Cribl, a US company that sells software for collecting and routing telemetry data, announced on 14 July 2026 that it would acquire CardinalOps, an Israeli startup that uses AI to help security teams build and maintain threat detection rules.
The companies did not disclose the price. Calcalist estimated the deal at about $100 million. Cribl did not say when it expected the acquisition to close.
CardinalOps employees will join Cribl, which will open a new office in Tel Aviv to tap Israel's cybersecurity workforce and speed up development of its security products, according to Cribl and Calcalist. Cribl plans to bring CardinalOps' technology into its own platform.
What CardinalOps built
CardinalOps, founded in early 2020, works on detection engineering: writing and tuning the rules that tell a security operations center's tools when to raise an alert. Its platform maps a company's existing detections against the techniques real attackers use, shows where coverage is missing, and helps teams fix rules that are broken or produce too many false alarms.
When it raised its Series A in 2022, Calcalist described the product as a cloud platform that recommends detection rules written in the native query languages of security analytics tools such as Splunk, Microsoft Sentinel, IBM QRadar and CrowdStrike. The company was then based in Tel Aviv and Boston.
CardinalOps had about 25 employees at the time of the deal, most of them in Israel, Calcalist reported. Repsol's global chief information security officer, Javier García Quintela, was quoted in Cribl's announcement as a customer, saying CardinalOps strengthens the energy company's detection posture across platforms.
“Security teams do not need more disconnected tools.”
Why Cribl is buying
Cribl, founded in 2018, describes itself as the AI platform for telemetry. Its products sit between the sources of logs, metrics and other machine data and the tools that analyse them, and it uses that position to offer security information and event management (SIEM), observability and AI security operations products. It says it is used by more than half of the Fortune 100. Calcalist reported that Cribl's annual recurring revenue is more than $300 million.
Calcalist described the purchase as a push into security operations and a challenge to traditional SIEM platforms. Cribl said that combining CardinalOps with its platform would create an open alternative to legacy SIEM architectures, using a federated model that lets customers search telemetry where it is already stored rather than moving it all into one system. It said future security and observability products would be built on the same shared data foundation.
Cribl co-founder and chief executive Clint Sharp said security teams needed a better way to turn telemetry into effective detections and outcomes. CardinalOps chief executive Michael Mumcuoglu said joining Cribl would let the company bring its work directly into the telemetry layer.
The founders and the funding
CardinalOps was founded by Mumcuoglu, its chief executive, and Yair Manor, both veterans of the Israeli military's Unit 8200 intelligence corps. Cribl said their previous companies had been acquired by Palo Alto Networks and Microsoft. Calcalist reported in 2022 that Mumcuoglu was the founder and chief technology officer of LightCyber, which Palo Alto Networks bought, and that Manor co-founded Netonomy, which was bought by Allot.
In March 2022 CardinalOps raised a $17.5 million Series A led by Viola Ventures, with existing investors Battery Ventures, Glilot Capital and Symbol taking part, bringing its total to $24 million at the time. By the time of the sale it had raised about $40 million, according to Calcalist, which also named In Venture, XT Hi-Tech and Gefen Capital among its investors.
A new office in Tel Aviv
Cribl said the new Tel Aviv office is meant to give it access to the country's cybersecurity talent and to speed up work on its security products, and Calcalist said Cribl is expected to grow its Israeli operations beyond the CardinalOps team. Cribl itself is remote-first, with an office in San Francisco.
For CardinalOps' investors, an exit at around $100 million, if Calcalist's estimate is accurate, would be roughly two and a half times the $40 million the company raised.
