Databricks enters cybersecurity market with Lakewatch launch, bulking up ahead of IPO

Databricks has grown from startup into major software company, generating billions by processing data and running generative artificial intelligence models for clients.
For its next leg of growth, it's turning to cybersecurity with a new offering called Lakewatch.
Adobe and National Australia Bank are currently using it, according to a statement. Anthropic also uses Databricks for cybersecurity purposes, and its models are running inside Lakewatch. Customers can now ask about adopting Lakewatch.
CEO and cofounder Ali Ghodsi said large language models, or LLMs, "have matured to a point that you can actually automate and augment a significant portion" of cybersecurity.
The product represents a nascent alternative to security information and event management, or SIEM, services from the likes of Palo Alto Networks, Cisco-owned Splunk, Google and Microsoft.
If Lakewatch takes hold, it could help Databricks justify its $134 billion valuation to public investors ahead of a public offering. Ghodsi said in December that he wouldn't rule out a 2026 IPO.
Rather than charge based on the amount of data stored, Databricks will determine Lakewatch costs by how much work the software performs.
"The prevailing pricing model is at odds with protecting against this avalanche that's coming our way, because it's just too prohibitively expensive to get all your data in there," Ghodsi said in an interview.
The pricing scheme allows administrators to integrate data from sources other than traditional security tools — applications such as Slack or Workday, for example — to provide a more complete picture. Databricks won't charge for storage, but it will ask customers to keep data in cloud-based data lake services. From there, Lakewatch can work on it.
Investors have grown anxious about LLMs posing a threat to cybersecurity incumbents. In February, after model builder Anthropic announced a preview of a tool that checks code for vulnerabilities, the Global X Cybersecurity Exchange-Traded Fund fell about 5%.
And AI worries have been pressuring software generally. The WisdomTree Cloud Computing Fund, an exchange-traded fund filled with software-as-a-service, or SaaS, stocks, has come down about 19% so far in 2026.
"With the sort of SaaS disruption that we're seeing, Databricks will definitely partake in that disruption," Ghodsi said.
Generative AI has helped attackers more quickly exploit newly discovered vulnerabilities. Organizations need more sophisticated tools to keep up with the larger number of incoming alerts, Ghodsi said.
In 2025, Databricks bought small security startup Antimatter, whose technology is part of Lakewatch. Databricks has also agreed to acquire another called SiftD, whose three founders boast a collective 39 years of experience at Splunk.
Security practitioners value Splunk's user interface, including its technology for running searches on data, and San Francisco-based SiftD's team members "were instrumental in creating that," Reynold Xin, another Databricks co-founder, said in an interview.
Security practitioners can prioritize alerts, with generative AI models providing context on each case. Experts can also pose questions about threats to Databricks' Genie AI agent.
In time, Databricks will add features for automatically responding to security threats, Ghodsi said.
WATCH: Under the hood of the AI economy: Databricks CEO Ali Ghodsi