Databricks to buy Panther as AI-driven cyber threats reshape security lakehouse race

Databricks has agreed to acquire Panther, a cloud-native AI security operations platform, as the privately held data and artificial intelligence company pushes deeper into cybersecurity. The proposed acquisition strengthens Databricks’ security lakehouse strategy and follows its earlier security acquisitions of Antimatter and SiftD.ai. The deal is strategically important because Databricks is trying to challenge legacy security information and event management platforms at a time when AI-driven attacks are increasing the volume, speed and complexity of enterprise threats. Although Databricks is privately held, the move has implications for publicly traded cybersecurity players such as CrowdStrike Holdings, Inc. (NASDAQ: CRWD) and Cisco Systems, Inc. (NASDAQ: CSCO), whose Splunk business sits directly in the security data and analytics market Databricks is now targeting.

Why does Databricks’ Panther acquisition matter for the future of security operations?

Databricks’ Panther acquisition matters because the security operations centre is becoming a data problem as much as a threat-detection problem. Enterprises are now collecting security signals from cloud infrastructure, identity systems, endpoints, SaaS applications, developer environments, networks and business systems. The issue is not only whether that data exists. The real problem is whether security teams can ingest it, normalise it, analyse it and act on it fast enough before attackers move.

Panther gives Databricks a more specialised security operations layer inside its broader data and AI platform. Panther’s value lies in consolidating security data and enabling detection, investigation and response workflows that are designed for modern cloud environments. That fits neatly with Databricks’ security lakehouse thesis, which argues that security teams should not be trapped inside costly, closed and fragmented SIEM systems when the rest of the enterprise is already moving toward unified data platforms.

The timing is also important because artificial intelligence is changing both sides of cybersecurity. Attackers can use AI to discover vulnerabilities, automate reconnaissance, generate phishing content, test exploit paths and scale attacks faster. Defenders therefore need automation that can triage alerts, gather context and recommend action at similar speed. Databricks is effectively betting that the next generation of cyber defence will be built around data gravity and AI agents, not just dashboards and alert queues.

How does Panther strengthen Databricks’ security lakehouse strategy after Lakewatch?

Panther strengthens Databricks’ Lakewatch strategy by adding a product and team already focused on AI-assisted security operations. Databricks introduced Lakewatch earlier in 2026 as an agentic SIEM designed to unify security, IT and business data inside a governed lakehouse. Panther adds mature security operations capabilities, cloud-native detection expertise and more than 100 pre-built integrations across infrastructure, identity, endpoints, networks and SaaS applications.

This is not a random adjacency for Databricks. The company has spent years building its identity around enterprise data intelligence, analytics, machine learning and AI applications. Cybersecurity is one of the most obvious extensions of that platform because threat detection depends on large-scale data ingestion, fast querying, governance, contextual reasoning and automation. If Databricks can make security data usable inside the same architecture enterprises already use for analytics and AI, it can argue that the security stack should converge with the enterprise data stack.

The risk is that security buyers are not ordinary data buyers. Chief information security officers care about speed, resilience, compliance, integrations, incident response and trust under pressure. A product that sounds elegant in a data architecture presentation still has to perform during a live breach. Databricks must prove that Lakewatch plus Panther can reduce alert fatigue and improve response quality without forcing security teams into a platform migration that feels like open-heart surgery during a fire drill.

Why is Databricks targeting legacy SIEM as AI reshapes enterprise cyber defence?

Legacy SIEM systems are under pressure because many enterprises are paying high costs to store and analyse only a fraction of their security data. As cloud environments grow, data volumes expand and threat patterns become more complex, older systems can become expensive, slow and heavily manual. Detection engineers still write rules, analysts still investigate alerts by hand, and security teams still struggle to connect technical signals with business context.

Databricks is entering the market with a different argument. Instead of treating SIEM as a standalone security database, it wants security data to live inside a broader lakehouse where AI agents can analyse signals, correlate context and automate parts of the response workflow. That proposition could be compelling for organisations already using Databricks for enterprise data, analytics and AI applications, because it reduces the need to move security data into yet another silo.

However, replacing or reshaping SIEM is not easy. Security operations platforms are sticky because they connect to incident-response workflows, compliance reporting, detection libraries, managed security providers and audit processes. Databricks will need to show that its approach lowers total cost of ownership, improves detection coverage and integrates with existing tools. The market is interested in SIEM disruption, but security teams do not casually rip out systems that wake them up at 2 a.m. for a very good reason.

How could the Panther deal affect CrowdStrike, Cisco’s Splunk and other cybersecurity incumbents?

The Panther deal increases competitive pressure on cybersecurity incumbents because Databricks is entering from the data platform side rather than from the traditional security vendor side. CrowdStrike remains a powerful endpoint, cloud and threat intelligence platform, while Cisco’s Splunk remains deeply embedded in enterprise security analytics and observability. Those businesses are not suddenly displaced by one private-market acquisition. However, Databricks is signalling that the security operations market is open for reinvention.

For CrowdStrike, the competitive question is whether its Falcon platform can remain the central operating layer for security teams as more enterprises ask for unified security data and AI-assisted workflows. CrowdStrike’s current market value of roughly $175 billion shows that investors already view the company as a major beneficiary of cybersecurity demand. That valuation also creates pressure to keep expanding beyond endpoint security into broader data, cloud and identity coverage.

For Cisco, Splunk’s role becomes more strategically important. Cisco paid heavily to gain a stronger position in security analytics, observability and data-driven operations. Databricks’ Panther deal attacks the same broad theme from a more AI-native and lakehouse-centred direction. Cisco has distribution, customer relationships and infrastructure reach. Databricks has data-platform momentum and a rapidly expanding AI story. The result is not a simple winner-take-all battle, but the lines between data platforms and security platforms are becoming less clean.

Why does this acquisition matter for Databricks’ valuation and future IPO narrative?

Databricks is valued at about $134 billion, making it one of the world’s most valuable privately held technology companies. That kind of valuation requires more than a strong data platform story. It requires investors to believe that Databricks can expand into adjacent markets where data, governance and AI workflows create large revenue pools. Cybersecurity is exactly such a market.

The Panther deal helps Databricks tell a broader IPO story whenever it eventually enters public markets. Instead of being seen only as a lakehouse company competing with Snowflake and cloud data warehouse providers, Databricks can position itself as an enterprise AI platform that spans analytics, applications, agents, governance and security. That broader narrative could support premium valuation if the company can show security revenue traction.

The challenge is execution discipline. Acquisitions can strengthen product breadth, but they can also create integration drag. Databricks has now made multiple security acquisitions in a short window, including Panther, Antimatter and SiftD.ai. Investors will eventually ask whether these assets produce a coherent product and revenue line or merely a collection of clever security pieces. A strong private-market valuation buys strategic patience, but public markets are less romantic. They usually ask for revenue, margin and proof before applauding too loudly.

What does Panther bring to Databricks beyond technology and integrations?

Panther brings Databricks security credibility, product focus and practitioner experience. The company has roots in detection-as-code, cloud-native security operations and security data lakes. That matters because cybersecurity products need more than generic AI capability. They need workflows that match how analysts, detection engineers, incident responders and compliance teams actually work.

Panther also gives Databricks a stronger bridge into the security buyer community. Databricks already has relationships with data, analytics and AI leaders, but cybersecurity purchasing involves different stakeholders and different trust thresholds. Panther’s customer base, security-focused engineering team and established product identity can help Databricks avoid looking like a data company trying to casually wander into cyber because AI made the market fashionable.

The cultural integration will be important. Panther’s value depends partly on its speed, domain expertise and security-native thinking. Databricks needs to absorb that capability without diluting it inside a much larger platform organisation. If Panther becomes a focused accelerator for Lakewatch, the deal can strengthen Databricks’ position. If Panther gets buried under platform complexity, the acquisition could lose some of the agility that made it attractive.

How does the deal reflect the broader shift toward agentic cybersecurity?

The deal reflects a broader shift from human-led security workflows toward agentic cybersecurity, where AI systems assist with alert triage, investigation, context gathering and response recommendations. This does not mean human analysts disappear. It means analysts are increasingly expected to supervise automated workflows rather than manually chase every alert from scratch.

That shift is necessary because the economics of security operations are becoming unsustainable. Threat volumes are rising, cloud environments are more dynamic, developer activity is continuous and attackers are using automation. Human teams cannot scale linearly with every new log source, cloud workload or SaaS application. AI agents offer a way to compress investigation time and reduce repetitive work, provided outputs are reliable and auditable.

The risk is overconfidence. Agentic security systems must be carefully governed because false positives, false negatives or poorly executed automated actions can create operational damage. Security teams will need controls over what agents can do, what they can recommend, when humans must approve actions, and how decisions are logged. Databricks’ broader governance story could help here, but the company will have to prove that agentic security can be both fast and controlled.

What could go wrong as Databricks tries to turn security into a major platform business?

The first risk is that security operations buyers may resist platform consolidation if they fear vendor lock-in or migration complexity. Many enterprises already use a mix of SIEM, endpoint detection, cloud security, identity security, threat intelligence, ticketing and managed services tools. Databricks will need to integrate into that reality rather than assume customers will rebuild everything around the lakehouse.

The second risk is competitive response. CrowdStrike, Cisco, Microsoft, Palo Alto Networks, SentinelOne and other vendors are not standing still. Microsoft can bundle security into its cloud, identity and productivity estate. Cisco can combine Splunk with networking and security assets. CrowdStrike has strong threat intelligence and endpoint reach. Databricks must therefore prove that its data-centric approach is not just elegant, but materially better in outcomes.

The third risk is regulatory and operational trust. Cybersecurity platforms hold sensitive logs, identity data, infrastructure details and incident histories. Customers will demand strong controls over data residency, access, retention and model behaviour. AI agents operating on security data also raise questions about explainability and accountability. Databricks can win if it makes security operations smarter. It can stumble if customers feel the platform creates a new control problem while trying to solve an old one.

What happens next if Databricks succeeds in building an AI security lakehouse category?

If Databricks succeeds, the Panther acquisition could become a meaningful step toward creating a new category that sits between SIEM, security data lake, AI SOC and enterprise data platform. That would give Databricks a route into cybersecurity budgets, which are often more resilient than discretionary software spending because boards and regulators keep increasing expectations around breach prevention and response.

The next proof points will be customer adoption, Lakewatch availability, integration depth, migration economics and how quickly Panther’s workflows become part of the Databricks platform. Databricks must show that customers can ingest more security data at lower cost, detect threats faster and automate investigations without sacrificing governance. That is the difference between a category claim and a working product.

The broader industry signal is clear. Cybersecurity is becoming a core arena for enterprise AI competition, not a side market. Data platforms want to become security platforms. Security platforms want to become data platforms. Cloud providers want to sit underneath both. Databricks has made its move. Now CrowdStrike, Cisco and the rest of the market have to decide whether the lakehouse is a threat, a partner channel or the next battlefield.

Key takeaways on what Databricks’ Panther acquisition means for cybersecurity, AI agents and enterprise data platforms

• Databricks’ agreement to acquire Panther strengthens its push into cybersecurity and supports its ambition to build a security lakehouse category.
• The acquisition gives Databricks a more security-native product layer for AI-assisted detection, investigation and response workflows.
• Panther adds practitioner credibility, cloud-native security operations expertise and integrations that can accelerate Databricks’ Lakewatch strategy.
• The deal shows that AI-driven cyber threats are forcing enterprises to rethink legacy SIEM tools that rely heavily on manual workflows and costly data storage.
• CrowdStrike and Cisco’s Splunk remain formidable incumbents, but Databricks is attacking the market from the enterprise data and AI platform side.
• Databricks’ $134 billion private-market valuation makes cybersecurity expansion strategically important for any future IPO narrative.
• The main execution risk is integration, because Databricks must turn Panther, Antimatter and SiftD.ai into one coherent security platform rather than a bundle of acquisitions.
• Agentic cybersecurity can reduce alert fatigue and accelerate response, but it requires strong governance, auditability and human oversight.
• Security buyers will expect Databricks to integrate with existing tools rather than force disruptive migrations from established security operations workflows.
• The broader market signal is that enterprise AI platforms and cybersecurity platforms are converging as attackers and defenders both adopt automation.