AI/LLM readiness is top of mind for every organization right now. The board wants an AI story. The C‑suite wants an AI story. Business leaders want an AI story. And every team is feeling pressure to deliver it.
But between that pressure and production‑ready AI outcomes lies a hard truth: AI is a massive data problem. Without a deliberate data strategy, AI and LLM efforts quickly turn into “ready, fire, aim” – racking up technical and financial debt long before they show value.
In this post, we share how a strong data strategy sets you up for AI and LLM success.
The AI pressure cooker: Why strategy matters
Across industries, teams are being told some version of:
“Give me an AI solution.”
“Show me where AI will save money.”
“Prove how AI will solve real business challenges.”
Most organizations are still struggling to define use cases, quantify value, and even know where to start. That’s not because they lack models or platforms. It’s because they lack a disciplined way to understand, govern, and prepare the data those models depend on.
"Security is a data problem. Observability is a data problem. AI is an even bigger data problem. Data quality and consistency drive both cost and outcomes. AI and LLM readiness, then, is fundamentally data readiness." - Kam Amir
Step 1: Treat AI as a cost you must understand and control
One of the most common pitfalls we see is treating AI like “free magic” – leaning on free tools or CSP‑subsidized services and assuming the economics will always look that way, “just doing it” and worrying about cost and governance later. But there’s a reckoning coming. Training and running models is expensive – from CPU/GPU cycles to storage, networking, and analytics.
That’s why a serious AI data strategy starts with:
Collecting detailed telemetry about how you’re using AI: the workloads you’re running, the models you’re training, the inference calls you’re making.
Measuring the cost footprint: CPU/GPU consumption, storage growth, and the downstream analytics required to support AI initiatives.
Centralizing that telemetry into a system where you can monitor and optimize usage over time, instead of discovering runaway costs after the fact.
For Cribl customers, this is where Cribl Stream and Cribl Lake give you an immediate advantage:
Use Stream to capture metrics, logs, and traces from your AI infrastructure and platforms, enrich them with context, and route them intelligently.
Land that telemetry in Lake as your durable, cost‑efficient store of record—then surface it with Search so teams can understand which models, jobs, and use cases are actually worth the spend.
Before you talk about “AI transformation,” you need to be able to answer a simpler question: What is AI costing us today, and what value are we getting in return? A robust data strategy gives you that visibility.
Step 2: Build a clean, consistent data foundation
Most AI projects start on a shaky data foundation. We see many initiatives as “ready, fire, aim” – teams rush to ship something, accumulate technical debt early, and then get crushed by it when they hit scale. To avoid that, you need to start by collecting the right data from the right sources. The richest training and grounding data for AI use cases is telemetry – security logs, observability data, operational events, and business signals – pulled from many systems rather than a single “hero” platform, but curated so that only the most relevant slices are actually fed into models or LLM‑powered workflows.
From there, the focus has to be on cleaning, normalizing, and enriching that data before it ever touches a model. We frame it this way: you need to bring the discipline of business intelligence to AI. In practice, that means:
Standardizing schemas across vendors and formats so that related events (e.g., VPN logs) conform to a fixed structure.
Normalizing timestamps and key fields so all systems “agree on reality.”
Enriching events with context like GeoIP, reversed IP addresses, and threat intel so your LLM doesn’t just see raw strings – it sees meaningful, correlated entities.
When you do this well, you transform a messy stream of logs and metrics into high‑quality, analytics‑ready data. Only then does it make sense to put AI and LLMs on top.
Step 3: Standardize for LLMs and generative AI
Once your foundation is in place, you can start designing AI and LLM use cases that are actually feasible.
In the interview, we share a practical example many customers will recognize: imagine you have multiple VPN solutions, each with different log formats, and you want to ask a simple security question: “Tell me when a user appears to be logging in from two geographically distant locations at the same time.” If you send those raw logs straight to an LLM, it will struggle because timestamps aren’t aligned, fields are named differently, and location data may be missing or inconsistent.
But if you:
Normalize and enrich all VPN logs into a single, consistent schema in a flexible data processing layer.
Land that standardized dataset in an LLM‑ready data store such as your data lake or data warehouse.
Expose that dataset to an LLM through a query layer or gen‑AI‑enabled analytics engine so you can ask and answer those questions reliably.
…then suddenly that “simple” question becomes easy to answer – and easy to automate.
This is the core pattern for LLM readiness:
Standardize data (schema, timestamps, keys).
Enrich it with context and risk indicators.
Store it in scalable systems like Lake and make it discoverable with Search.
Expose it to AI and LLMs through well‑defined queries and workflows, not raw firehoses.
Without that pattern, you risk getting inconsistent results, poor detection, and runaway costs – even if your LLMs are state‑of‑the‑art.
Step 4: Use AI to strengthen your data strategy (not replace it)
One of the most powerful ideas in the conversation is flipping the script: instead of seeing AI as something you bolt onto your data, use AI to improve your data strategy itself.
We use AI‑driven workflows to:
Discover gaps in your telemetry and security posture by asking questions like: “What data sources are currently feeding my SIEM?” “When did they last send data?” “What formats are we writing into our security lake or observability platforms?”
Identify missing data sources – for example, learning that you’re not collecting endpoint data or critical network telemetry – and then automate the onboarding of those sources via your existing tools and platforms.
This creates a virtuous cycle:
You use a vendor‑neutral telemetry pipeline, centralized data stores, and search or analytics layers to build better telemetry data management.
You apply AI and agentic workflows to highlight coverage gaps and suggest corrections.
You then use those same data controls to operationalize those corrections – improving data quality, completeness, and relevance over time.
The result isn’t a “magic AI box” that replaces operators. It’s an environment where AI complements human operators, helping them move faster, make better decisions, and focus on higher‑value work.
What this means for existing Cribl customers
If you’re already using Cribl Stream, Cribl Lake, or Cribl Search, you’re not starting from scratch. You already have many of the building blocks required for AI and LLM readiness:
A vendor‑neutral pipeline to normalize, enrich, and route telemetry data.
A cost‑efficient, searchable data lake where standardized datasets can live long‑term and serve as high‑quality training and grounding data.
A search and exploration layer to help teams understand how data is being used, what it costs, and where AI can add real value.
The next phase is about connecting those capabilities to your AI roadmap:
Use Stream to instrument and monitor AI workloads.
Use Lake to centralize high‑value, clean, enriched data.
Use Search to explore, validate, and refine AI/LLM use cases alongside your existing observability and security workflows.
That’s how a data strategy becomes your AI strategy.
Watch the full conversation
This post only scratches the surface of the work we’re doing and the insights we share about data strategy, AI, and LLM readiness.
To hear our full discussion – including real‑world examples, gotchas we’ve seen in the field, and how we think about the future of Cribl Lake and Cribl Search in a gen‑AI world – watch the full video interview.