SentinelOne Buys Observo AI for $225M to Fuel Data Ingestion

SentinelOne plans to purchase a data pipeline startup founded by a former Rubrik engineering leader to help customers decouple data ingestion from SIEM platforms.

See Also: OnDemand Webinar | Trends, Threats and Expert Takeaways: 2025 Global IR Report Insights

The Silicon Valley-based endpoint security titan said its proposed acquisition of fellow Silicon Valley firm Observo AI will unlock real-time enrichment and detection capabilities and continue SentinelOne’s push beyond endpoint security into broader security operations and AI-driven infrastructure, said Chief Business Officer Eran Ashkenazi. The $225 million acquisition is expected to close by the end of October.

“There’s a market leader that’s done pretty well, but it’s based on pretty archaic modus operandi, from the UX to setting up connectors to the ease of integration,” Ashkenazi told Information Security Media Group. “And then there’s a bunch of new players. What we felt is like Observo was the one that really hit the bull’s eye.”

Observo AI, founded in 2022, employs 42 people and closed a $15 million seed funding round in January led by Felicis and Lightspeed Venture Partners. The company has been led since its inception by Gurjeet Arora, who spent five years at Rubrik building out the company’s data platform, virtual platform and observability features. SentinelOne’s stock is down $0.21 – or $1.12 – to $18.52 per share Monday (see: Weingarten on What Makes SentinelOne’s Defense Different).

What Made Observo AI’s Data Pipeline Technology Stand Out

SentinelOne examined up to 10 vendors in the data pipeline space, with some immediately ruled out because of outdated architectures or lack of relevant features, while others looked good on paper but fell short in hands-on testing. Observo stood out from the competition due to its support of open standards, flexible deployment models and advanced real-time detection capabilities.

“What kind of ingestion standards does the solution support?” Ashkenazi said. “Does it support the open standards like JSON or CSF, things that make it easier for customers?” “What is the actual efficiency of their models when it comes to deduplication and filtration? What are their abilities to potentially do detection on anomaly graph-level detections in the pipe itself in real-time?”

Ingesting vast quantities of security data into platforms like SIEMs or AI-based security systems remains a deeply painful process, especially if that data comes from numerous sources, in varied formats, across complex infrastructures. Ashkenazi said Observo’s data pipeline allows clients to ingest data once and route it anywhere from SentinelOne’s SIEM to a rival SIEM like CrowdStrike to a legacy SIEM like Splunk.

“How can we make ingestion for our customers a lot easier?” he said. “We have all these prospects and customers out there that want to migrate to a next-generation SIEM, to an AI SIEM and they’re stuck. They’re stuck with the ingestion piece. They’re stuck with the data pipeline. If we can provide them a way to actually route things through one system, then they have the freedom to choose.”

Putting Observo’s AI-powered data pipeline layer between data sources and analytics platforms offers enterprises the ability to decouple the ingestion layer from the analytics and correlation layer, Ashkenazi said. The pipeline enables cost-efficient data processing by reducing noise and volume, Ashkenazi said helping security teams ingest more relevant data without being bound by expensive licensing models.

“You’re no longer hostages of your existing SIEM,” Ashkenazi said. “You have options. The way to do that is to get into an AI-driven data pipeline and think about your steps down the road. You don’t have to basically make the whole decision today. You can put something in that can help you save money and decouple the decision, and then you’re open to do whatever you want.”

What the Deals Means for Customers Using SIEM Competitors

Legacy SIEMs are expensive, slow and built on outdated architectures that doesn’t support real-time responsiveness or cost-effective scaling. Observo fuels inline data treatment, with filtration, enrichment and even detection happening as data is ingested rather than hours or days later. This pipeline-centric approach reduces cost, increases speed and allows organizations to make security decisions in real-time.

“We’re trying to take everything from a model where we would look at stuff and make detections based on correlation of things that happened yesterday,” Ashkenazi said. “We’re trying to move to an area where we’re doing things closer and closer to reality, and the most real-time is actually if you can deal with things on the pipeline itself.”

Observo will not only serve existing SentinelOne AI SIEM customers, but continue to operate as a standalone product supporting customers using third-party platforms like Splunk, Google SecOps, or QRadar, Ashkenazi said. He said future integrations will likely include deeper enrichment options, native SIEM enhancements and real-time detection capabilities at the ingestion layer.

“You’re using Google SecOps or Splunk or whatever? You can still use Observo,” Ashkenazi said. “We’re going to continue to invest in that business. That’s an important part of it. And then separately, there are some additional capabilities that are going to benefit AI SIEM customers as well.”

The Observo AI deal comes just a month after SentinelOne agreed to spend $180 million to buy Prompt Security, which helps organizations manage and monitor how employees use generative AI tools like ChatGPT or internal LLMs. Going forward, he said Prompt’s data classification or DLP capabilities could potentially be applied within Observo’s pipeline to enforce policies before data even hits the SIEM.

“We’re in an era where there’s not less data – there’s more data,” Ashkenazi said. “In fact, there’s too much data. Sometimes you don’t know what to do with all that data. How can we make it easier for customers to distill the data that they’re bringing to make sure that they’re not bound by cost to bring the additional data that they need?”