Overview
Scanner builds a security data lake that stores all security logs for security operations teams and AI agents, providing an alternative to SIEMs by retaining every log and enabling fast search. It collects and enriches logs from cloud services, SaaS tools, and data lake/warehouse streams, with tools for search, investigation, detection and response, plus API access for AI agents. It uses schemaless indexing across the whole environment to enable fast full-text searches across petabytes with sub-ten-second queries, while offering open formats and lower ingestion costs to reduce vendor lock-in. Its goal is to ensure no cyberattack goes unseen because of an unseen log, by offering complete log retention and fast, scalable search for security teams and AI agents.
Work here?Claim your company
Simplify's Take
What believers are saying
- Sequoia led Scanner’s $22 million Series A on March 10, 2026.
- Notion, Ramp, and BeyondTrust already use Scanner, validating enterprise demand.
- Scanner indexed 1.4 PiB and 689 billion events in 80 hours on July 27, 2026.
What critics are saying
- Datadog, Elastic, Exabeam, and Panther crowd Scanner’s category with bundled security analytics.
- Scanner raised only $22 million in March 2026, while rivals can outspend it.
- If Sequoia-backed growth stalls, Scanner loses the funding needed to defend its index moat.
What makes Scanner unique
- Scanner indexes logs in customer-owned S3, combining data-lake economics with SIEM speed.
- Scanner MCP, launched December 1, 2025, lets AI agents query security data directly.
- Scanner searches years of logs in seconds and keeps continuous detections running.
Help us improve and share your feedback! Did you find this helpful?