We've been saying for years that nothing in the enterprise ever really goes away, and AI isn't replacing that reality. It's multiplying it.
IDC reports that data is growing at a 30% CAGR, and we all know our budgets are not. And that 30% doesn’t even begin to account for AI. In the world of IT and Security, agentic solutions are piling on an order of magnitude more queries against that data, running hundreds of concurrent searches and testing every hypothesis at once, burning even more budget through tokens and generating even more digital exhaust. Our CriblCon 26 announcements are built for that world.
Until now, teams have had two imperfect paths. Solution-first vendors give you great purpose-built products, but their value is locked to their own platform and their own data. Platform-first vendors give you an open foundation, but no actual solutions, just a database and a hiring problem. Our answer is the AI Platform for Telemetry: the openness and customizability of a platform, with the out-of-the-box solutions of a purpose-built product, with inference included.
What we announced
StreamAI, an enterprise AI gateway with a built-in model router that sends each prompt to the right model at the right price, with free inference for customers using automatic routing to our benchmarked models.
Cribl Detect, delivering a new way to SIEM, built on the Cribl platform to provide a complete SIEM at up to 50% less cost.
Growing momentum for the Cribl App Framework, with 150+ apps built by Cribl, our partners, and our customers, many available now in the Cribl Marketplace.
Introducing StreamAI
AI inference spend is getting harder to predict, especially as agents coordinate multi-step tasks with minimal human oversight. Too many teams send every prompt to the most expensive model because they have no better way to decide.
StreamAI changes that. It takes what we already do for telemetry (routing data at massive scale) and applies it to AI. As Clint puts it, AI is not one-size-fits-all. The right model depends on the job, the context, and the economics of the request.
The router is grounded in our SecIT Bench research, which tested 20 AI models across 30 real-world IT and security investigations and found just a 17% spread in accuracy against a 20x range in cost. Because the router knows which models deliver for each job, customers using StreamAI's automatic routing to our benchmarked models get inference free, so no surprise token bills. StreamAI also enforces budgets and spending cutoffs, redacts sensitive data in both prompts and responses, and records every model call as audit-ready telemetry.
Explore the full SecIT Bench results, or talk to our team about bringing StreamAI to your environment.
Introducing Cribl Detect
SIEM is the clearest example of everything wrong with the old way of doing things. Security teams decide what to send to their SIEM based on what they can afford, not what they need to detect. That's not a security team failing at its job. It's an architecture forcing a budget decision to masquerade as a risk decision. And with AI-generated attacks moving faster than ever, that compromise is getting harder to live with.
Built on the Cribl platform security teams already trust, Cribl Detect delivers a complete SIEM. It runs on the telemetry you already have, in open formats you control, wherever that data lives, so you can get started right away. Because it runs on a platform with built-in inference and an agentic runtime, it goes beyond static, rules-based detection. AI SOC intelligence catches threats that rules alone would miss and surfaces actionable signals instead of noise. Detection posture management shows you exactly what you are and aren't detecting, from coverage gaps to broken rules to missing telemetry.
And it's not a migration event. Adopt it all at once or one workload at a time, at up to 50% less cost than incumbent SIEMs, because it's priced on infrastructure, not an analysis tax. If you ever leave, you keep everything. Your data is always yours.
Cribl Detect is available now for Cribl.Cloud customers. Log in to get started, or read more about how Cribl Detect works.
Own your data. Build anything on it.
Everything we build starts with one thing: owning your data. Half of the Fortune 100 trust Cribl with theirs, and we're well over $300 million in ARR with 1,500 customers. This year we added 70 new integrations, opened the platform to agents via MCP and SDKs, and put AI to work auto-parsing the messiest telemetry so it's useful the moment it arrives.
That’s the foundation. What you build on it is where the platform pays off. With the Cribl agentic development environment, you can build apps, workflows, and agents using natural language, then run them on the same agentic runtime that powers Cribl Detect, with compute, scheduling, logging, and permissions already handled. Our community is already building with more than 150 apps from Cribl, our partners, and our customers.
What’s next
We're not done. SIEM was the most urgent problem to solve first, but it won't be the last. APM, AI SOC, and AI Observability are already live, with CSPM, DSPM, and more ahead. And because every one of them runs on the same platform, sharing your data, inference, and agentic runtime, each new solution is one less system to stand up, one less copy of your data, and one less vendor locking you in.
None of this happens without the community that's grown up around Cribl. You've pushed the boundaries, broken things, filed the issues, and come right back to building. That's the same energy Cribl was founded on, and it's what drives everything we do.
Thank you for building with us.
