At this time, we’re asserting Lakewatch, a brand new open, agentic SIEM designed to assist organizations defend in opposition to more and more refined agent attackers. Lakewatch unifies safety, IT, and enterprise information right into a single, ruled setting for AI detection and response. With open codecs, Lakewatch permits clients to ingest, retain and analyze unprecedented volumes of multi-modal information, whereas slashing prices and eliminating vendor lock-in. Safety groups acquire full visibility throughout the enterprise and may deploy defensive safety brokers to automate risk detection and response at large scale. Lakewatch is launching at the moment in Personal Preview, with clients together with business leaders like Adobe and Dropbox.
We’re additionally launching an “Open Safety Lakehouse Ecosystem,” which incorporates main safety and supply companions to assist clients automate the normalization of telemetry into open codecs, and reply to threats with the unified scale they should meet fashionable threats with automated, machine-speed protection.
Safety for the Agentic Period
Safety is basically altering. Cyberattacks are not simply human-operated. They’re more and more AI-driven and automatic. LLMs have found 500+ zero days in open-source code, AI brokers have grow to be top-ranked hackers on bug bounty platforms, and state-sponsored teams are weaponizing AI to automate intrusions. Attackers now function at machine scale, working 24/7 to assemble exploits and coordinate assaults.
Within the face of those machine-scale assaults, even one of the best safety operations groups face structural constraints. At this time’s safety instruments require analysts to manually enrich alerts, hand-author detection guidelines, and take a look at risk searching hypotheses over days or even weeks. These workflows might be efficient in opposition to human-paced threats. In opposition to AI-driven assaults working 24/7 and at machine velocity, the structure itself turns into the bottleneck. ZeroDayClock.com discovered that the imply time to take advantage of has collapsed from 23.2 days in 2025 to only 1.6 days in 2026.
The issue compounds whenever you have a look at the information. Giant enterprises generate terabytes, and even petabytes, of safety information each day, however conventional SIEMs couple storage with compute, making a monetary penalty on each byte ingested. Groups reply by limiting ingestion, filtering information by routing layers, deleting historic information, and ignoring multimodal sources like chat logs and video solely. This creates a harmful asymmetry: attackers use AI brokers to research all the pieces and assault anyplace, whereas defenders see solely a fraction of their very own information. Conventional SIEMs cannot course of multimodal information, but it is precisely the place social engineering assaults, insider threats, and immediate injection makes an attempt conceal.
This is not only a value or scale downside. It is a elementary architectural mismatch between the threats we face and the instruments we’ve got to battle them. We have solved this precise downside earlier than. Information warehouses had the identical limitations: costly ingestion, siloed information, restricted to particular use circumstances. The lakehouse disrupted that mannequin with open codecs, low cost storage, and assist for any information sort. Now we’re bringing that very same transformation to safety.
Lakewatch brings the economics and structure of the lakehouse to safety operations. You possibly can ingest and retain 100% of your safety telemetry (together with multimodal information), analyze it alongside all your online business information, and deploy AI-powered brokers for detection and response at a fraction of legacy prices.
How Lakewatch Adjustments Safety Operations:
Full Visibility Throughout All Information
Organizations already possess the context wanted to analyze threats. HR techniques, collaboration platforms, software logs, and transaction information sit within the lake at the moment, however conventional safety instruments cannot entry it with out expensive duplication. Lakewatch flips the mannequin: safety runs straight on the lakehouse. Constructed on Unity Catalog, your safety information sits alongside all the pieces else. When an alert fires, you may immediately correlate throughout any information supply with out transferring recordsdata or switching instruments. Trendy assaults exploit gaps between techniques and depend on social engineering, insider context, and multimodal indicators that legacy instruments can’t course of. With all context in a single place, analysts can detect and include threats in minutes as a substitute of days.
Lakewatch makes this doable by:
- Enterprise-wide governance: High quality-grained entry management at desk, row, column, and attribute ranges with full auditability throughout all information.
- Open requirements: Constructed on the Open Cybersecurity Schema Framework (OCSF) so your information by no means locks into proprietary codecs.
- Automated ingestion: Lakeflow Join handles ingestion and normalization of main safety sources (AWS, Okta, Zscaler, and so on) into standardized tables.
- True information possession: Retailer information in Delta Lake or Apache Iceberg in your personal cloud storage, run queries throughout any cloud, and stop vendor lock-in.
Combat Brokers with Brokers
Conventional SIEMs depend on bolt-on AI options that may’t entry the complete context of your information. Lakewatch brings embedded AI on to the place your safety information lives. Genie automates important workflows corresponding to ingesting and parsing new log sources to OCSF, authoring net-new detections based mostly on the most recent risk intelligence, modifying present guidelines to scale back false positives, and translating pure language questions into SQL queries. Genie Areas lets safety groups question petabytes of knowledge utilizing plain English as a substitute of specialised question languages, democratizing risk searching throughout ability ranges.
Key Capabilities Embody:
- Genie Code: AI Assistant to automate ingestion, authoring net-new detections, modify guidelines to scale back false positives, and translate pure language questions into SQL queries for investigation.
- Genie Areas: Pure language question interface and agentic harness permits any consumer to carry out complicated multi-step risk searching, asking questions of their information with out studying complicated question languages.
- Detection-as-Code: Outline detection guidelines in YAML with SQL queries or Python notebooks, backtest in opposition to historic information, and deploy by CI/CD pipelines.
- Customized ML Detections: Practice and deploy machine studying fashions straight in your safety information utilizing MLflow, Characteristic Retailer, and Mannequin Serving, enabling anomaly detection, behavioral analytics, entity danger scoring, and extra.
- Highly effective dashboards: Create government, operational,and compliance dashboards with AI-enhanced visualizations for real-time monitoring.
Environment friendly SecOps at Petabyte Scale
By decoupling storage from compute, you may retailer petabytes of full-fidelity safety telemetry in your personal cloud storage and solely pay for compute. Run analytics solely when wanted utilizing Serverless compute. Preserve years of hot-queryable information as a substitute of weeks. You personal the information. You management the prices.
This interprets to:
- Personal your information: Safety telemetry saved in cloud object storage you management (S3, ADLS, GCS) utilizing open codecs.
- Lengthy-term retention: Meet compliance necessities and energy risk searching over multi-year durations with out value penalties.
- Predictable economics: Retailer full-fidelity logs at scale with out incurring per-byte license charges.
- Elastic compute on demand: Provision highly effective analytics and ML workloads solely when wanted with fine-grained value management.
- Serverless efficiency: Zero infrastructure to handle. Pay solely to your queries.
Deepening Partnership with Anthropic
Constructing on the success of the 2 firms’ present strategic partnership, Databricks and Anthropic are deepening their collaboration to ship agentic safety operations. Anthropic’s Claude fashions assist energy Lakewatch, utilizing Claude’s superior reasoning capabilities to correlate indicators throughout safety, IT, and enterprise information to floor threats sooner. Anthropic additionally makes use of Databricks for its personal safety lakehouse to achieve full visibility throughout its safety and enterprise information and detect threats earlier.
Open Safety Lakehouse Ecosystem
Databricks believes at the moment’s threats require open collaboration throughout the ecosystem the place clients are in full management of their very own information. That’s why we’re excited to announce the “Open Safety Lakehouse Ecosystem”, a fast-growing group of high safety distributors and supply companions together with Anvilogic, Arctic Wolf, Cribl, Deloitte, Obsidian, Okta, 1password, Palo Alto Networks, Panther, Proofpoint, Rearc, Slack, TrendAI, Wiz (now a part of Google Cloud), and Zscaler.
Zscaler shares Databricks’ dedication to an open ecosystem. We’re excited to hitch the Open Safety Lakehouse Ecosystem and provides our mutual clients the information and instruments they should defend AI-native assaults with AI-native options. — Eddie Parra, VP Options Architect Companion Ecosystem, Zscaler
As cyber threats evolve into AI-driven, machine-scale assaults, organizations could require a basically new structure to maintain tempo. Lakewatch represents a step ahead for safety operations, bringing the ability of the Databricks lakehouse to the SOC, enabling groups to harness their information, deploy clever brokers, and assist keep forward of evolving threats. — Jennifer Vitalbo, Managing Director, and Authorities and Public Providers Cyber Protection and Resilience Providing Chief, Deloitte & Touche LLP
Increasing Safety Management with Antimatter and SiftD.ai Acquisitions
To advance its open, agentic SIEM method, Databricks is asserting the acquisitions of each Antimatter and SiftD.ai. Antimatter was based by UC Berkeley safety researchers who laid the inspiration for provably safe authentication and authorization for AI brokers. SiftD.ai, based by the creator of Splunk’s Search Processing Language (SPL) and lead architects of Splunk’s search stack, will convey deep experience in large-scale detection engineering and fashionable risk analytics.
Be taught Extra
Lakewatch represents a elementary shift in how safety operations work. As an open safety lakehouse, the economics are higher, the structure is extra versatile, and the AI capabilities are native, not bolted on.
Lakewatch is launching in Personal Preview as we work towards broader availability. For those who’re coping with value pressures, retention limits, or trying to convey massive safety workloads onto your information platform, we wish to hear from you.
To be taught extra about how one can modernize your SOC, go to the Lakewatch product web page.