Databricks announced Lakewatch this week, an open, agentic security information and event management platform built on its data lakehouse. Adobe, Dropbox, and National Australia Bank are among the early customers. Two acquisitions accompanied the launch: Antimatter, focused on authentication and authorization for AI agents, and SiftD.ai, founded by the creator of Splunk's search processing language.

The Pricing Problem Databricks Is Solving

Legacy security information and event management tools charge for storage and compute together. That creates a financial penalty on every byte ingested, so security teams filter logs, delete history, and skip non-traditional data sources entirely.

Databricks decouples the two. Storage stays in the organization's own cloud. Charges are based on work performed, not data volume stored. The company claims up to 80% lower total cost of ownership compared to incumbent platforms.

Why Speed Is the Real Argument

The average time from vulnerability disclosure to active exploitation reportedly fell from 23 days in 2025 to 1.6 days in 2026. Security teams that depend on manual triage and hand-authored detection rules are structurally too slow for that pace.

Lakewatch runs AI agents directly inside the governed environment where data already lives, rather than routing it to a separate tool. The Anthropic partnership is relevant here: Claude models power the reasoning layer, and Anthropic itself runs Databricks as its own security platform. That is a reference architecture claim, not a co-marketing announcement.

Strategy or Pivot?

This is an extension of the existing platform, not a change in direction. Lakewatch runs on Unity Catalog, Genie, Delta Lake, and Apache Iceberg, all capabilities Databricks already sells. The SiftD.ai acquisition adds Splunk alumni with enterprise security operations depth. Antimatter addresses agent-to-agent trust, an unresolved problem in agentic architectures.

The IPO context matters. Databricks raised at a $134 billion valuation in February 2026, with annualized revenue above $5.4 billion growing at 65% year over year. Entering a large market with known pricing model failures gives the company a credible new growth story for public investors.

The Open Source Question

Databricks frames Lakewatch around open formats, specifically the Open Cybersecurity Schema Framework, Delta Lake, and Apache Iceberg. The pitch is that customers own their data and avoid vendor lock-in. That argument is worth scrutinizing. The underlying lakehouse infrastructure is Databricks infrastructure. Data portability in open formats does not mean the operational tooling, agent workflows, or detection-as-code pipelines are easily portable to another platform. Open formats and open architectures are different things.