Databricks Announces Lakewatch: New Open, Agentic SIEM

Databricks launched Lakewatch, an open, agentic SIEM, in Private Preview and announced acquisitions of Antimatter and SiftD.ai; early customers include Adobe and Dropbox. Built on the lakehouse/Unity Catalog and leveraging Anthropic’s Claude, Lakewatch promises ingestion and retention of petabytes of multimodal telemetry with decoupled storage/compute, AI-driven agents, and plain-English threat hunting to cut costs and eliminate vendor lock-in. The company cites ZeroDayClock data showing mean time to exploit collapsing from 23.2 days (2025) to 1.6 days (2026) to justify the need for machine-speed defenses; this is likely positive for Databricks and ecosystem partners but not a market-wide shock.

Analysis

The launch shifts the battleground from standalone detection appliances to data-platform economics: vendors owning catalog, cheap cloud storage and serverless compute gain leverage while per-GB SIEM licensing economics compress. Expect enterprise procurement to favor architectures that eliminate duplicate ingest and support multimodal telemetry; that dynamic can cut legacy SIEM gross margins and recurring license uplift by a material percentage over a 12–36 month window, not instantly.

A crucial second-order effect is on services and integrators: boil-down automation (rule authoring, ingestion normalization) will reduce high-margin detection-engineering spend but increase one-time platform integration and professional services from partners. This reallocates TAM from recurring software seats to implementation and cross-cloud storage costs — beneficial to firms that sell orchestration, identity and edge telemetry (which become strategic control points).

Near-term execution and risk hinge on pilots and governance. Adoption will be cadence-driven: expect PR-driven pilot wins in 0–9 months and revenue recognition >12 months. Key tail risks are regulatory/data residency objections and AI operational risks (model drift, false-positive cascades) which can flip initial efficiency gains into multi-week SOC disruptions if not tightly instrumented; therefore monitor pilot MTTR and false-positive metrics closely as early indicators of durable adoption.

Key Decisions for Investors

• Long ZS (Zscaler) — 12 month horizon: buy shares or buy-call LEAP (12–18 month) to capture ecosystem lead integrating telemetry controls. Target +30% if Lakewatch/partners drive measurable channel bookings; downside -20% if enterprise pilots stall or customers standardize on alternative stacks. Position size: tactical overweight (3–5% portfolio), cut half on first quarter of GA customer logos.
• Pair trade: Long OKTA / Short PANW — 6–12 months: OKTA (identity as policy plane) benefits from platform consolidation while PANW faces margin pressure defending incumbent detection/endpoint upsell. Target asymmetric return of +25% on OKTA vs -15% on PANW; use 6–9 month options (buy OKTA calls, buy PANW puts) to limit capital, cap loss to premium paid.
• Opportunistic long AKAM — 9–18 months: edge/CDN vendors that handle multimodal ingestion and normalization stand to capture higher throughput and managed-data fees. Small position (1–2% portfolio) awaiting concrete partner integration announcements and evidence of increased telemetry throughput; expect +20% if adoption picks up, -15% if routed to hyperscaler-native services.
• Risk management: size new positions to account for a 12–18 month adoption ramp and hedge with cash or short-dated index puts. Trigger to reduce exposure: failing pilot KPIs (no published MTTR or false-positive improvements within 9 months) or regulatory actions restricting cross-domain telemetry pooling.