Databricks enters cybersecurity market with Lakewatch launch, bulking up ahead of IPO

Databricks launched Lakewatch, an LLM-driven cybersecurity product that could help justify its $134 billion valuation ahead of a possible 2026 IPO. Early users include Adobe and National Australia Bank, and pricing is based on compute/work performed rather than storage, with data kept in cloud data lakes. The product incorporates tech from the 2025 Antimatter acquisition and a pending SiftD deal, positioning Databricks as a nascent alternative to SIEM incumbents (Palo Alto, Splunk, Google, Microsoft). Market sensitivity is evident: the Global X Cybersecurity ETF fell ~5% on related AI security news and the WisdomTree Cloud Computing Fund is down ~19% YTD in 2026.

Analysis

Databricks pushing an LLM-first approach to security changes the economic axis from data storage to compute/workload pricing, which should accelerate ingestion of high-cardinality telemetry into inexpensive lakes and concentrate margin flow into model execution layers. That is a structural threat to legacy SIEM economics (subscription + indexed storage) because customers can now choose to keep raw logs in cheap object stores and only pay for intermittent, high-value model runs; this compresses annuity revenue and lengthens sales cycles for incumbent vendors.

Second-order winners are firms that supply scalable GPU/CPU cycles, model orchestration, and observability primitives rather than pure-play detection products; conversely, vendors whose multiples rest on predictable per-GB indexing are most exposed. Adoption cadence will be uneven — expect pilot deployments and enterprise proofs-of-concept to drive visible churn in SIEM vendor renewal rates within 6-18 months, but measurable topline erosion is likelier on a 12-36 month horizon as SOCs validate false-positive/false-negative tradeoffs.

Key risks that could blunt this disruption: regulatory controls on sensitive-data model inference, well-capitalized incumbents bundling LLM features at low incremental cost, or operational failures where hallucinations create costly security gaps — any of which would re-anchor buyers to incumbents' proven UIs and compliance pedigrees. Monitor early customer win rates, retention on integrated lakes (not just demos), and Databricks’ ability to monetize higher-frequency model inference without reintroducing storage-linked economics.

Key Decisions for Investors

• Pair trade (12-24 months): Long ADBE equity (1-2% position) / Short PANW equity (1-2% position). Rationale: Adobe should weather a SaaS multiple reset and benefit from increased enterprise spend on AI tooling, while Palo Alto’s SIEM/existing security subscription economics face secular pressure. Target asymmetric payoff: 20-30% upside on ADBE vs 30-50% downside on PANW; pair sizes sized to be delta/vega neutral if using options.
• Directional bearish, defined risk (9-18 months): Buy PANW 1x put spread (buy 1 ATM put, sell 1 lower strike ~15-20% OTM) expiring 9-12 months. Cost-limited position; payoff if PANW cedes market share or guides down renewals. Max loss = premium; target 2.5-3x return if SIEM bookings decelerate materially.
• Cloud infra overweight (12-36 months): Buy a basket (GOOGL, MSFT) vs short CSCO. Size: net long 3-5% portfolio in cloud names funded by 2-3% shorts in legacy networking/security hardware. Thesis: underlying compute and storage consumption rises even if software vendors lose pricing power; cloud vendors can monetize model CPU and managed services. Risk: if cloud vendors aggressively bundle low-cost security capabilities, margin upside may be muted.
• Tactical monitor (0-6 months): Do not chase volatility in WDAY — instead set alerts for enterprise pilot-to-production conversion rates from early Lakewatch adopters and any regulatory guidance on model-driven security. If adoption stalls materially, reallocate short-dated bearish exposure into more defensive cash-generative security names.