- What: Databricks has launched Lakewatch, an "agentic" Security Information and Event Management (SIEM) platform.
- Key Feature: Uses AI agents to automate threat detection, triage, and response across multi-modal data.
- Strategic Shift: Built on open data formats to eliminate vendor lock-in and replace "stagnating" legacy security tools.
- Status: Available immediately in Private Preview for select customers, including Adobe and Dropbox.
Databricks officially entered the cybersecurity market today with the announcement of Lakewatch, a new open and agentic SIEM designed to defend organizations against increasingly autonomous "agent" attackers. By unifying security, IT, and business data into a single governed environment, the platform enables enterprises to automate complex defensive maneuvers that previously required manual intervention.
A New Era of Agentic Defense
The launch of Lakewatch marks a significant pivot for Databricks, moving the company beyond data engineering and into the high-stakes world of enterprise security. The platform is described as "agentic," a term referring to the use of autonomous AI agents that can not only detect threats but also perform triage and active threat hunting.
According to the official announcement, Lakewatch is built to handle the rising tide of sophisticated AI-driven attacks. By deploying defensive security agents, organizations can automate their response at a scale that traditional, human-led Security Operations Centers (SOCs) struggle to match.
"Security teams can no longer rely on stagnating SIEM tools," said Ali Ghodsi, CEO of Databricks, in a statement accompanying the launch. "With Lakewatch, we are giving enterprises a new open data architecture and agentic capabilities to replace legacy tools."
Breaking Vendor Lock-in with Open Formats
One of the primary value propositions of Lakewatch is its reliance on open data formats. Traditional SIEM providers often utilize proprietary formats that make it difficult and expensive for companies to move their own security data or integrate it with other business intelligence tools.
Databricks claims Lakewatch eliminates this "vendor lock-in," allowing customers to ingest and retain "unprecedented volumes" of multi-modal data. This unification is critical for modern security, as it allows AI models to analyze data from across the entire business—not just isolated security logs—to find subtle patterns of malicious activity.
Technical specifications regarding specific ingestion limits or supported file types beyond the mention of "multi-modal data" have not yet been disclosed. However, the company emphasized that this approach allows for "slashing costs" while maintaining complete visibility across the enterprise.
Impact on the Security Landscape
For CISOs and security developers, Lakewatch represents a shift toward "Security on the Lakehouse." By integrating security directly into the existing Databricks data environment, teams can theoretically reduce the friction between data science and security operations.
The industry impact is already being felt through early adoption by major tech leaders. Adobe and Dropbox are among the first customers to utilize Lakewatch in its private preview phase. These partnerships suggest that the platform is being positioned for high-scale, data-heavy environments where traditional SIEMs often become cost-prohibitive.
The move puts Databricks in direct competition with established security incumbents. By framing existing SIEM solutions as "stagnating," Databricks is betting that the future of security lies in autonomous AI rather than static rules-based engines.
What’s Next
Lakewatch is currently in Private Preview. While Databricks has not yet released a timeline for General Availability (GA) or a specific pricing structure, the company’s focus on "slashing costs" suggests a disruptive pricing model compared to the per-GB or per-event pricing common in the industry.
As organizations grapple with the emergence of "agentic" threats—AI-driven attacks that can adapt in real-time—the arrival of agentic defense tools like Lakewatch may become a baseline requirement for enterprise resilience. Databricks is expected to share more technical benchmarks and integration details as the platform moves toward a broader release.