Panther

Panther popularized two ideas that are now reshaping security operations — detection-as-code and the security data lake — and its pending acquisition by Databricks, announced June 16, 2026, validates the thesis at the highest level: the convergence of SIEM and the data lakehouse. Panther's architecture decouples storage from detection, ingesting logs into a scalable security data lake and letting engineering-minded SOC teams write detections in Python with version control, testing, peer review, and CI/CD — treating detections like software and solving the volume-and-cost problem that breaks legacy SIEMs at cloud scale. In 2026 Panther layered an AI SOC platform of autonomous agents on top of that data lake, extending detection-as-code into agentic investigation. For Databricks, Panther is the natural bridge into the exploding "security lakehouse" category — it brings 100-plus data integrations, detection-as-code, and agentic SOC workflows that operationalize threat detection directly on the lakehouse Databricks already sells, and it is the third security acquisition (after Antimatter and SiftD.ai) in a deliberate push to disrupt legacy SIEM. The strategic logic is powerful: security telemetry is just data, the lakehouse is where enterprises already centralize data, and running agentic detection where the data lives eliminates the costly duplication legacy SIEMs impose. Backed originally by Coatue's $120M Series B unicorn round, Panther exits into a distribution engine that could scale detection-as-code far beyond what it reached alone.