed?	Pipeline control you configure yourself, with its pricing shown separately	Filtering exists but is billed on the ingest meter
How do hot, warm and cold tiers work, and how do I query across them?	One query path across tiers, with rehydration time and cost stated	Cold data needs a ticket or a separate tool
What format is my data stored in, and can I read it without you?	Open formats and schemas you can query directly	Export only through a proprietary API
Who owns the parsers, pipeline configs and detection content we build?	You do, in a form you can export	Silence, or “it’s part of the platform”

The last row is the one I see skipped most often. Teams spend months tuning parsers and detections inside a platform, and that work is often the hardest thing to carry out.

If you want the architecture behind these questions, this piece on making a data lake answer real questions goes deeper on schemas and query paths.

Portability belongs in the contract

Vendors betting on the data layer want your data flows to be sticky. That’s rational for them. Your job is to make leaving a cost you’ve already priced, not a surprise.

How I’d approach the contract:

• Data export. Written rights to export all your data in an open, documented format, with any fees and timelines stated up front.
• Content ownership. Parsers, pipeline configurations, detection rules and playbooks you or the provider built for you are yours, and they’re handed over at exit.
• MSSP exit terms. If the provider runs a pipeline for you, the handover covers the pipeline configuration as well as the logs.
• Change of control. The table above is a list of products whose owner changed. Know what happens to your pricing, roadmap and migration support if your vendor is acquired, because QRadar SaaS customers got to find out.
• Pricing mechanics. Get in writing how filtering, routing and tier moves affect the bill.

Which of these you fight hardest for depends on your business: how many sources you run, how often you change providers, and how much of your detection content you built yourself.

Where this reading could be wrong

Acquisitions have more than one motive. Revenue, customer lists, talent and filling a gap in a product line all play a part. Chronosphere is also an observability-market play, not only a security one. I’m reading intent from a handful of deals, and that’s interpretation, not proof.

Detection quality still matters too. A clean data layer with weak detection catches nothing. My claim is narrower: detection is getting easier to replace, and the data layer is getting harder to.

I’m still working out how to weigh owning the pipeline against the convenience of a single platform. The answer seems to shift with team size and data volume. If you’ve made that call recently, in either direction, I’d like to compare notes.

What to do with this

Good (this week): Pull your current SIEM, platform and MSSP contracts. Find the clauses on data export, ownership of parsers and detection content, and change of control. Note which ones are missing.

Better (this quarter): Map where pipeline control sits in your environment today and who maintains it, whether that’s your team, your SIEM vendor or your MSSP. Add the five questions above to your next vendor evaluation, and put them before the AI demo.

Best (this half): Before your next renewal, choose your data-layer strategy on purpose: own the pipeline, rent it from your SIEM, or let your MSSP run it. Cost each option with maintenance included, not just the license. Then negotiate the portability terms that strategy depends on. And when the next security acquisition hits the news, ask what the buyer didn’t have that it just paid for. That’s free market intelligence.

---

David O’Neil is a CISO who has spent two decades on the buying side of security platforms, and who builds his own tools to test what vendors claim.