Databricks Panther and Lakewatch: What Splunk Buyers Should Know

The Fast Version

Databricks agreed to acquire Panther, an AI SOC platform, on 16 June 2026, its third security acquisition after Antimatter and SiftD.ai. For a Splunk buyer, the deal signals that Databricks intends to sell a full SIEM, not just storage underneath one. The right move today is vendor-neutral groundwork: OCSF-normalized logs in your own cloud storage.

• What happened: an agreed acquisition, terms undisclosed, subject to customary closing conditions.
• Product status: Lakewatch launched in Private Preview in March 2026, with no general availability date announced.
• Renewal risk: do not sign a multi-year Splunk deal or a Lakewatch bet on the strength of a press release.
• Safe work now: normalize, store and govern security data in open formats any SIEM can read.

The announcement came at Data + AI Summit. In its press release, Databricks describes Panther as a leading AI SOC platform with 100+ out-of-the-box data integrations and detection-as-code capabilities, and says the combined product will run agentic workflows that triage alerts, gather context and propose next steps.

Three months earlier, Databricks had announced Lakewatch on 24 March 2026, an agentic SIEM that stores data in Delta Lake or Apache Iceberg in the customer’s own cloud storage. Panther was named in that launch’s list of ecosystem integrations. Now it is being folded into the product.

If you are a mid-market security or data leader with a Splunk renewal on the calendar, the question is not whether this deal is interesting. It is what you should do differently in the next 12 months, and what you should refuse to decide yet.

What Exactly Did Databricks Agree to Buy?

Panther built a cloud SIEM around detection-as-code. On its own site, Panther describes Python and SQL detection rules, an AI SOC agent for investigation and alert triage, and deployments that connect to a customer’s Snowflake or Databricks account or run as a hosted service. The site now presents Panther as part of Databricks Lakewatch, says it stays fully supported as a standalone product for existing customers, and says it will gradually transition into a unified Lakewatch offering.

The deal pattern matters more than any single feature. Databricks lists Panther as its third security acquisition. Its Lakewatch announcement described the first two: Antimatter, a team focused on authentication and authorization for AI agents, and SiftD.ai, founded by the creator of Splunk’s Search Processing Language. Read together, that is identity for agents, a search team that knows Splunk from the inside, and now a working SOC product with detection content and customers.

What the press release does not say is just as useful. It gives no price, no closing date beyond customary conditions and regulatory clearances, no Lakewatch pricing and no general availability date. Plan around what was published, not around what the keynote implied.

Why Does the Deal Matter to a Splunk Renewal?

Splunk’s commercial model has long tied cost to how much data you index or how much compute you consume. Lakewatch’s pitch is the opposite shape: land everything in cheap object storage you own, and pay to compute on it when you search or detect. Databricks claims Lakewatch can reduce costs by up to 80 percent. That is a vendor claim, not an independent benchmark, and nobody outside Databricks can test it at general availability pricing because none has been published.

The acquisition changes the credibility of the pitch rather than its math. A storage layer with good intentions is not a SIEM. A storage layer plus a detection-as-code engine, 100+ integrations and an investigation agent starts to look like one. For a renewal, that gives you a real alternative to put in front of your account team, even if you never move.

Where Do Teams Go Wrong When They Read This News?

The first mistake is treating an announcement as a roadmap. Teams hear “agentic SIEM” and “Panther” in the same breath, then sign a short Splunk extension assuming a finished Lakewatch will be waiting when it ends. Private Preview products are worth piloting. They are not worth betting a renewal on, and a product that is still integrating an acquisition will change shape more than once before it settles.

The second mistake runs the other way: signing a long renewal to avoid thinking about it. A three-year commitment made in late 2026 locks in an ingest-shaped bill through a period when every SIEM vendor is repricing. The third mistake is the one I see most, and it has nothing to do with vendors. The logs themselves are not ready. Firewall, identity, endpoint and cloud audit data sit in different formats, with different timestamps and no shared field names, so any migration plan collapses at the parsing stage. Cybersecurity is a data engineering problem first, and that problem exists whichever logo you pick.

What Can You Build Now That Survives Any Vendor Decision?

This is the evergreen part, and it is where most of the value sits regardless of how the deal closes. Four pieces of groundwork make you portable.

Normalize to OCSF. The Open Cybersecurity Schema Framework gives every source the same event classes and field names. Lakewatch is built on it, and so are several other security data platforms. Our OCSF guide walks through mapping raw sources into the silver layer of a lakehouse.

Keep the data in your storage, in an open table format. Delta Lake or Iceberg tables in your own cloud account mean the history outlives any contract. A SIEM becomes something that reads your data, not something that holds it hostage.

Write detections as code. Rules kept in version control, with tests and backtests, move between engines far more cleanly than rules trapped in a vendor UI. Panther built its product on exactly this idea, which is one reason the acquisition fits.

Govern security data like business data. Put the tables under the same catalog, access control and lineage as everything else. Security investigations increasingly need HR, finance and CRM context, and joining them is trivial when they live in one governed lakehouse.

Before you automate any of it, map the process. In Lean Six Sigma terms, measure how alerts flow today: how many arrive, how many are closed as noise, how long triage takes. An AI triage agent pointed at a broken alert pipeline just closes the wrong tickets faster.

Which Path Fits Your Situation Today?

The table below matches common mid-market situations to a decision you can make now and the decision you should defer. It is not a ranking of vendors.

Notice that every row starts with data work. That is not a sales angle. It is the part of a SIEM program that does not depend on which vendor wins this round.

How Does This Compare With Moving Off Splunk Another Way?

A lakehouse SIEM is one route out of an ingest-priced contract, not the only one. Our Splunk alternatives guide lays out cloud SIEMs, security data lakes, pipeline tools and open-source options side by side, with what each publishes about pricing. The Panther deal does not change that list so much as strengthen one entry on it.

For the Lakewatch architecture itself, including what is in preview and what you can build today without it, see our Lakewatch breakdown. Our own lake watch work for pipeline monitoring is a prototype on dummy data. Lakewatch is Databricks’ product, and we describe it as an outside observer.

What Should You Ask Before You Renew Splunk or Build on the Lakehouse?

Take these questions into the room with your account team, your security lead and your data platform owner. If nobody can answer one, that gap is your first piece of work.

• Which of our ingested gigabytes feed an active detection? If you cannot answer, you are paying to store logs nobody reads.
• Can we export our full history in an open format, and what does it cost? Exit cost is part of the contract price.
• Are our detection rules in version control with tests? If not, they are not portable, whatever the engine.
• Is the product we are evaluating generally available, and is the price published? For Lakewatch, both answers were no at the time of writing.
• Who owns log parsing and schema changes when a source updates its format? That owner decides whether any migration succeeds.
• What is the shortest renewal term we can accept? Optionality is worth paying for while the market is repricing.

If you want an independent team to do the normalization, storage and governance groundwork that keeps every option open, that is the core of our lakehouse security work.

Frequently Asked Questions (FAQs)

Did Databricks buy Panther?

Databricks announced an agreement to acquire Panther on 16 June 2026. The press release says the deal is subject to customary closing conditions, including any required regulatory clearances, and terms were not disclosed. Panther’s own site now presents the company as part of Databricks Lakewatch.

Is Databricks Lakewatch generally available?

Lakewatch launched in Private Preview on 24 March 2026, with Adobe and Dropbox named as early customers. We found no general availability announcement or published price at the time of writing. Check the Databricks newsroom before you plan around a date.

What happens to existing Panther customers?

Panther states that it remains fully supported as a standalone product for existing customers and will gradually transition into a unified Lakewatch offering. Ask for a written transition plan that covers your deployment model and where your data is stored.

Should we wait for Lakewatch before renewing Splunk?

Do not leave a renewal to chance on a preview product. Negotiate the shortest term you can, and use the time to normalize logs to OCSF in your own storage. That work pays off whichever SIEM you run next.