Splunk

Splunk was founded in 2003 by Michael Baum, Rob Das and Erik Swan around a deceptively simple idea: the logs and events that servers, applications, networks and devices generate constantly are a goldmine, if only you could search them like the web. Splunk's platform indexed that unstructured machine data and let users query it with a purpose-built Search Processing Language, surfacing patterns for troubleshooting, capacity planning and — increasingly — security. The name was a play on spelunking, the exploration of caves, because that was the experience: going into the dark, messy interior of an organization's data exhaust and finding what mattered. It spread bottom-up through IT and security teams before becoming an enterprise standard.

Security became Splunk's center of gravity. Splunk Enterprise Security, built on the core data platform, grew into one of the most widely deployed SIEMs in the world — the system analysts lived in to correlate logs, hunt threats, investigate incidents and run risk-based alerting across an entire infrastructure. For a generation of security operations centers, 'we run Splunk' was shorthand for the whole detection stack. Its flexibility was its moat: because it could ingest almost any data and let analysts write their own searches and dashboards, it embedded itself so deeply into enterprise and government workflows that ripping it out was nearly unthinkable. That stickiness is what ultimately made it worth $28 billion to a buyer.