Scanner

Scanner is a cybersecurity data platform that indexes security logs where they already reside — object storage such as Amazon S3, Google Cloud Storage and Azure Blob; SaaS applications such as Okta and CrowdStrike; and the streaming pipelines (Kafka, Kinesis, MSK) that feed lakes and warehouses including Snowflake, Databricks and ClickHouse. The company positions the product as a cloud-native security data lake intended to cover the roughly 90% of security telemetry that typically never reaches a SIEM because ingestion and indexing costs force sampling and short retention. Customers can run Scanner alongside an existing SIEM or use it as their primary SIEM.

The platform combines schema-less ingestion (Scanner Collect, with dozens of pre-built integrations for sources such as AWS CloudTrail, Azure, Google Cloud, Okta, GitHub, Tines and PagerDuty), full-text search across petabytes, and a streaming detection engine that uses stateful stream processing to evaluate rules continuously rather than re-scanning historical data. Detections are managed as code from GitHub, with more than 400 out-of-the-box rules across 20+ log sources, plus role-based access control, an API, AI-generated natural-language explanations of logs and alerts, and a Model Context Protocol (MCP) server that gives AI agents structured access to the data lake. Stated use cases include incident response, detection engineering, threat hunting, SIEM augmentation, primary SIEM operation, and compliance and audit evidence.

Deployment options are a managed service (multi-tenant or single-tenant) and Bring Your Own Cloud, where Scanner compute runs entirely inside the customer's own AWS account. By default logs and index files stay in customer-owned S3 buckets, though Scanner can host the collect buffer and index buckets. The company states SOC 2 Type II certification, GDPR compliance and data residency options.

Founding story

The founders say that at their previous employers they watched log volumes and associated bills grow to the point where security teams had to choose between paying for traditional SIEMs or deleting data and accepting blind spots. They drew on experience building large-scale distributed systems and algorithms at Cisco, Dropbox and Accompany to build a platform delivering sub-10-second search across petabytes at lower cost [3].

Business model

Scanner sells its security data lake platform to enterprise security teams, offered either as a managed service (multi-tenant or single-tenant compute run by Scanner) or as Bring Your Own Cloud, where compute runs inside the customer's own AWS account and data remains in customer-owned S3 buckets [2].

Positioned against SIEM ingestion-based pricing, the architecture scales compute up during a query and back down afterwards so customers pay only for the compute used by a search; the company claims unlimited retention at roughly 90% lower cost than a traditional SIEM [2][4][5].

Traction

Named users include Notion, Ramp, BeyondTrust, Lemonade, Benchling, Postman and EliseAI. Ramp reports moving from two weeks to months of searchable history and rapidly searching years of logs for indicators of compromise; Lemonade's CISO reports searching a full year of logs in seconds. Notion runs a security AI agent called Scruff that draws on Scanner alongside Wiz and CrowdStrike. The company says AI agents became some of the most active users of the platform in recent weeks/months [0][4][5].

Latest developments

In March 2026 Scanner announced a $22m Series A led by Sequoia Capital, with CRV, Mantis VC and angel investors including Vanta CEO Christina Cacioppo, MongoDB board chairman and former Amazon CISO Tom Killalea, and Rockset founder and OpenAI head of infrastructure Venkat Venkataramani. The capital is earmarked for expanding platform capabilities and reaching more security teams, with emphasis on AI agents that continuously query security data to triage alerts and hunt threats [4][5][6][7].