--- title: "Follow the Acquisitions: Security's Real Fight Is Over the Data Layer" summary: "Two years of security deals put the money into telemetry pipelines, observability and security data lakes, not detection or AI models. If you're about to sign a SIEM, platform or MSSP contract, judge vendors on who controls your data and how you get it back, not on the AI demo." canonical: "https://cisoexpert.com/articles/4-billion-bet-on-data-pipes" publishedAt: 2026-10-02 --- # Follow the Acquisitions: Security's Real Fight Is Over the Data Layer # Follow the Acquisitions: Security's Real Fight Is Over the Data Layer Every vendor briefing I've sat through this year opens the same way. There's a slide about agentic AI, then a demo of an assistant writing a query, then a promise that triage gets faster. Then I ask where my data lives, who decides what gets kept, and what it costs to leave. The room gets quieter. Press releases can say anything. Acquisitions are harder to fake, because they cost real capital and are hard to undo. **Read the last two years of security deals and you'll see the money went into the plumbing (telemetry pipelines, observability platforms, security data lakes) far more than into detection logic or AI models. The real fight is over who controls your security data layer.** This matters most if you're about to sign a multi-year SIEM, platform or MSSP contract. A telemetry pipeline is the layer that collects logs and events, then filters, reshapes and routes them before anything stores or analyzes them. Whoever owns that layer decides what you keep, what you pay to keep it and how hard it is to leave. Pick a vendor on the strength of an AI demo and two years later you may find the demo was the easy part. The data layer is the part of the contract you can't get out of. ## The deal trail points one way Here's the trail, oldest first. Values are what the buyer or seller disclosed. Where the final number differs from the headline, the table says so. | Deal | Completed | What the buyer got | Disclosed value | |---|---|---|---| | [Cisco acquires Splunk](https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m03/cisco-completes-acquisition-of-splunk.html) | Mar 2024 | Enterprise-scale machine-data search and analytics | About $28B equity value | | [Exabeam and LogRhythm merge](https://www.thomabravo.com/press-releases/exabeam-and-logrhythm-complete-merger-and-announce-new-company-details) | Jul 2024 | Scale for two SIEM vendors under one name | Not disclosed | | [Palo Alto Networks buys IBM's QRadar SaaS](https://www.ibm.com/investor/news/ibm-and-palo-alto-networks-to-jointly-provide-ai-powered-security-offerings) | Aug 2024 | QRadar SaaS customers and assets (IBM kept QRadar on-premises) | $500M upfront, plus payments tied to migrating customers | | [CrowdStrike agrees to buy Onum](https://www.sec.gov/Archives/edgar/data/1535527/000153552725000025/crwd-20250731.htm) | Agreed Aug 2025 | Real-time telemetry pipeline | About $290M, per CrowdStrike's 10-Q | | [SentinelOne buys Observo AI](https://www.sec.gov/Archives/edgar/data/1583708/000158370826000020/s-20260131.htm) | Sep 2025 | Security data pipeline | About $185M purchase consideration, per SentinelOne's 10-K | | [Palo Alto Networks buys Chronosphere](https://www.paloaltonetworks.com/company/press/2026/palo-alto-networks-completes-chronosphere-acquisition--unifying-observability-and-security-for-the-ai-era) | Jan 2026 | Observability data platform for metrics, logs and traces at cloud scale | Agreed at $3.35B in cash and equity | | [Cribl buys CardinalOps](https://cribl.io/news/cribl-acquires-cardinalops-to-expand-its-ai-platform-into-security-operations/) | Announced Jul 2026 | AI-driven detection engineering | Not disclosed | | [Databricks buys Panther](https://www.databricks.com/blog/databricks-completes-acquisition-panther-accelerating-security-lakehouse-era) | Aug 2026 | An AI SOC platform for its security lakehouse | Not disclosed | | [Cribl buys Radiant Security's AI SOC technology](https://cribl.io/news/cribl-advances-ai-powered-security-operations-with-new-ai-soc-acquisition/) | Announced Aug 2026 | Automated alert triage and investigation | Not disclosed | The headline figures give you the scale. The direction matters more. The table runs from 2024 consolidation, to 2025 pipeline purchases, to 2026 data companies buying detection. Every step either takes control of where security data flows or attaches something to whoever already controls it. ## Pipelines were bought, not built The 2024 deals looked like classic consolidation. Splunk was a data platform before it was a security brand. Most of its value is the ability to ingest and search huge volumes of machine data, and security happens to be one of the heaviest uses. When Palo Alto took over QRadar SaaS, the payment structure (upfront cash plus amounts tied to migrating customers) tells you what was being bought. In my reading, it was the installed base and its data flows, more than the detection content. 2025 is where the pattern sharpened. Two endpoint vendors, CrowdStrike and SentinelOne, each bought a telemetry pipeline company within weeks of each other: [CrowdStrike's agreement for Onum](https://www.sec.gov/Archives/edgar/data/1535527/000153552725000025/crwd-20250731.htm) in August, and [Observo AI for SentinelOne](https://www.sec.gov/Archives/edgar/data/1583708/000158370826000020/s-20260131.htm) in September. Both already had data platforms. What they lacked was control of the data *before* it lands, which is the point where you decide what's worth paying to store. Then Palo Alto [completed the Chronosphere deal](https://www.paloaltonetworks.com/company/press/2026/palo-alto-networks-completes-chronosphere-acquisition--unifying-observability-and-security-for-the-ai-era) in January 2026. It's the largest number in the recent set, and Chronosphere isn't a detection company. It's an observability data platform. That's not a coincidence. It's a bet on where the margin and the lock-in live. ## In 2026 the pipeline vendor moved up I'd been expecting a pipeline company to move up into analytics rather than wait to be bought. This year it happened. Cribl, the best-known independent pipeline vendor, [announced it was acquiring CardinalOps](https://cribl.io/news/cribl-acquires-cardinalops-to-expand-its-ai-platform-into-security-operations/) in July. CardinalOps uses AI to test how well your detections cover real attacker techniques. In August Cribl [bought Radiant Security's AI SOC technology](https://cribl.io/news/cribl-advances-ai-powered-security-operations-with-new-ai-soc-acquisition/), which triages and investigates alerts. On September 29 it [launched Cribl Detect](https://cribl.io/news/introducing-cribl-detect-delivering-a-new-way-to-siem/) and positioned it as a SIEM. The data platforms are making the same move. Databricks [announced in June](https://www.databricks.com/company/newsroom/press-releases/databricks-agrees-acquire-panther-further-establishing-security) that it would acquire Panther, and [completed the deal in August](https://www.databricks.com/blog/databricks-completes-acquisition-panther-accelerating-security-lakehouse-era). Databricks describes Panther as an AI SOC platform and is pairing it with Lakewatch, its own SIEM built on a security lakehouse. A security lakehouse keeps security data in open formats in a data lake and runs detection and search on top of it, instead of inside a SIEM's proprietary store. So the deals come from both directions. Security vendors buy pipelines. Pipeline and data companies buy detection and triage. In this trail, nobody bought detection as a standalone business. Detection gets bolted onto whoever holds the data. ## What I see on the buyer side The deal trail is public. Here's what it looks like from the side of the table that signs the contract. When I've evaluated MSSPs recently, more of them are building their own data pipelines for faster detection instead of routing everything to your SIEM first. That can be a real improvement. It also means the provider now owns part of your data layer: the parsing, the routing logic, the decisions about what gets dropped. The contract has to spell out what you get back when the relationship ends. Your SIEM provider is building a pipeline too. In my experience it's usually limited in what it can do, or it's billed in a way that stops you scaling it into a real pipeline. If filtering and routing are priced on the same per-volume meter as storage, the feature that's supposed to cut your costs gets more expensive the more you use it. Dedicated pipeline tools are the third option, and they aren't cheap either. The ROI case is almost always built on savings, which means you have to be moving a lot of data before the tool pays for itself. They also need ongoing care: parsers break when sources change, and routes drift. In my experience that maintenance pushes total cost of ownership well past the license line. None of these options is wrong. Each one just hands the data layer to somebody, and the acquisitions say the vendors know that's the valuable part. I've written before about [why the SIEM's storage economics push teams toward a data lake](/articles/2026-04-01-siem-cost-trap-data-lake-ai-agents). The deal trail is the vendors' side of that same argument. ## Ask these before the AI demo AI features are table stakes in every briefing now, because every vendor has to have an AI story. The AI can only work with the data it can reach. That's why I'd put these questions ahead of the demo: | Question | What a specific answer looks like | What should worry you | |---|---|---| | Can you ingest what my environment actually produces, at a cost that doesn't force constant trade-offs? | Pricing modeled on your real sources and volumes | "We'll size it after onboarding" | | Can I filter, route and transform data before it's billed? | Pipeline control you configure yourself, with its pricing shown separately | Filtering exists but is billed on the ingest meter | | How do hot, warm and cold tiers work, and how do I query across them? | One query path across tiers, with rehydration time and cost stated | Cold data needs a ticket or a separate tool | | What format is my data stored in, and can I read it without you? | Open formats and schemas you can query directly | Export only through a proprietary API | | Who owns the parsers, pipeline configs and detection content we build? | You do, in a form you can export | Silence, or "it's part of the platform" | The last row is the one I see skipped most often. Teams spend months tuning parsers and detections inside a platform, and that work is often the hardest thing to carry out. If you want the architecture behind these questions, [this piece on making a data lake answer real questions](/articles/2026-04-09-data-lake-searchability-architecture) goes deeper on schemas and query paths. ## Portability belongs in the contract Vendors betting on the data layer want your data flows to be sticky. That's rational for them. Your job is to make leaving a cost you've already priced, not a surprise. How I'd approach the contract: - **Data export.** Written rights to export all your data in an open, documented format, with any fees and timelines stated up front. - **Content ownership.** Parsers, pipeline configurations, detection rules and playbooks you or the provider built for you are yours, and they're handed over at exit. - **MSSP exit terms.** If the provider runs a pipeline for you, the handover covers the pipeline configuration as well as the logs. - **Change of control.** The table above is a list of products whose owner changed. Know what happens to your pricing, roadmap and migration support if your vendor is acquired, because QRadar SaaS customers got to find out. - **Pricing mechanics.** Get in writing how filtering, routing and tier moves affect the bill. Which of these you fight hardest for depends on your business: how many sources you run, how often you change providers, and how much of your detection content you built yourself. ## Where this reading could be wrong Acquisitions have more than one motive. Revenue, customer lists, talent and filling a gap in a product line all play a part. Chronosphere is also an observability-market play, not only a security one. I'm reading intent from a handful of deals, and that's interpretation, not proof. Detection quality still matters too. A clean data layer with weak detection catches nothing. My claim is narrower: detection is getting easier to replace, and the data layer is getting harder to. I'm still working out how to weigh owning the pipeline against the convenience of a single platform. The answer seems to shift with team size and data volume. If you've made that call recently, in either direction, I'd like to compare notes. ## What to do with this **Good (this week):** Pull your current SIEM, platform and MSSP contracts. Find the clauses on data export, ownership of parsers and detection content, and change of control. Note which ones are missing. **Better (this quarter):** Map where pipeline control sits in your environment today and who maintains it, whether that's your team, your SIEM vendor or your MSSP. Add the five questions above to your next vendor evaluation, and put them before the AI demo. **Best (this half):** Before your next renewal, choose your data-layer strategy on purpose: own the pipeline, rent it from your SIEM, or let your MSSP run it. Cost each option with maintenance included, not just the license. Then negotiate the portability terms that strategy depends on. And when the next security acquisition hits the news, ask what the buyer didn't have that it just paid for. That's free market intelligence. --- *David O'Neil is a CISO who has spent two decades on the buying side of security platforms, and who builds his own tools to test what vendors claim.*