Summary
Databricks has announced an agreement to acquire Panther, an AI-native Security Operations Center (SOC) platform, marking the company’s third cybersecurity acquisition following SiftD.ai and Antimatter. The deal was announced during Databricks’ Data + AI Summit and aims to strengthen the company’s “security lakehouse” vision by integrating Panther’s agentic SOC workflows into its existing Lakewatch platform.
Panther’s technology focuses on using AI agents to automate alert triage, investigation, and response — enabling organizations to detect more threats and process alerts at machine speed rather than human speed. Databricks CEO Ali Ghodsi framed the acquisition as essential for defending against increasingly sophisticated AI-driven attacks, arguing that traditional SIEMs cannot keep pace with the volume and velocity of modern threats.
The combined platform is positioned to disrupt the traditional SIEM market by operationalizing agentic detection and response on top of Databricks’ data lakehouse architecture, eliminating the data duplication and query limitations that plague legacy security analytics.
Source
Databricks Newsroom — Databricks Agrees to Acquire Panther
Security Boulevard — Databricks Acquires Panther Labs
The Next Web — Databricks Acquires Panther Labs
Commentary
Databricks buying Panther is a direct shot at Splunk, Microsoft Sentinel, and every legacy SIEM vendor. The thesis is compelling: if your security data already lives in a lakehouse, why pipe it through a separate SIEM with its own storage, its own query language, and its own limitations? Run your detections and investigations directly on the data platform where everything else already lives.
The “agentic SOC” angle is no coincidence — it’s the same pitch Cisco is making with Splunk’s WideField acquisition. The security industry is converging on the idea that AI agents, not human analysts, will handle the bulk of alert triage and investigation. The real differentiator will be data architecture: whoever provides the most seamless path from raw telemetry to AI-driven detection and response wins. For security teams evaluating their SIEM strategy, the message is clear — the next generation of security platforms will look nothing like the ones you’re running today.