Overview
Scanner builds a security data lake that stores all security logs and makes them accessible for security operations teams and AI agents, offering an alternative to traditional SIEMs by keeping every log and enabling fast search. It works by schemaless indexing across the whole environment, enabling fast full-text search across petabytes with sub-ten-second queries; it collects and enriches logs from clouds, SaaS tools, and data streams, with API access for AI agents. It differentiates from competitors by avoiding high ingestion costs, supporting full retention with open formats to reduce vendor lock-in, and providing near real-time detection rather than slow, scheduled queries. Its goal is to prevent attacks from going unseen due to missing logs, by giving complete log retention and fast, scalable search for security teams and AI agents.
Work here?Claim your company
Simplify's take
What believers are saying
- Notion, Ramp, and BeyondTrust already use Scanner for investigations across years of logs.
- By July 29, 2026, SVCI CISOs invested after testing production workloads.
- October 2026 releases added CIDR search, backfills, and CrowdStrike, SentinelOne, Google Workspace, GitHub, Snowflake support.
What critics are saying
- Splunk, Datadog, and Elastic can copy faster search while bundling existing security workflows.
- Scanner still depends on AWS S3 economics; one pricing shift breaks its core cost promise.
- If agents stop driving 80% of queries, Scanner loses the wedge powering its 2026 narrative.
What makes Scanner unique
- Scanner’s March 10, 2026 Series A from Sequoia validated its security-data-lake architecture.
- Its October 28, 2026 V6 format cut page scans 5.5–6x and storage 25%.
- Scanner’s MCP and API layer lets human analysts and AI agents query years of logs.
Help us improve and share your feedback! Did you find this helpful?