Scanner Raises Series A Led by Sequoia Capital

AI agents are reshaping how security teams investigate threats, and they need a radically different kind of data layer to do it. We've built it, and security teams at Notion, Ramp, and BeyondTrust are already using it to investigate threats across years of log data. Today we're announcing our $22 million Series A, led by Sequoia, with participation from CRV and Mantis VC, to bring this capability to every security team.

The problem

Without Scanner, security teams are stuck between a rock and a hard place. They can pay exorbitant SIEM ingestion costs for data that's searchable but limited to 30 days of retention, or put their data in cost-effective object storage where searching it takes hours, or days. WAF logs, EDR logs, and dozens of other high-volume sources typically end up in object storage by default. Teams are flying blind over most of their data.

We know because we lived this firsthand. We spent years building large-scale data infrastructure together at our previous startup Accompany, and later at Cisco after it was acquired. The vast majority of our logging data went to object storage because it was the only economically feasible place to keep it long term, and the tools available to search it were painfully slow. Scanner is what we wished we had: the cost advantages of object storage with the search speed of a SIEM.

Our approach

Scanner is built around a new kind of index designed from the ground up for object storage. When you run a query, Scanner scales up to find results rapidly, and scales to zero when it's done. You're not paying for idle infrastructure. You're paying for answers.

This lets security teams rapidly threat-hunt across years of logs and dozens of log sources. When a new threat intelligence report drops, our customers don't check the last 30 days. They look back six, twelve, twenty-four months and get results in seconds. That can mean the difference between catching attackers while they're still trying to get in and discovering them too late after data has been exfiltrated.

We're most proud of the security teams that have trusted us to be a critical part of their stack. Notion, Ramp, BeyondTrust, Lemonade, Benchling, Postman, EliseAI, and many others rely on Scanner to see across data they previously had no way to search. Helping these teams uncover threats that would have gone undetected in a traditional SIEM is why we built this company.

"Scanner gave us months of searchable history instead of two weeks. When new threats emerge, we build detections and search years of logs for IOCs very rapidly. Both are game-changers for security at scale."

Brandon Ledyard, Detection Engineer, Ramp

Agents

And over the last 12 weeks, something remarkable happened: AI agents became by far the most prolific users of Scanner. Security teams are deploying agents that continuously query Scanner, hunting for threats, triaging alerts, and investigating incidents across massive volumes of log data. With Scanner, agents can perform far more thorough and rigorous correlation and context gathering across huge numbers of data sources that were previously inaccessible. Agentic threat hunting would not be possible without a performant security data lake like Scanner.

Notion recently wrote about Scruff, their security AI agent, which uses Scanner as a core data source alongside tools like Wiz and CrowdStrike. Scruff gathers context across logs, user activity, and system events through Scanner, correlates findings, and delivers preliminary analysis to human analysts. The result: an 84% reduction in investigation time and a 30% increase in job satisfaction.

Our investors

We're grateful to Sequoia, CRV, Mantis VC, and an incredible group of angel investors for backing this vision. Our angels include CISOs from Fortune 500s and fast growing scale-ups, the former GM of Splunk Security, and leaders from Splunk's detection research team. They include Christina Cacioppo (founder and CEO of Vanta), Tom Killalea (chairman of the board of MongoDB and Amazon's first CISO), and Venkat Venkataramani (founder of Rockset, acquired by OpenAI, and current head of OpenAI infrastructure). These are people who have lived with the cybersecurity and data infrastructure problems that Scanner solves, and we're excited to have them behind us.

"Security teams generate massive amounts of data but can only afford to search a fraction of it. Scanner has built a fundamentally new approach to this problem, which enables companies to move into the agentic era of cybersecurity. AI is notoriously data hungry, and Scanner is the only technology on the market today that manages security data at AI scale."

Bogomil Balkansky, Partner, Sequoia Capital

The future of security operations is humans and agents working together over all of their data, not just the fraction that fits in a SIEM. We're building the platform that makes that possible, and we're just getting started.

If you want to see Scanner in action, visit scanner.dev to learn more or request a demo. And we're hiring. If our mission resonates with you, we'd love to talk.