Scanner, which helps organizations build cloud-native security data lakes for threat hunting, detection, and response, raised a $22M Series A led by Sequoia
Context & Ripple Effects
Security operations have long treated high-speed logging and analytics as strategic infrastructure, illustrated by SentinelOne's acquisition of logging specialist Scalyr. Scanner sits in the newer layer: connecting AI agents to cloud-native security data lakes for investigation, detection engineering, and response.
The financing arrives alongside substantial investor interest in AI-driven cloud-threat detection, including Vega's $120M Series B. It matters because the contest is increasingly over the data foundation that makes automated security workflows usable, not just individual detection models.
First-order effects
- Scanner gains capital and Sequoia backing to develop and sell its cloud-native security data-lake platform and AI-agent workflows.
- Security teams evaluating Scanner get a better-funded prospective supplier for threat hunting, detection engineering, and response operations.
Second-order effects
- Cloud-security and detection vendors face added pressure to show how their AI features access, organize, and act on security data rather than merely generate alerts.
- Buyers may more closely compare data-lake architectures, integrations, and response workflows when choosing between point tools and broader security platforms.
Third-order effects
- If funding continues to favor data-layer security platforms, security-data ownership and workflow integration could become a more important competitive boundary for AI-native defense products.
- The pattern may push the market toward platforms that combine data storage, detection, investigation, and response, though enterprises' willingness to consolidate tools will determine how far that shift goes.
The trend: AI-native security is moving competition toward cloud-scale data foundations that can support detection and increasingly automated response.