Databricks, the data and artificial intelligence company, is significantly expanding its security offerings with the launch of Lakewatch, a new security information and event management (SIEM) service. This move comes alongside the acquisition of two cybersecurity startups, Antimatter and SiftD, signaling a major investment in protecting the increasingly valuable data processed and analyzed on its platform. The company, which has grown rapidly by providing tools for managing and leveraging large datasets, is now aiming to become a key player in the data security space, a critical concern as organizations increasingly rely on AI and cloud-based data solutions.
The rise of generative AI has amplified existing data security challenges, and created new ones. Organizations are grappling with protecting not only their data *at rest* and *in transit*, but also during the AI processing phase. Databricks’ strategy with Lakewatch and these acquisitions is to provide a unified security layer across the entire data lifecycle, from raw data ingestion to AI model deployment. This is a departure from traditional SIEM solutions, which often struggle to integrate with modern data architectures like data lakes and AI pipelines.
What is Lakewatch and How Does it Work?
Lakewatch is designed to provide real-time security monitoring and threat detection specifically for data lakes built on the Databricks Lakehouse Platform. According to Databricks, the service leverages a unified data layer to correlate security events across storage, compute, and data science workloads. This allows security teams to quickly identify and respond to potential threats, such as unauthorized data access, malicious code execution, and data exfiltration. The service aims to simplify compliance requirements by providing audit trails and automated security controls.
Traditional SIEMs often struggle with the scale and complexity of modern data environments. They can be expensive to operate and require significant expertise to configure and maintain. Databricks positions Lakewatch as a more streamlined and cost-effective solution, tightly integrated with its existing platform. The company claims Lakewatch reduces the time to detect and respond to security incidents by automating many of the manual tasks associated with traditional SIEMs.
Acquiring Expertise: Antimatter and SiftD
The acquisitions of Antimatter and SiftD are central to Databricks’ security strategy. Antimatter, a data security posture management (DSPM) company, specializes in discovering and preventing data breaches by identifying misconfigurations and vulnerabilities in data stores. Antimatter’s technology will enhance Lakewatch’s ability to proactively identify and address data security risks.
Databricks is acquiring Antimatter, a data security posture management (DSPM) startup, to bolster its security offerings. https://t.co/q9q9q9q9q9
— TechCrunch (@TechCrunch) March 24, 2026
SiftD, focuses on detecting and responding to insider threats. Their platform uses behavioral analytics and machine learning to identify anomalous user activity that could indicate malicious intent. Integrating SiftD’s capabilities into Lakewatch will provide Databricks customers with a more comprehensive view of their security posture, including protection against both external and internal threats.
The Broader Context: Data Security in the AI Era
Databricks’ move into security comes at a time when data breaches and cyberattacks are becoming increasingly sophisticated and frequent. The cost of data breaches is also rising, with the average cost now exceeding $4.45 million globally, according to IBM’s 2023 Cost of a Data Breach Report. The increasing reliance on cloud computing and the proliferation of data are further exacerbating these risks.
The demand for robust data security solutions is particularly strong in industries that handle sensitive data, such as healthcare, finance, and government. These organizations are subject to strict regulatory requirements and face significant penalties for data breaches. Databricks is positioning Lakewatch as a solution that can help these organizations meet their compliance obligations and protect their valuable data assets.
What Which means for Databricks Customers
For existing Databricks customers, Lakewatch promises a more integrated and streamlined security experience. The service is designed to work seamlessly with the Lakehouse Platform, eliminating the need for complex integrations with third-party security tools. The acquisitions of Antimatter and SiftD will further enhance Lakewatch’s capabilities, providing customers with a more comprehensive set of security features.
Although, the success of Lakewatch will depend on Databricks’ ability to effectively integrate the technologies acquired from Antimatter and SiftD. The company will also need to continue to innovate and adapt to the evolving threat landscape. The competition in the SIEM market is fierce, with established players like Splunk, Palo Alto Networks, and Microsoft offering competing solutions.
Databricks has not yet announced pricing details for Lakewatch, but the company has indicated that it will offer a variety of pricing plans to meet the needs of different customers. The service is expected to be generally available in the coming months. Customers can discover more information and sign up for updates on the Databricks website.
Looking ahead, Databricks is expected to continue investing in security as a core part of its platform. The company recognizes that data security is no longer an afterthought, but a fundamental requirement for organizations that want to unlock the full potential of their data and AI initiatives. The next key milestone will be the full integration of Antimatter and SiftD technologies into the Lakewatch platform, expected by the conclude of 2026.
Have thoughts on Databricks’ new security push? Share your comments below and let us know how you see these developments impacting the future of data security.
Worth a look
