Black Hat USA news roundup - August 3, 2026: Sumo Logic, Cribl, Mimecast. Published: August 3rd, 2026 Sumo Logic expands agentic AI capabilities to turn telemetry into action. The company today announced at the Black Hat USA conference Sumo Logic Analyst Agent, MCP Server and a new version of its Mobot conversational interface for security and observability workflows "We believe that telemetry is the fuel of the AI future," Jeremy Powell, CISO for Sumo Logic, said in the announcement. "Every threat detection, investigation, and response traces back to telemetry. As AI agents become an increasingly valuable tool for security operations, telemetry is the source of truth that separates a confident answer from an educated guess. We're seeing this in our very own SOC, building from trusted telemetry from Sumo Logic Dojo AI, we were able to reduce MTTR by 64% and saved 25 hours per week per analyst." The Sumo Logic Intelligent Operations Platform refines telemetry to intelligent, actionable vulnerability detection and remediation, while Mobot, and MCP Server provide access to security operations from where teams work. The SOC Analyst Agent investigates SIEM alerts automatically, makes decisions about how to deal with them, and through Mobot enables humans to analyze the decisions. Finally, MCP Server can connect code assistants via API tools to Sumo Logic SIEM and Log Analytics. Cribl's AI Platform debuts powerful new security capabilities. Cribl's new AI Observability app provides a view of AI activity to help manage token usage, spend, model adoption, and risk. The company said these new capabilities address the issues of increasing alerts, faster threats and a tool chain that is disconnected. The new capabilities build on the AI Platform for Telemetry as a foundational infrastructure layer to offer real, customer-facing applications that solve urgent enterprise problems today. "Security teams are telling us they don't want to keep solving every new problem by sending the same data into more closed boxes," said Clint Sharp, co-founder and CEO of Cribl. "They want visibility into enterprise AI usage and risk, stronger detections, and the flexibility to work across the tools and environments they already have. This is our new approach: keep the data open, run the security capabilities on top, and give teams a path forward without rebuilding the stack every time the market changes." New detection engineering capabilities can identify relevant events in the telemetry data, and due to Cribl's recent acquisition of CardinalOps, detections are mapped to the MITRE ATT&CK framework. Things like coverage gaps and broken and noisy rules are exposed and AI-assisted workflows can be applied to maintain and improve detection content, the company said in its announcement. Mimecast unveils tooling for agent risk. threat response. Mimecast Agent Risk Center for monitoring and governing agents is in beta, while Managed Threat Response is a service that provides AI-powered triage and analyst-confirmed remediation. Key capabilities of Agent Risk Center include a real-time inventory of AI tools and connections in an agent dashboard, an AI Rulebook to enforce policy by department, and response controls such as desktop app blocking, upload and paste blocking as well as contextual user nudges, the company said. The Mimecast Agent Risk Center is in beta as a free, opt-in capability for active Incydr subscription customers, with early access in September 2026 and general availability for those customers planned for January 2027. Article tags. About david Rubinstein. David Rubinstein is editor-in-chief of ITOps Times and SD Times.

Cribl acquires CardinalOps to further expand its AI Platform into security operations. Published: July 17th, 2026 SAN FRANCISCO, CA - Cribl, the AI Platform for Telemetry, today announced it is acquiring CardinalOps, an Agentic Detection Engineering solution. The acquisition adds detection engineering capabilities that help customers improve threat coverage, lower data costs, and strengthen their SOCs. This creates a flexible path toward replacing legacy SIEM architectures. Security teams are under pressure to process more telemetry, move faster against threats, and control the rising cost and complexity of their environments. With CardinalOps, Cribl can help customers connect those priorities: use telemetry more intelligently, continuously validate and improve detections, and do it in a way that lets customers modernize at their own pace, using the tools and architectures that make the most sense for their environment. "Security teams do not need more disconnected tools. They need a better way to turn telemetry into effective detections and outcomes," said Clint Sharp, co-founder and CEO of Cribl. "CardinalOps strengthens our AI Platform for Telemetry by adding deep detection engineering capabilities to the open data infrastructure our customers already rely on and serves as the foundation for a complete, open alternative to the SIEM stack they've outgrown." The acquisition reinforces Cribl's platform-first approach to the market. Rather than offering another rigid, all-or-nothing security stack, Cribl gives customers an open, vendor-agnostic platform to analyze, collect, move, store, and act on telemetry across their environments. That includes a federated model that lets customers search and work across telemetry where it already lives, without forcing everything into another centralized system. With CardinalOps, Cribl is adding foundational detection engineering capabilities to its AI platform, bringing the same open, AI-native model to the SIEM category itself: everything a SIEM does, on telemetry infrastructure customers already own. That federated foundation also allows Cribl to layer new security and observability solutions on the same shared telemetry foundation, giving customers more flexibility and better economics as they modernize their environments in the AI era. Founded in early 2020, CardinalOps is led by serial entrepreneurs and veterans of IDF's Unit 8200, Michael Mumcuoglu and Yair Manor, whose previous companies were acquired by Palo Alto Networks and Microsoft. CardinalOps uses AI to help organizations continuously assess and improve detection coverage by mapping security controls against real-world adversary behavior. It automates detection engineering tasks, helping teams identify and eliminate coverage gaps, find and fix broken or noisy rules, and unlock the full value of their existing security stack. Combined with Cribl's ability to manage telemetry at scale, CardinalOps adds the detection layer that helps customers move faster from raw data to actionable insights that improve security outcomes. "Too many security teams have good data, powerful tools, and endless alerts, but no real confidence that they are actually protected," said Michael Mumcuoglu, co-founder and CEO of CardinalOps. "We built CardinalOps so SOC teams could understand and improve coverage instead of just managing more noise. Joining Cribl lets us bring that directly into the telemetry layer and build what the market needs next: an open, AI-native alternative to the SIEM, where customers pay for better protection, not more data volume. That's what we're building next." With this acquisition, Cribl will also establish a new office in Tel Aviv, creating a strategic presence in one of the world's most active cybersecurity innovation hubs. The move will allow Cribl to tap into Israel's deep pool of cybersecurity talent and further accelerate the development of its modern security solutions. By bringing CardinalOps into the Cribl platform, Cribl is expanding its footprint in security operations while staying true to what differentiates the company in the market: an open platform, lighter-weight solutions on top, and the freedom for customers to adopt what they need without lock-in. The acquisition also creates a stronger foundation for future security offerings built on the Cribl platform. The integration of CardinalOps technology into the Cribl platform will bring Cribl's security capabilities together into a complete, open alternative to legacy SIEM architectures.

Cribl acquires Israeli cyber startup CardinalOps for around $100 million. The U.S. telemetry company will establish a Tel Aviv office after buying the AI-powered detection engineering startup. The acquisition marks Cribl's push into security operations and its effort to challenge traditional SIEM platforms. 16:28, 14.07.26 Cribl, a U.S. technology company specializing in telemetry management, announced on Tuesday the acquisition of Israeli startup CardinalOps, which develops agentic detection engineering solutions. The companies did not disclose the purchase price, but the deal is estimated at approximately $100 million. Following the acquisition, CardinalOps employees will join Cribl, which will establish a new office in Tel Aviv and is expected to expand its Israeli operations. Cribl develops an AI-powered telemetry platform for cybersecurity and IT teams and is considered one of the fastest-growing technology companies in the U.S., with annual recurring revenue of more than $300 million. The acquisition will extend Cribl's platform into security operations by adding detection engineering capabilities designed to help customers improve threat coverage, reduce data costs, and strengthen their security operations centers (SOCs). The move will allow Cribl to offer customers a more flexible alternative to traditional SIEM (Security Information and Event Management) architectures. Security teams are increasingly under pressure to process growing volumes of telemetry, respond faster to threats, and manage the rising costs and complexity of their environments. Through CardinalOps, Cribl will enable customers to use telemetry more intelligently, continuously validate and improve detection mechanisms, and modernize their security infrastructure at their own pace while maintaining flexibility over the tools and architectures they use. The acquisition reinforces Cribl's strategy of building an open, vendor-agnostic platform rather than another closed security stack. The company's platform allows organizations to collect, analyze, move, store, and act on telemetry across their environments. By adding CardinalOps' detection engineering capabilities, Cribl aims to create a broader alternative to legacy SIEM solutions based on the telemetry infrastructure customers already operate. "Security teams do not need more disconnected tools. They need a better way to turn telemetry into effective detections and outcomes," said Clint Sharp, co-founder and CEO of Cribl. "CardinalOps strengthens our AI Platform for Telemetry by adding deep detection engineering capabilities to the open data infrastructure our customers already rely on and serves as the foundation for a complete, open alternative to the SIEM stack they've outgrown." Founded in early 2020, CardinalOps is led by serial entrepreneurs and veterans of the IDF's Unit 8200, Michael Mumcuoglu (CEO) and Yair Manor (CIO). The founders previously built companies that were acquired by major cybersecurity and technology companies, including Palo Alto Networks and Microsoft. CardinalOps uses artificial intelligence to help organizations continuously assess and improve their threat detection coverage by mapping security controls against real-world attacker behavior. Its technology automates detection engineering tasks, enabling security teams to identify and close coverage gaps, fix broken or overly noisy rules, and maximize the value of their existing security infrastructure. Combined with Cribl's ability to manage telemetry at scale, CardinalOps adds a detection layer designed to help customers move faster from raw security data to actionable insights and improve their overall security posture. "Too many security teams have good data, powerful tools, and endless alerts, but no real confidence that they are actually protected. We built CardinalOps so SOC teams could understand and improve coverage instead of just managing more noise," said Michael Mumcuoglu, co-founder and CEO of CardinalOps. "Joining Cribl lets us bring that directly into the telemetry layer and build what the market needs next: an open, AI-native alternative to the SIEM, where customers pay for better protection, not more data volume. That's what we're building next." CardinalOps currently employs approximately 25 people, most of them in Israel. To date, the company has raised about $40 million from investors including Viola Ventures, Glilot Capital, Battery Ventures, In Venture, XT Hi-Tech, Gefen Capital, Symbol, and others.