Cribl
Cribl is a San Francisco-based infrastructure company founded in July 2018 by three former Splunk employees—Clint Sharp (CEO), Dritan Bitincka (CPO), and Ledion Bitincka (CTO)—to address a structural problem in enterprise observability: the cost and complexity of managing exploding data volumes across multiple monitoring platforms.
Profile
Data pipeline and telemetry management platform that filters and routes observability data across monitoring tools to reduce ingestion costs.
Cribl is a San Francisco-based infrastructure company founded in July 2018 by three former Splunk employees—Clint Sharp (CEO), Dritan Bitincka (CPO), and Ledion Bitincka (CTO)—to address a structural problem in enterprise observability: the cost and complexity of managing exploding data volumes across multiple monitoring platforms. The company's first product, LogStream, pioneered what Cribl calls the "Cribl in the Middle" approach—a data pipeline that sits between telemetry sources and analytic destinations, allowing enterprises to filter, enrich, and route data selectively rather than ingesting every byte into expensive SIEM systems.\n\nThat foundation expanded into a multi-product suite: Cribl Stream (the core pipeline), Edge (edge collection), Search (search-in-place), Lake and Lakehouse (cloud storage with configurable retention), Cloud (managed SaaS), and AI (copilot features). The company has raised $600 million across six rounds, culminating in Series E in August 2024 ($319 million including secondary sales) at $3.5 billion valuation.\n\nRevenue growth accelerated sharply: $200 million ARR in January 2025 (up 70% year-over-year), then $300 million ARR by May 2026—a 50% jump in four months—driven partly by enterprises modernizing telemetry for agentic AI.
The company serves 43 of the Fortune 100 and 130 of the Fortune 500, including ServiceNow, Nutanix, and Cox Automotive. Net dollar retention exceeds 130%, and cloud ARR now represents over $130 million growing past 75% annually.\n\nLeadership matured for an IPO track: Mike Pyle (formerly VP of Enterprise Sales at GitLab) became CRO in September 2024. Mike Kourey (five IPO exits) and CJ Desai (MongoDB CEO) joined the board in 2025.
CEO Sharp told Fortune in January 2025 that an IPO is "not near-term"—likely 2027 or later.\n\nCribl's 2025 strategy pivoted toward agentic AI. In June, it launched Copilot Editor, translating raw logs into standard schemas and auto-generating pipelines. By fall, it released Notebooks (collaborative investigation workspace), BYOAI (bring your own model), and Model Context Protocol support, positioning its "Data Engine" as foundational for agentic workflows.
December saw Cribl become a launch partner for AWS Security Hub with full OCSF support. Glassdoor reviews average 4.4/5 stars with 91% recommending the company, though employees note intense pace and heavy remote work.
Who buys this
- Enterprise security operations centers needing SIEM modernization and centralized telemetry management
- Fortune 100/500 companies managing multi-tool observability stacks (Splunk, Datadog, cloud providers)
- IT operations teams using hybrid and multi-cloud environments requiring vendor-agnostic data routing
- Large organizations managing agentic AI workloads with exponential observability data growth
Publicly disclosed clients
- ServiceNow
- Nutanix
- Cox Automotive
- Hughes Network Systems
- Pegasystems
- Yale New Haven Health
- Sally Beauty
Strengths and what to watch
Strengths
- 50% ARR growth in four months (Jan–May 2026); 130%+ net dollar retention indicates strong land-and-expand
- Vendor-agnostic positioning between data sources and destinations; avoids the lock-in risk that makes Splunk/Datadog unattractive to cost-conscious ops teams
- Early AI integration (Copilot Editor, Notebooks, Model Context Protocol) positions platform as foundational for agentic AI observability—a real near-term problem as LLM deployments balloon data volumes
Watch for
- IPO timeline pushout: CEO indicated 2+ years away in Jan 2025; venture investors may pressure for acceleration if public-market conditions improve, risking employee equity expectations
- Customer concentration risk: 43 Fortune 100 + 130 Fortune 500 concentration means deal-loss cycles could impact growth; mid-market segment underdeveloped relative to competitors
- Competitive response from incumbents: Datadog and Splunk have launched or are expanding their own pipeline/routing capabilities; differentiation rests on pipeline-first positioning but is not defensible long-term
Recent moves
- 7w ago Cribl surpasses $300 million in ARR, more than doubling from $200M in January 2025
- 5mo ago Cribl eyes secondary offering after hitting $300M ARR milestone, signaling push toward IPO-readiness
- 7mo ago Cribl becomes launch partner for AWS Security Hub; announces full Open Cybersecurity Schema Framework (OCSF) support
- 8mo ago Chirantan 'CJ' Desai, President and CEO of MongoDB, appointed to Cribl board of directors
- 1y ago Cribl unveils Copilot Editor, AI-powered assistant that translates raw logs into standard schemas and auto-generates data pipelines
Key Information
- Industry
- MGMT/Monitoring
- Founded
- 2017
- Headquarters
- San Francisco, USA
Frequently Asked Questions
What is Cribl?
Cribl is a data pipeline and telemetry management platform that filters, enriches, and routes observability data across multiple monitoring tools. Founded in 2018 by former Splunk employees, it reduces ingestion costs by sitting between telemetry sources and analytics destinations, allowing selective data flow rather than storing everything.
How does Cribl reduce data ingestion costs?
Cribl's in-the-middle architecture sits between data sources and monitoring platforms, filtering and routing only relevant telemetry instead of ingesting everything into expensive systems like SIEM. This selective approach eliminates unnecessary data storage and ingestion, reducing overall costs while maintaining critical observability.
What are Cribl's main products?
Cribl offers Stream (core pipeline), Edge (edge collection), Search (in-place search), Lake and Lakehouse (cloud storage), Cloud (managed SaaS), and AI Copilot features. The product suite scales from simple data filtering to complex enterprise observability and agentic AI workload management.
Who uses Cribl?
Cribl serves 43 of the Fortune 100 and 130 of the Fortune 500, including ServiceNow, Nutanix, Cox Automotive, Hughes Network Systems, Pegasystems, Yale New Haven Health, and Sally Beauty. This enterprise adoption reflects strong traction in large organizations managing multi-tool observability stacks.
What is Cribl's Copilot Editor?
Launched in June 2025, Copilot Editor is an AI-powered assistant that automatically translates raw logs into standard schemas and generates data pipelines. It reduces manual pipeline configuration, allowing engineers to focus on complex observability workflows instead of repetitive schema mapping.
When is Cribl planning to go public?
CEO Clint Sharp told Fortune in January 2025 that an IPO is not near-term, suggesting 2027 or later. The company hit $300 million ARR in May 2026 and recently pursued a secondary offering, indicating progressive moves toward IPO readiness without a fixed timeline.
How Cribl compares
Direct head-to-head against 3 competitors. Picked by 7wData.
Cribl
- Positioning
- Data pipeline and telemetry management platform that filters and routes observability data across monitoring tools to reduce ingestion costs.
- Customer segments
- Enterprise security operations centers needing SIEM modernization and centralized telemetry management
- Strengths
- 50% ARR growth in four months (Jan–May 2026); 130%+ net dollar retention indicates strong land-and-expand
- Watch for
- IPO timeline pushout: CEO indicated 2+ years away in Jan 2025; venture investors may pressure for acceleration if public-market conditions improve, risking employee equity expectations
- Recent moves
- Cribl surpasses $300 million in ARR, more than doubling from $200M in January 2025
Datadog
- Positioning
- Full-stack observability platform with built-in pipeline routing, positioned as an all-in-one alternative to Cribl plus separate monitoring tools.
- Customer segments
- Enterprise DevOps and SecOps teams, FinOps leaders controlling ingestion spend, regulated industries requiring FedRAMP compliance.
- Strengths
- Pre-ingestion PII/PCI redaction with 150+ parsing rules, routing logs to any destination before they hit billing counters.
- Watch for
- Multi-dimensional usage billing compounds aggressively at scale. Mid-market teams routinely receive invoices 3x to 10x their contracted budget.
- Recent moves
- Acquired Eppo for $220M (May 2025), launched Datadog Experiments into GA (April 2026).
Cisco Splunk
- Positioning
- Full-stack SIEM and observability platform with built-in pipeline filtering, positioned as an all-in-one alternative to Cribl plus a separate analytics tool.
- Customer segments
- Large enterprises and regulated industries. Buyer is CISO or VP of IT Operations with existing Cisco or Splunk contracts.
- Strengths
- 47% SIEM market share with 11 consecutive Gartner Magic Quadrant Leader positions, backed by Cisco network telemetry integration.
- Watch for
- Ingestion-based pricing forces teams to limit what they monitor by budget, not risk. Nearly half of customers dislike it but feel locked in.
- Recent moves
- Cisco Data Fabric unveiled at .conf25 (September 2025), federating Splunk ingest, analytics, and a cold-tier Machine Data Lake into one pipeline.
Elastic
- Positioning
- Unified search, observability, and SIEM stack competing as a full-stack alternative to Cribl's vendor-neutral pipeline routing.
- Customer segments
- Enterprise security and platform engineering teams, SecOps analysts, federal agencies, cloud-native SREs.
- Strengths
- Single Elasticsearch index serving logs, metrics, traces, and security detections without data movement between tools.
- Watch for
- Consumption-based pricing produces unpredictable bills at scale. Mid-market self-managed costs run nearly 2x comparable OpenSearch setups.
- Recent moves
- Acquired Jina AI for $44.6M (October 2025) to add multimodal embedding and reranker models for search.
Sources
- cribl.io — Company overview, product portfolio (Stream, Edge, Search, Lake, Lakehouse, Cloud), customer base (Fortune 100/500), and positioning
- fortune.com — January 2025 $200M ARR milestone, 70% YoY growth, CEO quote on IPO timing, customer count (43 Fortune 100, 130 Fortune 500)
- www.crunchbase.com — Funding history, Series E round ($319M in Aug 2024 at $3.5B valuation), investor list, founding date July 2018
- cribl.io — Leadership team details including Mike Pyle (CRO from GitLab), CPO Dritan Bitincka, CTO Ledion Bitincka, and other executives
- www.glassdoor.com — Employee reviews (4.4/5 stars, 91% recommend), workplace culture assessment, compensation and benefits feedback
- www.globenewswire.com — June 2025 Copilot Editor launch with AI pipeline generation and schema mapping capabilities
- www.globenewswire.com — April 2025 strategic partnership with Palo Alto Networks for Cortex XSIAM integration
- techtarget.com — Series E funding details ($319M), valuation ($3.5B), and IPO positioning