Databricks Enters Security Market with Launch of Lakewatch: New Open, Agentic SIEM

USA - English

• India - English

New product enables unlimited and unified data, petabyte-scale threat detection and investigations at up to 80% lower TCO

SAN FRANCISCO, March 24, 2026 /PRNewswire/ -- Databricks, the Data and AI company, today announced Lakewatch, a new open, agentic SIEM (Security Information and Event Management) designed to help organizations defend against increasingly sophisticated agent attackers. Lakewatch unifies security, IT, and business data into a single, governed environment for AI detection and response. With open formats and an open ecosystem, Lakewatch enables customers to ingest, retain and analyze unprecedented volumes of multi-modal data, while slashing costs and eliminating vendor lock-in. Security teams gain complete visibility across the enterprise and can deploy defensive security agents to automate threat detection and response at massive scale. Lakewatch is now available in Private Preview.

Defending at Machine Speed
AI threats are evolving at a speed and complexity that goes beyond human-led defenses. Attackers can now deploy agents to continuously scan systems, discover vulnerabilities, and execute coordinated attacks at machine speed. Defenders remain constrained by incomplete data, manual workflows, and siloed architectures. High ingestion costs force them to discard up to 75% of their data. This creates a dangerous asymmetry: attackers use AI agents to attack anywhere, while defenders see only a fraction of their own data and are limited by how fast their teams can react.

Lakewatch closes this gap by enabling organizations to unify all their data in open formats so they can analyze years of data cost-effectively without moving or duplicating it. This includes multi-modal data like video and audio to identify social engineering, insider threats, and anomaly detection. With Lakewatch, swarms of AI agents automate detection, triage, and threat hunting to meet machine-speed attackers with machine-speed defense.

"Security teams can no longer rely on manual workflows to outpace AI-driven attacks," said Ali Ghodsi, Co-Founder and CEO of Databricks. "With Lakewatch, we are giving enterprises a new open data architecture and agentic capabilities to replace stagnating SIEM tools. Defenders must have even better visibility and speed than today's agent attackers."

Open, Agentic SIEM for Enterprise Speed and Scale
Lakewatch is designed to deliver agentic security atop the scale of an open security lakehouse. Key features include:

• Agentic Triage and Investigation: Build, optimize, and deploy custom security agents with Agent Bricks to handle complex workflows end-to-end. Agents parse and enrich telemetry across hundreds of formats to reduce Mean Time to Detect & Respond (MTTD/R), while remaining inside the secure, governed environment where data already lives.
• Automated Security Intelligence: Integrated with Genie, Lakewatch automates triage, plans multi-step approaches, and helps enterprises reduce alert fatigue, leaving more time for analysts to focus on high-impact threats.
• Open Ecosystem: Unify all structured and unstructured security data on one open, cloud-agnostic platform that integrates with any tool to identify social engineering, insider threats, and anomaly detection. Databricks' new Open Security Lakehouse Ecosystem is a fast-growing group of leading security vendors and delivery partners, including Anvilogic, Arctic Wolf, Cribl, Obsidian, Okta, Palo Alto Networks, 1Password, Panther, Proofpoint, Rearc, Slack, TrendAI, Wiz (now part of Google Cloud), and Zscaler.
• Detection-as-Code: Manage detections as code with automated testing and deployment to ensure defense is always version-controlled and verified.
• Governance and Compliance at Scale: Enable compliance and consistent policy enforcement with Unity Catalog. Access cost-effective, long-term retention out of the box, helping global enterprises meet rigorous new mandates such as NIS2 and DORA.

Enterprise organizations use Lakewatch to unify their data and detect threats faster with AI. Lakewatch customers include industry leaders like Adobe and Dropbox.

"As the volume of security data grows, organizations need new ways to analyze and act on that information quickly and at scale," said Karthik Venkatesan, Security Engineering Lead at Adobe. "Databricks provides the foundation needed to move from data-driven to AI-driven approaches for security operations, and Lakewatch is an important step toward bringing security intelligence closer to where data already lives."

Deepening Partnership with Anthropic
Building on the success of the two companies' existing strategic partnership, Databricks and Anthropic are deepening their collaboration to deliver agentic security operations. Anthropic Claude models help power Lakewatch, using Claude's advanced reasoning capabilities to correlate signals across security, IT, and business data to surface threats faster. Anthropic also uses Databricks for its own security lakehouse to gain complete visibility across its security and business data and detect threats earlier.

Expanding Security Leadership with Antimatter and SiftD.ai Acquisitions
To advance its open, agentic SIEM approach, Databricks is announcing the acquisitions of both Antimatter and SiftD.ai. Antimatter was founded by UC Berkeley security researchers who laid the foundation for provably secure authentication and authorization for AI agents. SiftD.ai, founded by the creator of Splunk's Search Processing Language (SPL) and lead architects of Splunk's search stack, will bring deep expertise in large-scale detection engineering and modern threat analytics.

Availability
Lakewatch is now available in Private Preview. Read more about Lakewatch on the Databricks blog.

About Databricks

Databricks is the Data and AI company. More than 20,000 organizations worldwide — including adidas, AT&T, Bayer, Block, Mastercard, Rivian, Unilever, and over 60% of the Fortune 500 — rely on Databricks to build and scale data and AI apps, analytics and agents. Headquartered in San Francisco with 30+ offices around the globe, Databricks offers a unified platform that includes Lakebase, Genie, Agent Bricks, Lakeflow, Lakehouse, and Unity Catalog. To learn more, follow Databricks on LinkedIn, X, YouTube, and Instagram.

Contact: [email protected]

SOURCE Databricks