Databricks Displacing Legacy SIEM Vendors

This is a classic bundle move where Databricks turns a cost center it already hosts into a new software line with very little extra delivery cost. Security teams already generate the same raw logs, alerts, and access events that Databricks stores for analytics, so Lakewatch can sit on top of data pipelines customers already pay for, then sell higher value detection and investigation workflows that previously went to Splunk or Microsoft Sentinel.1 2 3 4 5

• Legacy SIEMs are vulnerable because pricing has long been tied to how much data gets ingested. Splunk still supports GB per day ingest pricing, and Microsoft Sentinel bills by GB analyzed or ingested. That gives Databricks a wedge, because customers can keep more raw security data in one lakehouse and avoid paying a separate vendor to copy, index, and retain it again.4 5 6
• The margin profile is attractive because the hardest part, the data platform, is already in place. Databricks built Lakewatch by adding threat detection from SiftD.ai and governed data controls from Antimatter onto its existing lakehouse, which means expansion revenue rides on top of infrastructure and account relationships that were already paid for by the core platform.1 2 3
• There is precedent for this kind of expansion. Cribl grew by helping big Splunk customers cut SIEM bills 30% to 90%, showing how much buyer frustration exists around legacy log economics. Databricks is pushing further than Cribl, from routing and storing the data to running the security analyst workflow itself inside the same environment.6 7

If Lakewatch lands, Databricks becomes harder to dislodge because security data is among the stickiest data in the enterprise. The next step is not just replacing a SIEM line item, but making the lakehouse the place where security, IT, and business events are investigated together, which opens another large expansion path beyond warehousing and AI.1 7