Cribl enters SIEM market and launches AI gateway StreamAI
Cribl, the telemetry data platform vendor trusted by half of the Fortune 100 according to the company, used its CriblCon conference on 29 September 2026 to announce two significant product launches: Cribl Detect, a full security information and event management (SIEM) solution, and StreamAI, an enterprise AI gateway with intelligent model routing. Together, the announcements mark a substantial expansion of Cribl's platform beyond its established data pipeline roots.
Cribl Detect is priced on infrastructure consumption rather than on the volume of data analysed, a deliberate departure from the per-gigabyte models that have made incumbent SIEMs expensive as telemetry volumes grow. The company says the product costs up to 50% less than competing platforms, though it has not published independent benchmark pricing data to support that figure. The SIEM includes detection posture management mapped to the MITRE ATT&CK framework, AI-driven triage via what Cribl calls an AI security operations centre (AI SOC), and federated investigation across distributed data stores including pipelines, data lakes and object stores. It is available now for Cribl.Cloud customers.
Clint Sharp, co-founder and chief executive, said: "Customers don't want the SIEM they have today, and they don't have the resources to build the SIEM they want. With Cribl Detect, we've taken a different approach that solves both problems."
The StreamAI model router
The second announcement, StreamAI, addresses a different but related pain point: runaway inference costs as enterprises deploy agentic AI at scale. The gateway automatically routes each prompt to whichever model Cribl's router judges most appropriate, based on task type, context and unit economics. Built-in circuit breakers cap token consumption, and automatic fallback to a cheaper model kicks in when a cost threshold is reached.
StreamAI's routing logic draws on Cribl's own SecIT Bench research, which put 20 AI models through 30 real-world IT and security investigation scenarios. The study found a 20x spread in per-investigation cost alongside only a 17% spread in diagnostic accuracy, a result that underpins Cribl's argument that the most expensive model is rarely necessary for every workload. The gateway also offers bidirectional sensitive-data redaction in both outgoing prompts and incoming responses, and logs every routing decision as audit-ready telemetry. Cribl is offering free inference for customers who use automatic routing to its benchmarked model set. StreamAI is not yet generally available; interested customers are directed to their account teams for early access.
Market context and competitive landscape
The SIEM market is large and under pressure from multiple directions. Legacy players such as Splunk (now part of Cisco), IBM QRadar and Microsoft Sentinel dominate enterprise deployments, but buyers have long complained about cost scaling and vendor lock-in. A wave of cloud-native entrants including Exabeam, Securonix and Panther Labs have built on open data schemas to compete on flexibility, and several hyperscalers offer native SIEM-adjacent capabilities. Cribl's infrastructure-priced model is a direct response to the per-gigabyte economics that have made log ingestion increasingly expensive as data volumes compound.
The AI gateway category is similarly competitive, with LLM routing and cost-control tooling available from players including LiteLLM, PortKey and a growing number of well-funded startups. Hyperscalers are also building routing and spend-management features into their own AI platforms, which may squeeze independent gateways over time. Cribl's differentiation rests on the combination of its existing telemetry pipeline installed base, the security-specific redaction and audit capabilities in StreamAI, and the free inference offer, which lowers the barrier to adoption for existing customers.
From a regulatory standpoint, both products touch areas of active standards development. The EU AI Act's obligations for general-purpose AI systems are phasing in through 2026 and 2027, and enterprises running agentic workloads will need auditable records of model decisions, precisely what StreamAI's telemetry logging is designed to provide. The NIS2 Directive, which broadened cybersecurity obligations across EU member states in late 2024, has also increased demand for capable SIEM tooling among mid-market operators who were previously out of scope.