Scanner, which helps organizations build cloud-native security data lakes for threat hunting, detection, and response, raised a $22M Series A led by Sequoia
The company connects AI agents to security data lakes for interactive investigations, detection engineering, and autonomous response.
Context & Ripple Effects
Scanner enters a security-AI market where data collection and analysis have already been strategic assets: SentinelOne’s acquisition of high-speed logging startup Scalyr tied logging infrastructure to an AI security platform.
Recent funding for Vega’s cloud-threat detection product underscores investor demand for AI applied to cloud security data. Scanner’s emphasis on a security data lake positions it at the data-access layer beneath investigation, detection engineering and response workflows.
First-order effects
- Scanner gains capital and a prominent lead investor to build out its cloud-native security-data platform and AI-agent workflows.
- Security teams evaluating the product get another vendor focused on connecting their security data to interactive investigation, detection engineering and autonomous response.
Second-order effects
- Vendors spanning security analytics, logging and detection will face pressure to show that their AI features can work over broad customer data estates, rather than only within proprietary tools.
- The overlap between data-lake infrastructure and security operations may sharpen competition for the workflows that turn collected telemetry into detections and response actions.
Third-order effects
- If security buyers consolidate data and automation around a smaller set of platforms, control of the underlying security-data layer could become as consequential as the AI agents operating on it.
- The pattern points to security products being differentiated less by standalone AI claims and more by access to usable, cloud-native data and integration into operational workflows.
The trend: Cybersecurity is moving toward AI-assisted operations built on centralized security-data layers, with agents becoming an interface for investigation and response rather than a separate product category.