Databricks is entering the cybersecurity market with Anthropic assist

Databricks launched Lakewatch, an agentic AI-powered SIEM in private preview, and concurrently raised $7.0 billion to build out Lakebase and Genie. The push is bolstered by Anthropic partnership (Claude models) and acquisitions of Antimatter and SiftD.ai, positioning Databricks to offer multi-modal ingestion, serverless performance, log storage without licensing fees, detection-as-code and automated defensive agents. The initiative aims to displace legacy SIEMs, capture margin, and compete with security incumbents (CrowdStrike, Palo Alto), creating meaningful competitive pressure in the cybersecurity platform market.

Analysis

A data-platform incumbent pushing down the stack into security creates asymmetric pressure: companies that control telemetry and storage can undercut per-ingest economics and capture higher-margin orchestration services. Expect a 20–40% effective TCO hit for legacy SIEM/ingestion business models over 12–36 months as customers re-evaluate recurring license and egress fees and favor architectures that minimize cross-vendor telemetry duplication.

Second-order winners are orchestration and process vendors that become the glue for mixed security estates — firms that sell SOAR/process workflows or catalog/governance layers can increase wallet share even as detection/EDR margins compress. Incumbent gatekeepers of identity and network stacks (Okta/Zscaler/Palo Alto-style adjacencies) can either monetize telemetry flows via preferred integrations or be forced into reseller/partner economics; vendors who can sell embedded prevention or high-value incident response services will see lower elasticity of demand.

Key risks and catalysts: near-term noise (wins, previews, partner logos) can move sentiment in days, but durable revenue share shifts need 12–36 months of enterprise pilots, procurement cycles, and SIEM-to-data-platform migrations. Reversal can come from two places — (1) poor execution on multi-tenant security primitives (false positives, model hallucinations, compliance hurdles) that slow adoption, or (2) coordinated incumbent counteroffers (bundle pricing or exclusive OEMs) that restore legacy economics within 6–18 months.

Key Decisions for Investors

• Pair trade (6–12 months): Short CRWD 1.0x notional / Long ESTC 1.0x notional. Thesis: CrowdStrike bears higher share loss risk vs Elastic which can monetize search/logging on-platform; target CRWD -25% / ESTC +20%, stop-loss if CRWD +15%.
• Long NOW (12–24 months): buy JAN-2027 calls or 50–75% notional equity exposure. Thesis: ServiceNow-style orchestration benefits from mixed-platform estates and can expand ASPs on workflow automation; reward skew ~2:1 vs execution risk of ~15% downside on macro churn.
• Hedge/alpha short (6–12 months): small position in PANW puts (size 25–50% of a single equity position). Thesis: Palo Alto faces margin pressure if telemetry is absorbed into platform stacks; downside 15–25% if price competition accelerates, but limited by enterprise preference for network prevention — keep position size defensive.