Databricks Enters Cybersecurity Market with Anthropic-Powered Lakewatch SIEM

Databricks has officially entered the cybersecurity sector with the launch of Lakewatch, an agentic AI-powered Security Information and Event Management (SIEM) system. Developed in collaboration with Anthropic, the platform aims to unify security, threat intelligence, and business data within a single environment to streamline defensive operations. This move signals a shift toward data-centric security architectures, challenging established players by leveraging existing data lakes to reduce ingestion costs and vendor lock-in.

Databricks has introduced Lakewatch, a new SIEM solution designed to integrate security operations directly into its existing data management ecosystem. By utilizing agentic AI, Lakewatch allows enterprises to ingest, retain, and analyze multi-modal data without the typical costs associated with transferring information to third-party security platforms. The initiative is supported by a strategic partnership with Anthropic, whose Claude models power the system’s agentic security capabilities, enabling the deployment of defensive agents and automated workflows.

To strengthen its security portfolio, Databricks also announced the acquisitions of Antimatter and SiftD.ai. These moves reflect a broader industry trend where data management companies like ServiceNow and Elastic are expanding into the security space, operating on the premise that modern cybersecurity is fundamentally a data problem. CEO Ali Ghodsi emphasized that Lakewatch provides an open data architecture intended to replace stagnating SIEM tools that have struggled to keep pace with the volume and complexity of modern enterprise data.

The launch of Lakewatch positions Databricks as a direct competitor to major cybersecurity platforms such as CrowdStrike and Palo Alto Networks. By offering a solution where data is already in place, Databricks aims to capture market share from enterprises looking to avoid the high margins and platformization strategies of traditional vendors. This approach focuses on reducing financial friction and technical lock-in, providing a unified environment for security and business data that leverages the rise of AI agents to transform defensive operations.