Databricks is expanding beyond data processing into cybersecurity with Lakewatch, a new offering positioned to challenge established SIEM providers like Splunk and Palo Alto Networks. The launch aligns with the company's potential public listing plans in 2026, aiming to solidify its $134 billion valuation.

CEO Ali Ghodsi argues that legacy pricing models, based on data volume, are unsustainable against modern threat volumes. Ghodsi noted that storing all telemetry in traditional SIEMs is often prohibitively expensive. Instead, Lakewatch charges based on computational work. This approach encourages engineers to ingest logs from non-traditional sources like Slack or Workday without worrying about storage costs, provided the data remains in cloud data lakes.

The platform leverages generative AI to prioritize alerts and provide context, allowing teams to query threats directly through Databricks' Genie agent. Early adopters include Adobe and National Australia Bank. Anthropic also utilizes the platform, running its own models within Lakewatch to secure its infrastructure.

To build this capability, Databricks acquired security startup Antimatter in 2025 and recently agreed to purchase SiftD. The latter brings significant expertise from Splunk, including three founders with nearly four decades of combined experience at the security giant. Co-founder Reynold Xin noted the SiftD team was instrumental in creating Splunk's core search technology.

This expansion arrives during a turbulent period for software stocks. The WisdomTree Cloud Computing Fund has dropped 19% in 2026, while investors worry AI tools might disrupt incumbent security vendors. Ghodsi remains confident, stating Databricks intends to lead this disruption rather than suffer from it. Future updates will reportedly include automated threat response features. The move signals a broader trend where unified data platforms absorb adjacent workflow responsibilities.

Source: CNBC