Panther
Acquired1 known investors
Panther is a cloud-native SIEM and AI SOC platform using detection-as-code and AI agents; Databricks agreed to acquire it in 2026.
Also known as Panther Labs · Panther, Inc.
Founders & leadership
Investors · 1
Company profile
researched Aug 2026Panther (also referred to as Panther Labs; corporate entity Panther, Inc.) builds a security operations platform that combines a cloud-native SIEM with an open security data lake and AI agents intended to automate detection, triage, investigation and response. The platform ingests security telemetry through more than 100 pre-built, parsed integrations spanning cloud infrastructure, identity providers, endpoints, networks and SaaS applications, and applies detection-as-code (including Python-based detections) so security engineering teams can version and govern rules. Product components listed by the company include a data pipeline, an AI SOC agent, a detection engine, alerting and triage automation, analytics and reporting, and integrations.
The company positions its agentic workflows around a closed loop: agents hunt across the data lake on a schedule, investigate alerts with assembled context, automatically close alerts confirmed benign, and feed outcomes back into tuned detections. Governance features include human-in-the-loop approval for every write action, logging and review of AI actions, enforcement of user permissions so agents act under the invoking identity, and tenant isolation on Amazon Bedrock with no cross-tenant data sharing and no customer data used in model training. Use cases marketed by the company include AI SOC transformation, detection engineering, threat hunting, compliance, managed detection and response, cloud security posture and threat intelligence.
On June 16, 2026, at the Data + AI Summit, Databricks announced its intent to acquire Panther to advance its "security lakehouse" category and its Lakewatch product, positioning the combination as a replacement for legacy SIEMs. The transaction was announced as subject to customary closing conditions, including required regulatory clearances, and was described as Databricks' third security acquisition, following Antimatter and SiftD.ai.
Founding story
Founder and CEO Jack Naglieri started Panther in 2018 after a career in security engineering and incident response at Airbnb and Yahoo, motivated by the view that existing tooling was not built for the scale and needs of security teams operating in modern cloud environments. Naglieri led the open source StreamAlert project originally created at Airbnb, and designed Panther to rebuild SIEM in a scalable, cloud-native form so teams could query data quickly, detect genuinely suspicious activity and ingest contextual signals at any scale.
Business model
Panther sells its SIEM and AI SOC platform to enterprise security organizations, with a sales-led motion built around booked demos and enterprise deployments; customer material cites cost savings versus incumbent SIEM spend as part of the value proposition.
Traction
Company materials cite roughly 2x faster investigations, 70% faster detection tuning, $400,000 in cost savings, and 85% fewer alerts reaching the queue due to outcome-based suppression of repeat alerts. Databricks states Panther is trusted by leading security teams including Anthropic, whose Head of Defense credited Panther with enabling a software engineering approach to detection and response. A customer executive reported standing up a fully deployed in-house enterprise SOC within weeks using Panther's SIEM and AI SOC.
Latest developments
On June 16, 2026, Databricks announced its agreement to acquire Panther, citing plans to combine Panther's agentic SOC workflows, detection-as-code capabilities and 100+ integrations with Databricks' Lakewatch security lakehouse; Panther's website promotes the company joining Databricks.
▸Full profile — market position, technology, go-to-market, geography, history, risks & controversies
Market position
Databricks describes Panther as a leading AI SOC platform and frames the acquisition as establishing the security lakehouse category as a disruptor of legacy SIEM. Panther itself contrasts its purpose-built agentic platform with AI features bolted onto legacy SIEM and SOAR stacks and with agents assembled across fragmented data sources.
Panther emphasizes being designed for agents from the outset rather than retrofitting AI onto legacy SIEM/SOAR tooling; an open security data lake without vendor lock-in; detection-as-code with code-driven, real-time monitoring; a feedback loop in which investigation outcomes suppress repeat alerts and sharpen future detections; and transparency controls such as human-in-the-loop approvals, identity-scoped agent permissions and tenant isolation.
Technology
Cloud-native architecture combining a data pipeline, an open security data lake positioned to avoid vendor lock-in, a real-time detection engine driven by detection-as-code (including Python), and AI agents for scheduled threat hunting, alert triage, investigation and agentic runbooks. Natural-language detection creation is supported. AI is run in an isolated tenant on Amazon Bedrock, with permission enforcement, audit logging of AI actions and mandatory human approval for write operations. The platform ships with more than 100 deeply parsed, out-of-the-box data integrations across cloud, identity, endpoint, network and SaaS sources.
Go-to-market
Direct enterprise sales supported by demo requests, product tours, customer stories, webinars, podcasts, documentation and a partner program; the company also publishes a blog and knowledge base and maintains a trust page.
Enterprise and cloud-native security teams, including security operations centers, detection engineering and threat hunting functions, and compliance and MDR-oriented buyers. Named or referenced customers include Anthropic, and testimonials come from organizations with more than 500 employees and from a cyber defense and engineering leader.
Geography
Panther is a remote-first company with a distributed, global team.
History
Founded in 2018 by Jack Naglieri, Panther grew from roots in the open source StreamAlert project into a cloud-native SIEM and AI SOC platform built on detection-as-code and security data lakes, raising over $100 million in venture capital along the way. The company later extended the platform with agentic AI capabilities for triage, investigation and response. In June 2026, Databricks announced an agreement to acquire Panther, and Panther's website subsequently promoted its joining Databricks to build the security lakehouse.
Risks & controversies
The Databricks acquisition was announced as an intent to acquire and remained subject to customary closing conditions, including any required regulatory clearances.
Compiled by commissioned research from 8 cited public sources — announcements, filings, and press listed under research sources below.
Key figures
latest reportedCompany-reported or press-reported figures, each dated to when it was claimed — not independently audited.
Timeline · 1
launches, deals, and filingsDatabricks announced at Data + AI Summit its intent to acquire Panther, an AI SOC platform, to advance its security lakehouse vision and its Lakewatch product. The deal, Databricks' third security acquisition after Antimatter and SiftD.ai, was subject to customary closing conditions including required regulatory clearances.
Dated company events from announcements, filings, and press; legal rows summarize public dockets and regulator releases.
▸Research sources · 8
primary sources listed
- Pantherpanther.co · web
8 public sources were cited for this profile; the first-party ones are listed here.
Frequently asked questions
- What does Panther do?
- Panther is a cloud-native SIEM and AI SOC platform using detection-as-code and AI agents; Databricks agreed to acquire it in 2026.
- Who founded Panther?
- Panther was founded by Jack Naglieri.
- Who are Panther's investors?
- Panther's investors include Vibe Capital.