All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Databricks bought Panther in August 2026. Panther sells security teams at cloud-native companies a platform that collects security logs at petabyte scale. It runs detection rules written in Python against them. Its AI agents analyze each alert and propose fixes to rules that raised false alarms. Each fix needs the team's approval to deploy. Founded in 2018, Panther raised about $140 million, including a $120 million Series B led by Coatue in 2021. Its named customers include Anthropic, Zapier, and Snyk, and Panther says many customers migrate from Splunk, Sumo Logic, or Elastic. Panther says it will remain supported for existing customers and will over time transition into Lakewatch, Databricks' security product. Its customers face an eventual move onto Lakewatch.
| Description | AI security operations platform that ingests and normalizes security logs at petabyte scale, runs detection rules written in Python, and uses AI agents to investigate alerts and create detections. Databricks acquired Panther in 2026 and is integrating it into Databricks Lakewatch. | [f1] |
|---|---|---|
| Acquisition | Databricks, announced 2026-06-16 | [f2] |
| Founded | 2018 | [f3] |
| HQ | San Francisco, CA | [f3] |
| Funding | $140M total | [f4] |
| Latest funding | Series B, $120 million led by Coatue (December 2021) | [f5] |
| Product | What it does |
|---|---|
| Panther | AI SOC platform combining a security data lake, Python detection rules, and AI agents for alert triage, threat hunting, and detection tuning, being integrated into Databricks Lakewatch. |
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
Detection-as-code analytics earn detect across the telemetry Panther ingests, and cloud security scanning earns identify for cloud resources. The platform is mapped to the Cyber Defense Matrix. [f6]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | Panther names a clear buyer, security teams whose log volume and alert load outgrew legacy SIEM tools, and a clear pain, SIEM cost and manual triage. Omdia describes the same pressure as a desire to reduce the cost and complexity of buying and maintaining a SIEM. Contrary Research writes that traditional SIEM platforms like Splunk can cost over $1 million per year in full deployment. That is one category-level figure from one independent source, so the problem is clear and independently described without multiple sources quantifying the pain for Panther's own buyers. [s11, s12, s14, s19, s6] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 4/5 | Public documentation describes a cloud-native SIEM with detections-as-code and natively supported log sources. The panther-analysis repository publishes the built-in detection rules under an Apache-2.0 license, with 208 forks on GitHub, so the detection capability is open to inspection. GitLab's security manager described Panther's Python-based detection framework in the 2020 Series A release, and Omdia independently credits Panther as an early proponent of detection as code. [s8, s9, s5, s12, s19] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 4/5 | The enabler is agentic AI. Omdia's June 2026 analyst note ties another round of SIEM innovation to it, and Panther shipped its AI SOC Platform on March 19, 2026. Omdia's analysis of buyer pressure and reviews from verified AWS customers on the Marketplace listing, dated May 26 and June 1, 2026, are two independent buyer-side kinds. The reviews describe current use of Panther's AI features. Panther's and Databricks' releases are company-published, so neither counts as an independent kind. Nothing in the record shows demand accelerating, so the record supports present demand only. [s19, s16, s11, s17, s13] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 4/5 | Naglieri managed security engineering at Airbnb and Yahoo and his team built the open-source StreamAlert framework before founding Panther, which Contrary Research documents. Independent press credits the team with years of cloud-native detection work, and Databricks completed its acquisition in 2026. A named prior in-domain build plus an independently documented outcome meet the rung-4 test of verifiable prior builds or exits, multiply evidenced. Rung 5 needs category-defining recognition the record does not carry. [s14, s20, s19, s22] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 4/5 | Panther's customer stories page names customers including Zapier, Asana, Snyk, Jumio, Bitstamp, and Varo. Independent voices corroborate named customers: Contrary Research listed Coinbase, Dropbox, Gusto, Discord, and Snyk as notable customers as of September 2023, and The Next Web states that Anthropic is a customer. Anthropic's head of defense also speaks on the record in Databricks' release, and an AWS Marketplace listing adds a procurement channel. Panther does not disclose customer counts or revenue, which leaves the scale of those customer relationships unmeasured. [s7, s14, s20, s17, s16] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 4/5 | Panther raised about $140 million, including a $120 million Series B led by Coatue in December 2021, and Databricks completed its acquisition in 2026. Scoring policy 1.2.0 reads a completed exit as rung-4 evidence of confirmed output per dollar even where the price stays undisclosed, so the exit resolves what the raise alone could not. Rung 5 stays out of reach because the record carries no independently confirmed profitability or cash generation. [s22, s18, s13, s14] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 | Analysts place Panther in an established category without vendor coaching. Omdia calls its flagship product a cloud-native SIEM, Contrary Research compares it with Splunk, Hunters, Elastic, Sumo Logic, and Exabeam, and Panther's documentation uses the same SIEM label. The AI SOC Platform name it launched in March 2026, which SiliconANGLE covered, is newer, and it sits on top of a SIEM budget line the independent sources already recognize. [s19, s14, s8, s13] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Panther pairs its data lake with Python detection logic, and its agents propose rule changes as reviewable code, which gives workflow friction against absorption. Omdia writes that Databricks' Lakewatch already offered security agents for triage and detection but lacked a rich set of prebuilt SOC workflows before buying Panther. Bundling could still replicate that friction, because Panther's built-in detection library is public code and Connected customers keep their data in their own warehouses. [s19, s11, s4, s5, s9] |
Panther sells a platform that ingests security logs at petabyte scale, runs detection rules against them, and uses AI agents to investigate the resulting alerts. Its 2020 Series A release framed the buyer as security engineers at cloud-first organizations such as GitLab. GitLab's security manager said in that release that the SIEM products GitLab evaluated had rules engines too inflexible and management overhead too large.
Independent analysis describes the same pressure. Omdia writes that a desire to reduce the cost and complexity of buying and maintaining a SIEM has driven much of the change in security operations. It calls the SIEM the foundational tool in most enterprise security operations centers. Panther's data pipeline page argues that ingest-based SIEM pricing forces teams to decide which log sources are worth monitoring.
The March 2026 relaunch reframed the problem around people. Panther's launch release says the expertise required to run an effective security operations center remains stubbornly scarce. Omdia adds that agentic AI has started another round of innovation in the SIEM market. [s1, s12, s19, s6, s11]
Panther combines three components. A data pipeline normalizes logs at ingest into a security data lake, which can run on the customer's own Snowflake or Databricks instance. A detection engine runs rules written in Python, versioned and reviewed through GitHub like application code. AI agents work across both.
The agents cover four jobs. When an alert fires, Panther gathers evidence from the data lake, detection logic, alert history, and connected tools, then assigns a risk classification. Alerts scored below a customer-set threshold close automatically with an audit trail. Scheduled prompts run threat hunts across the data lake, and the AI Detection Builder converts plain-language threat descriptions into Python detections.
Panther calls the design a closed loop. When an alert resolves as a false positive, the platform traces it to the rule that fired and proposes a fix as a GitHub pull request, and nothing deploys without human approval. Panther also exposes its own MCP server, an interface that lets outside AI tools query its alerts, detections, and log data. The panther-analysis repository publishes the built-in detection rules under an Apache-2.0 license. [s1, s6, s5, s4, s11, s9]
Contrary Research names Splunk, Hunters, Elastic, Sumo Logic, and Exabeam as Panther's competitors, with SentinelOne and Palo Alto Networks Cortex competing indirectly. Panther's homepage says many customers migrate from Splunk, Sumo Logic, or Elastic.
Panther's case against AI triage tools that run on top of another SIEM is about access. Its product page argues that such tools can speed up an analyst's review but cannot improve the detection that fired, because they lack access to the detection code. Panther says its own agent runs inside the platform with native access to the data lake, detection logic, and alert history.
The acquisition changed Panther's position. Databricks completed its purchase on August 3, 2026, and is integrating Panther's SOC workflows and integrations into Lakewatch, Databricks' security product. Omdia writes that Lakewatch already offered security agents for triage and detection but lacked a rich set of prebuilt SOC workflows before the deal. [s14, s1, s4, s19, s18]
Panther's customer stories page names customers including Zapier, Asana, Snyk, Jumio, Bitstamp, Varo, Spring Health, GoFundMe, and Benchling. Contrary Research listed Coinbase, Dropbox, Gusto, Discord, and Snyk as notable customers as of September 2023. Databricks' acquisition release names Anthropic among the security teams that trust Panther and quotes Tim Nguyen, head of defense at Anthropic.
Panther publishes customer results for the AI platform. Its launch release credits HealthEquity with a 90% reduction in investigation times, Infoblox with 70% faster detection tuning, and Tealium with an 85% reduction in total alert volume. SiliconANGLE's launch article reports the same three figures as pre-release testing results, so they describe early deployments before general availability.
Panther sells through a sales team and through AWS Marketplace, where a Cloud Connected listing offers a one-year contract with a 1TB monthly ingestion allowance. Panther's homepage now says the company is part of Databricks Lakewatch. [s7, s14, s17, s11, s13, s16, s1]
Jack Naglieri founded Panther in 2018 after managing security engineering at Airbnb and Yahoo, according to Contrary Research. At Airbnb his team created StreamAlert, an open-source real-time data analysis framework, and Contrary Research describes Panther as his effort to make that approach more accessible.
Naglieri has held both the chief executive and chief technology roles since 2024. He moved from CEO to CTO in February 2024, when chief operating officer Will Lowe became CEO. Databricks' June 2026 release quotes Naglieri as Founder and CEO. The about page lists him in that role with John McCarthy as chief revenue officer, Julian Giuca as chief product officer, Shannon King as chief marketing officer, and Mike Baker as vice president of threat research.
Coverage of the deal describes the wider team. The Next Web writes that Panther adds a team that has spent years building cloud-native threat detection. Databricks' release describes engineers and former SOC analysts with open source and cloud-native security experience. Databricks welcomed the Panther team when the acquisition closed. [s14, s15, s2, s17, s20, s18]
Panther's trust page lists SOC 2 Type 2 compliance, ISO 27001 certification, and PCI compliance, and links to a trust center. It describes single-tenant deployments that isolate customer data in dedicated instances and a 99.9% uptime commitment backed by an SLA.
Customers choose where their data lives. In the Connected model Panther runs inside the customer's AWS account against its Snowflake or Databricks warehouse, and in the Hosted model Panther manages a dedicated, isolated environment. For the AI layer, AI-proposed detection changes deploy only after human approval, while alerts the agent scores below a customer-set threshold close automatically with an audit trail. The homepage says each customer runs in an isolated tenant on Amazon Bedrock, with no customer data used in model training. [s3, s1, s4, s5]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Splunk | competes with | Named as a Panther competitor by Contrary Research, and one of the SIEM products Panther says its customers migrate from. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Hunters | competes with | Named as a Panther competitor by Contrary Research. | |
| Sumo Logic | competes with | Named as a Panther competitor by Contrary Research, and one of the SIEM products Panther says its customers migrate from. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Exabeam | competes with | Named as a Panther competitor by Contrary Research, whose September 2023 report contrasted its per-user pricing with Panther pricing by data ingested. | |
| Elastic | competes with | Named as a Panther competitor by Contrary Research, and one of the SIEM products Panther says its customers migrate from. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| SentinelOne | adjacent | Competes indirectly for detection budgets, per Contrary Research. | |
| Palo Alto Networks | adjacent | Its Cortex products compete indirectly, per Contrary Research. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Dropzone AI | competes with | Analyst inference, not stated in any captured source: competes for the same security operations budget. |
Add analyzed competitors to compare them side by side with Panther.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
Customers write and review detection rules as Python code in their own GitHub repositories, set the thresholds for automatic alert closure, and run agents that learn their environment's patterns. A customer that leaves would rebuild that detection and review workflow elsewhere, and one that runs Panther on its own Snowflake or Databricks warehouse would keep its data in place. Panther publishes its built-in detection rules under an open-source Apache-2.0 license. Panther shares no customer data across tenants and uses none in model training, and its AI model is Anthropic's Claude through Amazon Bedrock. Its named customers include Varo, a bank, which is the kind of regulated buyer where procurement and legal review sit between a vendor and its replacement.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Customers pay for a software platform. Panther sells subscriptions such as the AWS Marketplace contract metered on ingestion, and its AI agents automate investigation work as product features whose actions the customer's own team reviews and directs. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Leaving Panther carries meaningful friction in detections written and reviewed through Panther's Python and GitHub workflow, auto-resolve thresholds the customer configures, and agents that learn each environment's patterns. The record also documents portability, since rules are Python code in the customer's own GitHub repository and Connected customers keep their data in their own warehouse free from proprietary formats. The switching mechanism is documented, but the cited record does not size the migration or show that learned state cannot be exported. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | SOC 2 Type 2, ISO 27001, and PCI are attestations a funded rival can obtain through ordinary enterprise preparation. The trust page lists no government authorization or mandate that would block a replacement. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Panther ingests and normalizes logs at petabyte scale and runs detections in real time. Its AI agents investigate alerts against that data and propose rule changes, which adds machine learning to a real-time system. The Next Web describes the team as having spent years building cloud-native threat detection. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | Panther's named buyers include a regulated enterprise. Varo appears in a Panther customer story, and Varo's site states that its cards are issued by Varo Bank, N.A., a bank. On its customer page, Panther lists Spring Health, Jumio, Bitstamp, and Zapier, and Databricks' release names Anthropic among the security teams that trust Panther. A bank is the kind of regulated buyer where procurement and legal sit between a vendor and its replacement. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | Panther is a platform with application features. Other tools feed it logs, analysts work in its interface, and its MCP server lets outside agents query its data. The cited record does not show applications that depend on Panther to run. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | Panther's built-in detection library is public, published in the panther-analysis repository under an Apache-2.0 license, while customers manage their own rules in their own GitHub repositories. The agents learn each customer's patterns, and the homepage states no cross-tenant data sharing and no customer data in model training. The cited record does not establish a vendor-retained, cross-customer learning asset. The AI model is Anthropic's Claude through Amazon Bedrock, and no retained dataset, content license, or granted patent appears in the cited record. |
Panther's original segment was the security engineering team at a cloud-first company. The 2020 Series A release named GitLab in that frame, and Contrary Research described Panther's focus as cloud-native organizations with leaner teams. Current customer stories name Zapier, Asana, Snyk, and Benchling.
The named customers also include a bank. Varo appears in a Panther customer story, and Varo's site states that its cards are issued by Varo Bank, N.A. Databricks' acquisition release names Anthropic among the security teams that trust Panther.
The 2026 platform widens the audience to teams without detection engineers. Panther's homepage says such teams can start with the built-in detection library and the AI Detection Builder. Its customer stories include a two-person IT team at Loglass that built security operations on the platform.
Panther's AI claim rests on agents that both read and change the detection layer. The triage agent investigates each alert against the data lake, detection logic, and alert history. When an alert resolves as a false positive, the platform traces it to the Python rule responsible and proposes a fix as a pull request with tests for human review.
The launch release says the agent learns the patterns and risk profile of each customer's environment. The homepage adds that each customer runs in an isolated tenant on Amazon Bedrock with no cross-tenant data sharing. The cited record does not establish a vendor-retained, cross-customer learning asset, so the agents' learning is evidenced as a capability each customer's deployment builds for that customer.
The model comes from outside Panther. Its Infoblox case study says Panther AI uses Anthropic's Claude through Amazon Bedrock. Panther's agents can access the customer's data lake and detection code. Panther says overlay tools lack access to the detection code.
Omdia credits Panther as an early proponent of detection as code, which treats threat detection as a software engineering problem. Panther's detection engine page argues that large language models work well with Python, which lets its agents propose specific changes to Python rules.
Panther runs a sales-assisted enterprise motion. Its AWS Marketplace listing directs buyers who want custom pricing, SaaS deployment, or private contracts to Panther's sales team, and the about page lists John McCarthy as chief revenue officer.
The marketplace listing is a second procurement channel. It covers the Cloud Connected deployment, which requires the customer to own AWS and Snowflake infrastructure and pay its costs.
The acquisition now shapes distribution. Databricks completed its purchase of Panther on August 3, 2026. Panther's homepage says Panther will remain fully supported for existing customers while its capabilities are integrated into Databricks Lakewatch, and that over time Panther will transition into a single Lakewatch offering.
Panther's AWS Marketplace listing prices the Cloud Connected deployment by data ingested. It offers a one-year contract with a 1TB monthly ingestion allowance and one year of data retention at $50,000, with overage charges above the allowance. Contrary Research's September 2023 report described Panther as pricing for the data its platform ingests, in contrast with Exabeam's per-user pricing.
Panther's data pipeline page argues that traditional SIEMs charge by daily ingest volume, which forces teams to decide which log sources to monitor. It says Panther's pricing does not penalize ingestion growth, without naming a meter. The Marketplace contract meters monthly ingestion, and in the Cloud Connected model storage in the customer's own account is billed separately from that allowance.
Panther ships in two deployment models. In the Connected model it runs inside the customer's AWS account against the customer's Snowflake or Databricks warehouse. In the Hosted model Panther manages the environment and ingests the customer's data into a dedicated, isolated instance.
The trust page describes an architecture that scales instantly and requires zero administration, with a 99.9% uptime commitment backed by an SLA. Panther's homepage says most teams ingest logs and run detections within days, with integrations, data validation, and tuning as the main work. Public documentation describes ingesting terabytes of security events per day into a structured data lake.
Panther's certifications cover the standard enterprise checklist. The trust page lists SOC 2 Type 2, ISO 27001, and PCI, and links to a trust center.
The deployment options reduce the data custody a buyer must grant. Connected customers keep security data in their own warehouse, which the data pipeline page describes as queryable and free from proprietary formats. For the AI layer, AI-proposed detection changes deploy only after human approval, and alerts the agent scores below a customer-set threshold close automatically with an audit trail.
Panther's integrations run in three directions. Databricks' acquisition release cites more than 100 out-of-the-box data integrations feeding logs in. Investigations pull live context from GitHub, PagerDuty, Atlassian, Notion, and other tools. Underneath, the platform can run on a customer's own Snowflake or Databricks warehouse.
Panther also exposes its own MCP server, so external agents and tools such as Claude or Cursor can query its alerts, detections, and log data. That makes Panther a data source for other AI tools as well as a destination for logs.
The panther-analysis repository is the community layer. It holds detections developed by the Panther team and the community under an Apache-2.0 license, and GitHub shows 208 forks. Databricks says the acquisition brings Panther's SOC workflows and integrations directly on top of Lakewatch's open data foundation.
Jack Naglieri founded Panther in 2018 after managing security engineering at Airbnb and Yahoo, according to Contrary Research, and his team created the open-source StreamAlert framework at Airbnb. Panther Labs Inc.'s SEC Form D filings of 2019 and 2020 give 2018 as its year of incorporation in Delaware. Naglieri signed the 2020 notice as chief executive officer. Naglieri also writes Detection at Scale, a weekly newsletter on how AI is reshaping security operations.
Naglieri has held both the chief executive and chief technology roles since 2024. He moved to CTO in February 2024, when chief operating officer Will Lowe became CEO. Databricks' June 2026 release quotes Naglieri as Founder and CEO of Panther. The about page lists him in that role alongside a chief revenue officer, a chief product officer, a chief marketing officer, and a vice president of threat research.
The Next Web writes that Panther adds a team that has spent years building cloud-native threat detection. Databricks' release describes that team as engineers and former SOC analysts with open source and cloud-native security experience.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Panther: homepage | official | 2026-09-15 |
| f2 | Omdia: analyst note on the Databricks acquisition of Panther | research | 2026-09-15 |
| f3 | CB Insights: company profile for Panther | research | 2026-09-15 |
| f4 | SiliconANGLE: article on the AI SOC Platform launch | press | 2026-09-15 |
| f5 | Contrary Research: company report on Panther | research | 2026-09-15 |
| f6 | panther-analysis repository README | official | 2026-06-12 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.