All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Scanner runs a security data lake that indexes logs inside its customers' own Amazon S3 buckets, evaluates detection rules continuously, and searches years of logs in seconds. Cliff Crosland and Steven Wu, who built data infrastructure at Accompany and then Cisco, founded the company in 2022, and Sequoia led a $22 million Series A in March 2026. Customers include Notion, Ramp, and BeyondTrust, and Notion described its security agent investigating alerts through Scanner. The surprise is that Scanner gave up the custody lock-in that funds incumbent log platforms: by default logs stay in customer buckets, and leavers keep them but rebuild detections and workflows. The company bets that AI agents, already its heaviest users, make the fast data layer the part of the stack customers keep.
| Description | Security data lake company whose platform indexes security logs inside customer-owned Amazon S3 buckets, runs detection rules continuously on incoming data, and returns searches across years of logs in seconds for investigation and threat hunting. | [f1] |
|---|---|---|
| Founded | 2022 | [f2] |
| HQ | San Francisco, CA, US | [f2] |
| Latest funding | Series A, $22M (March 2026) | [f2] |
| Product | What it does |
|---|---|
| Scanner | Security data lake that indexes logs in customer-owned S3 buckets, runs continuous detection rules, and searches years of log data in seconds. |
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
Fast search and continuous detection rules over customer-owned S3 log telemetry, including EDR, WAF, and identity sources, produce detection signal. Scanner defends conventional infrastructure and is mapped to the Cyber Defense Matrix.
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score |
|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 4/5 |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs, demos, and third-party validation. | 4/5 |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 4/5 |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 |
Unlock the Full Analysis
The reasoning for the scores, the strategy deep dive, the business risks, and more. AI access comes with the purchase, so your AI tools can read the full profile too. You keep 12 months of access.
One-time purchase: $20 per profile.
UnlockReading several? Unlock the entire catalog.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
pivot urgently
| Dimension | Score |
|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 2/3 |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 |
Unlock the Full Analysis
The reasoning for the scores, the strategy deep dive, the business risks, and more. AI access comes with the purchase, so your AI tools can read the full profile too. You keep 12 months of access.
One-time purchase: $20 per profile.
UnlockReading several? Unlock the entire catalog.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Scanner homepage | official | 2026-06-12 |
| f2 | SecurityWeek on the Scanner Series A | press | 2026-06-12 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | Scanner homepage “Your SIEM sees 1%. Scanner sees what it can't. A radically different way to detect threats in security data.” | official | 2026-06-12 |
| s2 | Scanner about page “Our Series A is led by Sequoia, with participation from CRV and Mantis VC.” | official | 2026-06-12 |
| s3 | Scanner terms of service “This Site is operated by Scanner, Inc. and has been created to provide information about our company and our log management platform and related services” | official | 2026-06-12 |
| s4 | Scanner pricing examples page “250–500 GB Daily log volume $50k–$95k Est. annual cost Multi-Tenant Managed Scanner” | official | 2026-06-12 |
| s5 | Scanner docs: What is Scanner “In all deployment models, you own your data. Logs and index files always reside in your S3 buckets.” | official | 2026-06-12 |
| s6 | Scanner docs: How it Works “SOC 2 Type 2 certified, attests to security controls, operational processes, and internal auditing practices. Full documentation is available via the Drata Trust Center.” | official | 2026-06-18 |
| s7 | Scanner Series A announcement “Today we're announcing our $22 million Series A, led by Sequoia, with participation from CRV and Mantis VC, to bring this capability to every security team.” | official | 2026-06-12 |
| s8 | Ramp case study “Queries that previously caused Athena to time out after 30 minutes now complete in about a minute with Scanner, drastically reducing investigation time.” | official | 2026-06-12 |
| s9 | Scanner headless SOC blog post “A headless SOC is one where the detection and investigation loop runs without a human-facing security interface in the middle.” | official | 2026-06-12 |
| s10 | Scanner MCP server announcement “Today we're announcing Scanner's Model Context Protocol (MCP) server: a remote MCP server that connects AI agents directly to your security data lake.” | official | 2026-06-12 |
| s11 | Scanner case studies page “Discover how fast-growing, cloud-native companies use Scanner to unlock the full potential of their security data lake.” | official | 2026-06-12 |
| s12 | SecurityWeek on the Scanner Series A “Cybersecurity startup Scanner has announced raising $22 million in a Series A funding round led by Sequoia Capital, with additional support from CRV, Mantis VC, and angel investors.” | press | 2026-06-12 |
| s13 | Pulse 2.0 on the Scanner Series A “Scanner says its long-term goal is to build the foundational data layer for a new era of security operations in which human analysts and AI agents collaborate over complete datasets rather than the limited slices of data typically stored in traditional systems.” | press | 2026-06-12 |
| s14 | FinTech Global on the Scanner Series A “The company has raised $22m in a Series A funding round led by Sequoia Capital, with additional participation from CRV and Mantis VC.” | press | 2026-06-12 |
| s15 | Notion engineering blog on the Scruff security agent “84% reduction in median time to investigate for false positive alerts” | research | 2026-06-12 |
| s16 | Scanner.dev AWS Marketplace seller profile “scanning 250TB of logs for indicators of compromise takes less than 30 seconds” | official | 2026-06-12 |
| s17 | Data Engineering Podcast episode notes on Scanner “Cliff Crosland co-founded Scanner to provide fast querying of high scale log data for security auditing.” | research | 2026-06-12 |
| s18 | Scanner Series A names BeyondTrust as a customer “We've built it, and security teams at Notion, Ramp, and BeyondTrust are already using it to investigate threats across years of log data.” | official | 2026-06-13 |
| s19 | Scanner homepage security badges (SOC 2 Type II, GDPR) “Enterprise-Grade Security. SOC 2 Type II Certified. GDPR Compliant. Data Residency Options.” | official | 2026-06-16 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | Scanner homepage “Your SIEM sees 1%. Scanner sees what it can't. A radically different way to detect threats in security data.” | official | 2026-06-12 |
| s2 | Scanner about page “Our Series A is led by Sequoia, with participation from CRV and Mantis VC.” | official | 2026-06-12 |
| s3 | Scanner terms of service “This Site is operated by Scanner, Inc. and has been created to provide information about our company and our log management platform and related services” | official | 2026-06-12 |
| s4 | Scanner pricing examples page “250–500 GB Daily log volume $50k–$95k Est. annual cost Multi-Tenant Managed Scanner” | official | 2026-06-12 |
| s5 | Scanner docs: What is Scanner “By default, your logs and index files reside in S3 buckets you own, so you keep full custody of your data. As a standard option, Scanner can also host this storage (both the collect buffer and the index buckets)” | official | 2026-07-11 |
| s6 | Scanner docs: How it Works “SOC 2 Type 2 certified, attests to security controls, operational processes, and internal auditing practices. Full documentation is available via the Drata Trust Center.” | official | 2026-06-18 |
| s7 | Scanner Series A announcement “Today we're announcing our $22 million Series A, led by Sequoia, with participation from CRV and Mantis VC, to bring this capability to every security team.” | official | 2026-06-12 |
| s8 | Ramp case study “Queries that previously caused Athena to time out after 30 minutes now complete in about a minute with Scanner, drastically reducing investigation time.” | official | 2026-06-12 |
| s9 | Scanner headless SOC blog post “The interface for a headless SOC is Slack, Notion, or a Jira ticket with a pre-filled timeline. Wherever the team already reads. The SIEM tab stays closed.” | official | 2026-06-12 |
| s10 | Scanner MCP server announcement “Today we're announcing Scanner's Model Context Protocol (MCP) server: a remote MCP server that connects AI agents directly to your security data lake.” | official | 2026-06-12 |
| s11 | Scanner case studies page “Discover how fast-growing, cloud-native companies use Scanner to unlock the full potential of their security data lake.” | official | 2026-06-12 |
| s12 | SecurityWeek on the Scanner Series A “Founded in 2022, San Francisco-based Scanner helps organizations build a cloud-native security data lake for fast threat hunting and continuous detection and response.” | press | 2026-06-12 |
| s13 | Pulse 2.0 on the Scanner Series A “Scanner says its long-term goal is to build the foundational data layer for a new era of security operations in which human analysts and AI agents collaborate over complete datasets rather than the limited slices of data typically stored in traditional systems.” | press | 2026-06-12 |
| s14 | FinTech Global on the Scanner Series A “The company has raised $22m in a Series A funding round led by Sequoia Capital, with additional participation from CRV and Mantis VC.” | press | 2026-06-12 |
| s15 | Notion engineering blog on the Scruff security agent “84% reduction in median time to investigate for false positive alerts” | research | 2026-06-12 |
| s16 | Scanner.dev AWS Marketplace seller profile “scanning 250TB of logs for indicators of compromise takes less than 30 seconds” | official | 2026-06-12 |
| s17 | Data Engineering Podcast episode notes on Scanner “Cliff Crosland co-founded Scanner to provide fast querying of high scale log data for security auditing.” | research | 2026-06-12 |
| s18 | Scanner docs: keeps logs in Amazon S3 “It lets you keep unlimited logs in your own Amazon S3 buckets and adds hyper fast search, detection, alerts, APIs & more.” | official | 2026-06-13 |
| s19 | Scanner about page: Cliff Crosland and Steven Wu co-founder profiles “Previously engineering lead for the data platform at Accompany before its acquisition by Cisco.” | official | 2026-06-13 |
| s20 | Scanner Series A names BeyondTrust as a customer “We've built it, and security teams at Notion, Ramp, and BeyondTrust are already using it to investigate threats across years of log data.” | official | 2026-06-13 |
| s21 | Scanner homepage security badges “Enterprise-Grade Security. SOC 2 Type II Certified. GDPR Compliant. Data Residency Options.” | official | 2026-06-18 |
| s22 | Scanner docs: Azure and GCP ingestion sources “Google Cloud Platform (GCP) Audit” | official | 2026-06-16 |
| s23 | Scanner about page: advisor bench “Haiyan Song EVP CloudOps at NetApp; Former SVP & GM of Security Markets at Splunk. Mike Horn Former SVP & GM of Splunk Security. Christina Cacioppo CEO & Co-founder of Vanta. David Tsao CISO of Notion. Ryan Knisley CSO of Axonius; Former CISO of Disney.” | official | 2026-06-18 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Do not republish its content or share access without the operator's permission.