Scanner

• Splunk, Datadog, or another SIEM incumbent could ship credible search over customer-owned object storage, collapsing Scanner's cost-architecture differentiation into a platform feature.
• AWS could close the Athena performance gap or add fast managed search over S3-resident security logs, becoming the default alternative inside every account where Scanner deploys.
• A customer can cancel the subscription and keep every log it ever stored, losing only search speed, so churn costs the customer little once budgets tighten or an alternative matches the price.
• If buyers standardize on full AI SOC suites instead of building their own agents, the headless data-layer position becomes an ingredient in someone else's product and the agent vendor captures the relationship.
• Telemetry-reduction pipelines could shrink the daily log volume Scanner charges on, capping expansion revenue within existing accounts.
• Scanner publishes homepage security badges and points buyers to a Drata Trust Center for its SOC 2 documentation, but the public record reviewed here still lacks a penetration-test summary or a vulnerability disclosure policy, and enterprise procurement could slow on that remaining evidence gap as bank and insurance logos appear on its homepage.

Scanner sells fast search and continuous detection over the log data that SIEM pricing pushes out of reach. The company describes security teams choosing between paying SIEM ingestion fees for roughly 30 days of searchable retention or parking logs in cheap object storage where a search takes hours. High-volume sources such as WAF and EDR logs land in object storage by default, which leaves teams unable to search the bulk of their own telemetry.

Customer evidence corroborates the pain beyond Scanner's framing. Ramp's case study describes a 15-day retention limit before Scanner and high-volume sources excluded from monitoring because of cost. Notion's engineering team wrote on its own blog that it routes logs, user activity, and system events through Scanner, which it calls its SIEM, to feed alert investigations. Press coverage of the funding round describes the same cost-versus-visibility tradeoff.

The buyer is a security operations or detection engineering team at a cloud-heavy company. Scanner's case studies page courts fast-growing, cloud-native companies, Ramp's story is told by a detection engineer, and the founders trace the product to their own logging costs at Accompany and later Cisco, where the economics pushed the bulk of their log data into object storage. [s7, s8, s15, s12, s11]

The Scanner platform turns customer-owned S3 buckets into a searchable detection layer. Scanner builds compact, schema-agnostic indexes beside the logs, keeps both in the customer's buckets, and runs queries on parallel short-lived Lambda workers that the docs credit with scan speeds from hundreds of gigabytes to a terabyte per second. The docs lay out a four-stage pipeline covering ingestion, indexing, querying, and detections, and the same query engine powers ad-hoc searches and always-on detection rules.

Deployment comes in three models that differ by who runs the compute. Managed Scanner runs multi-tenant or single-tenant compute that Scanner operates, and Bring Your Own Cloud runs the compute inside the customer's own AWS account. The docs state that in every model logs and index files always reside in the customer's S3 buckets.

Scanner aimed the product at AI agents before the funding round. The MCP server it announced in December 2025 connects agents directly to the data lake for investigations, detection engineering, and response workflows, and the Series A post reports that agents became the most prolific users of Scanner within twelve weeks. Notion's Scruff agent gathers context through Scanner alongside Wiz and CrowdStrike, and Notion reports an 84% reduction in median investigation time for false-positive alerts.

External validation exists but stays customer-shaped. Ramp reports that queries which used to time out in Athena after 30 minutes complete in about a minute, the AWS Marketplace listing claims a 250TB scan for indicators of compromise in under 30 seconds, and Cliff Crosland walked through the architecture on the Data Engineering Podcast. No independent benchmark of the speed claims appears in reviewed pages. [s6, s5, s10, s7, s15, s8, s16, s17]

Scanner positions itself against SIEM economics rather than against any single vendor. The homepage frames incumbents as cost-limited, claiming a typical SIEM sees 1% of an organization's data, and pitches indexing data in S3 where it already lives as the structural fix. The pitch targets the budget line of ingestion-priced platforms such as Splunk and Datadog while claiming a different architecture underneath.

The nearer competitive set is other security data lake builders. Panther and RunReveal pitch fast, lower-cost detection over cloud-scale logs to the same buyers, and AWS itself supplies the baseline, since Ramp's case study measures Scanner against Athena queries that timed out at 30 minutes. Scanner's visible differentiators are its purpose-built index, its published speed claims, and customer ownership of both logs and indexes.

Scanner also picked an unusual position in the AI SOC wave. A June 2026 company post argues against building an AI SOC product and commits to serving as the headless data layer under agents that customers build themselves, reasoning that no vendor knows a customer's environment the way the customer's own team does. That choice differentiates Scanner from the crowd of AI SOC vendors and makes customers' in-house agent programs its distribution surface. [s1, s8, s9, s7]

Scanner runs a sales-assisted motion with unusually transparent pricing for its stage. The pricing page publishes example annual costs by daily log volume, from $50k to $95k for 250 to 500 gigabytes per day up to a contact-sales tier for 2 to 100 terabytes and beyond, and the homepage routes buyers to a demo. An AWS Marketplace seller profile gives enterprises a procurement path through existing cloud commitments.

Named customers anchor the traction case in multiple voices. The Series A post names Notion, Ramp, BeyondTrust, Lemonade, Benchling, Postman, and EliseAI, the homepage logo wall adds names such as Confluent, Tide, Lead Bank, and Live Oak Bank, and the Ramp case study carries a named detection engineer crediting Scanner with a year of searchable history. Notion's endorsement is the strongest because Notion published it on its own engineering blog rather than through Scanner's marketing.

The founders still front the public selling. Cliff Crosland writes the funding and product announcements and appears on technical podcasts aimed at the practitioner audience, and no named sales leadership appears in the cited public record. For a company at this stage, founder-led selling alongside a growing named-customer list reads as a healthy sequence rather than a gap. [s4, s16, s7, s1, s8, s15, s17]

Scanner's founders bring data-infrastructure pedigrees to a data-infrastructure problem. The about page identifies Cliff Crosland and Steven Wu, both Stanford CS, who led engineering for the data platform at Accompany through its acquisition by Cisco and then built large-scale systems at Cisco. Steven founded Predictive Edge, which Dropbox acquired, and Cliff was a principal engineer on the Webex People Graph. Cliff is the CEO, and the Series A announcement carries his byline.

Public technical presence substitutes for a security-industry track record. Cliff has discussed the architecture on the Data Engineering Podcast and other technical shows, and the company blogs about its Rust and Lambda engineering choices in enough depth for practitioners to evaluate. The founders are new to selling security products as a market, and their credibility argument runs through the data problem rather than through SOC operating experience.

Outside validation comes through investors and advisors rather than press profiles. Sequoia led the Series A with CRV and Mantis VC participating, and the about page lists Sequoia partner Bogomil Balkansky among the advisors. No independent press coverage profiles the founding team, which keeps the public evidence one tier below founders with prior security exits. [s2, s7, s17, s12]

Scanner's strongest trust argument is structural rather than certificate-based. Logs and indexes never leave the customer's S3 buckets in any deployment model, the BYOC option keeps even the compute inside the customer's AWS account, and the docs describe role-based access control and a dedicated audit index. For buyers whose concern is data custody, the architecture answers a question most vendors answer with paperwork.

The headline compliance artifacts are published as homepage badges. Scanner's homepage carries an Enterprise-Grade Security section displaying SOC 2 Type II Certified, GDPR Compliant, and Data Residency Options, which cover the attestations most procurement reviews open with. Scanner's docs go one step further and point buyers to a Drata Trust Center for the full SOC 2 documentation, so a self-serve path to the attestation report already exists rather than the badge alone.

What did not surface on the pages reviewed is the next tier of evidence beyond the attestation, a penetration-test summary or a public vulnerability disclosure policy, which a vendor whose homepage logo wall includes banks such as Lead Bank and Live Oak Bank and whose pricing targets six-figure contracts will meet buyers expecting. Publishing those report-level artifacts would shorten the path for the next regulated buyer. [s5, s6, s1, s4, s19]

Add analyzed competitors to compare them side by side with Scanner.

Scanner publishes its segmentation as pricing tiers. The multi-tenant tier addresses fast-growing companies centralizing logs from core infrastructure, the single-tenant tier names mid-sized companies with compliance requirements and dedicated SOC operations, and the Bring Your Own Cloud tier names large organizations with strict regulatory compliance and data-residency needs. The case studies page courts fast-growing, cloud-native companies explicitly.

The visible customer mix matches that ladder and skews toward fintech and regulated buyers. The Series A post names Notion, Ramp, BeyondTrust, Lemonade, Benchling, Postman, and EliseAI, and the homepage logo wall adds Confluent, Tide, Lead Bank, and Live Oak Bank. Banks and an insurer alongside product-led technology companies suggest the compliance-driven retention pitch sells beyond the early-adopter crowd.

The evaluating persona is the detection engineer, with a second persona emerging. Ramp's case study speaks through a detection engineer, the docs organize use cases around incident response, detection engineering, and threat hunting, and Notion's writeup comes from a software engineer building a security agent. That second reader, the engineer wiring an agent to a data source, becomes visible in Scanner's public evidence only with the MCP announcement and Notion's writeup.

One structural constraint shapes the segment. The product indexes data in Amazon S3 and runs on AWS compute, so the buyer who fits best is an organization whose storage and compute already live in AWS. The ingestion surface reaches wider than the storage layer, since the docs list Azure Activity and Google Cloud Platform audit logs among the supported sources, but the data plane itself stays AWS-native.

Scanner's capability claims center on one mechanism, an index purpose-built for object storage. The docs describe compact schema-agnostic indexes written beside the logs, queries that fan out across short-lived Lambda workers at speeds the company states reach a terabyte per second, and a four-stage pipeline where the same query engine drives ad-hoc search and always-on detection rules. The AWS Marketplace listing claims a 250TB scan for indicators of compromise in under 30 seconds.

Customer-measured outcomes back the speed story at smaller scale. Ramp reports that queries which used to time out in Athena after 30 minutes complete in about a minute, and that searchable history grew from 15 days to a year. Notion reports an 84% reduction in median investigation time for false-positive alerts after wiring its Scruff agent to Scanner, Wiz, and CrowdStrike. The headline scan-speed figures remain vendor-stated, with no independent benchmark in reviewed pages.

Scanner's AI advantage is positional rather than algorithmic. The company ships no detection model it brags about. Instead it built the MCP server that lets customers' AI agents query the data lake directly, and the Series A post reports that agents became the platform's most active users within twelve weeks. Notion's production agent is the proof that the position is real rather than aspirational.

The company claims no data advantage in reviewed pages. Logs and indexes stay in buckets the customer owns by default, Scanner offers to host that storage as a standard option, and no cross-customer dataset to train on or to lock customers in with appears in the record. Reviewed pages do not describe Scanner's telemetry, metadata, or model-training practices either way. The differentiated asset on show is the query engine itself, which the founders discuss in enough public technical depth for practitioners to judge.

Scanner sells through a sales-assisted motion with published price anchors. The pricing page shows example annual costs by daily log volume, the homepage routes buyers to a demo, and an AWS Marketplace seller profile makes Scanner purchasable through that channel. Publishing six-figure example prices filters the pipeline toward buyers who already know their log volume, which is exactly the buyer who feels SIEM pricing pain.

Customer evidence arrives in more than one voice. Scanner's own materials name seven customers and carry a Ramp case study with a named detection engineer, and Notion separately published its Scruff agent architecture with Scanner in the stack on its own engineering blog. Press coverage of the round repeats the customer names but adds no independently sourced accounts.

The public face of the company is still founder-led. Cliff Crosland writes the funding and product announcements and carries the technical story on practitioner podcasts, and the about page lists only the two founders as officers, with no sales or revenue leader named. Who conducts the selling is not documented in reviewed pages, but a company with seven named logos and a fresh Series A sits at the revenue stage where founder-led sales are still the usual motion.

Distribution beyond the direct motion is thin but pointed. The AWS Marketplace profile and the MCP server are both channels where a buyer or an agent builder encounters Scanner without a salesperson, and Notion's public writeup functions as unpaid evangelism to exactly the right audience. No reseller, MSSP, or technology-partner program appears in reviewed pages, so the channel layer that usually carries a vendor past founder-led scale has not surfaced publicly.

Scanner prices on the unit buyers already use to measure the problem. The pricing page publishes example annual costs by daily log volume, with a multi-tenant tier at $50k to $95k for 250 to 500 gigabytes per day, a single-tenant tier above it, and a contact-sales Bring Your Own Cloud tier from two terabytes per day. Charging by ingestion volume mirrors how SIEM budgets are already sized, which lets a buyer compare directly against the bill Scanner proposes to cut.

Unlimited retention inside every tier is the pricing weapon. SIEM pricing couples cost to how much history a team keeps, and Scanner decouples them, since every published tier puts the data plane in the customer's own object storage, so the customer's S3 bill carries the history. Scanner also offers to host that storage as a standard option for teams that do not want to run AWS infrastructure. The vendor's marketing claims large cost reductions against ingestion-priced tools, a claim buyers can sanity-check because both the example prices and their own log volumes are known quantities.

The pricing unit also matters for agent economics. Scanner's published anchors are example annual costs by daily log volume, so the visible price ladder tracks ingestion rather than query activity, which should make the cost of heavy agent querying easier to predict. Scanner does not publish contract terms, and the pricing page directs buyers to sales for pricing tailored to volume, retention, and deployment, so whether query, compute, or overage charges apply is not established in the public record. Scanner's expansion lever still rides on log growth, which telemetry-reduction pipelines could erode.

Scanner delivers the same data-plane promise across three operating models. Managed multi-tenant and single-tenant deployments run compute that Scanner operates, Bring Your Own Cloud runs everything inside the customer's AWS account, and the docs state that by default logs and index files reside in S3 buckets the customer owns, with Scanner-hosted storage a standard option and GCS and Azure Blob data passing through a short-lived collect buffer. The single-tenant and BYOC tiers exist for isolation and residency requirements, which matches the bank and insurance names on the logo wall.

Onboarding leans on S3 mechanics the customer already has. The docs walk through AWS infrastructure setup and connecting a first source through Scanner Collect's pre-built integrations, and the vendor claims a team can stand up a working data lake in a day or less. Logs flow into buckets the customer controls, and Scanner indexes what arrives, so adoption rides on bucket notifications rather than re-plumbing pipelines.

The operational risk profile depends on how a log reaches the lake. For sources that write into the customer's own S3 buckets, Scanner adds index files beside the logs rather than becoming the system of record, so those raw logs keep accumulating whatever happens upstream of them. Other paths run through Scanner-operated components, since the docs describe Scanner Collect pushing and pulling SaaS logs into an S3 collect buffer and GCS and Azure Blob data passing through the same buffer. Reviewed pages document no outage behavior for any path, and no SLA, status page, or support-tier documentation appears in them. The dependency that remains under every operating model is AWS itself, since both the data plane and the serverless query layer are AWS-native.

Scanner's trust argument leads with architecture and adds the standard attestations. Logs and indexes stay in the customer's buckets by default, the BYOC model keeps even compute inside the customer's account, and the docs describe role-based access control plus a dedicated audit index that records activity for accountability. For the data-custody question that dominates security-vendor reviews, Scanner answers first with topology rather than paperwork.

The headline compliance artifacts are published as homepage badges. The site displays SOC 2 Type II Certified, GDPR Compliant, and Data Residency claims, which cover the attestations most procurement reviews open with. The docs go one step past the badge and point buyers to a Drata Trust Center for the full SOC 2 Type 2 documentation, so a self-serve path to the attestation report already exists rather than the homepage badge alone.

What the cited public record does not document is the next tier of evidence beyond the attestation report: a penetration-test summary or a public vulnerability disclosure policy. Security vendors get held to a higher bar than other suppliers, and a company whose published example prices start at $50k will meet teams that expect those deeper artifacts too.

The remaining gap may be a publishing choice more than a posture problem. Scanner displays bank and insurer logos on its homepage, including Lead Bank, Live Oak Bank, and Lemonade, and those are the buyers most likely to ask for deeper artifacts in a private review. What a displayed logo does not establish is whether such a review happened or on what terms. Publishing the report-level artifacts would shorten the path for the next regulated buyer and remove an objection competitors can exploit.

Scanner committed publicly to being a component rather than a destination. A June 2026 company post rejects building an AI SOC product, describes the headless pattern where the investigation loop runs through Slack, Notion, or Jira while the SIEM tab stays closed, and positions Scanner as the searchable data layer those loops run on. The company's stated long-term goal, relayed in press, is the foundational data layer where analysts and agents work over complete datasets.

Building on Scanner is already happening on the customer side. Notion's Scruff agent treats Scanner as one of its core data sources, the MCP server formalizes that interface for any agent framework, and Scanner Collect handles the inbound side with pre-built integrations. What does not appear in reviewed pages is a vendor-side ecosystem, no technology-partner program, no integration marketplace, and no co-built offerings with the SIEM or SOAR vendors whose customers Scanner courts.

The platform dependency runs one level down. Scanner's data plane, query layer, and procurement channel all run on AWS, which makes AWS both the substrate and the most credible absorber. The bet only compounds if the agent-builders' dependence on fast data outpaces the hyperscaler's interest in shipping the same capability natively.

Scanner's founding team matches the problem it chose. Cliff Crosland and Steven Wu, both Stanford CS, led engineering for Accompany's data platform through the Cisco acquisition and then built large-scale systems at Cisco, where Cliff was a principal engineer on the Webex People Graph. Steven previously founded Predictive Edge, which Dropbox acquired. The pair experienced the log-economics problem as operators before building the product, which the Series A post tells as the origin story.

Public credibility runs through technical channels rather than security-industry pedigree. Cliff carries the architecture story on the Data Engineering Podcast and similar shows, and the company's engineering blog posts are specific enough for practitioners to evaluate. Neither founder shows security-operations history in reviewed pages, so the domain credibility the founders supply is reinforced by customers like Ramp's detection engineers and Notion's security team vouching in their own words.

The advisor bench supplies the security-operations weight the founders lack. The about page lists Sequoia partner Bogomil Balkansky alongside a deep security roster: two former Splunk Security GMs in Haiyan Song and Mike Horn, Vanta co-founder and CEO Christina Cacioppo, sitting CISOs at Notion and Chevron, the CSO of Axonius who formerly ran security at Disney, and Autodesk's chief trust officer. That bench reads as deliberate compliance and SOC-buyer credibility for a company selling six-figure contracts to regulated accounts. What still does not appear is any named full-time security or go-to-market executive or any headcount figure, so the unannounced GTM and security-leadership hires remain the main execution unknowns.