Tenzir
Tenzir GmbH operates an open-source AI-assisted security data pipeline platform that enables enterprise SOCs, MDR providers, and security teams to collect, normalize, enrich, detect, and route telemetry across SIEMs, SOAR, XDR, and data lakes via a freemium-to-enterprise model.
- Company typePrivate
- Founded2019
- HeadquartersHamburg, Germany
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What Tenzir does
Tenzir GmbH is a Hamburg, Germany-based software company operating an open-core platform for security data pipelines. The product enables enterprise security teams, security operations centers (SOCs), and managed detection and response (MDR) providers to collect, parse, shape, normalize, enrich, detect, store, search, replay, and route security telemetry across hyperscaler, on-premises, and SaaS deployments. The platform is built on Apache Arrow for high-bandwidth data exchange and emphasizes Open Cybersecurity Schema Framework (OCSF) normalization as a quality gate, with support for ASIM and ECS schemas. It offers an open-source Node under a BSD 3-Clause license, a free Community Edition limited to one Node and 500 GB/day ingress, and a quote-based annual Enterprise Edition subscription with commercial support. Distribution combines self-serve product-led growth (app.tenzir.com), direct enterprise field sales, cloud marketplace availability across AWS, Azure, and Google Cloud, and channel partners including Computacenter and ectacom.
The company addresses acute pain points in the enterprise security stack: escalating SIEM and cloud data costs, vendor lock-in with incumbent security platforms, slow data source onboarding, lack of data quality standardization, and engineering overhead associated with custom pipeline construction. Quantified claims include sub-minute data onboarding via an AI-accelerated MCP server, 100% OCSF compliance across the data fabric, and +40% team efficiency improvement. The platform integrates with 150+ destinations including Splunk, Elasticsearch, Snowflake, Microsoft Sentinel, Google Security Operations, and all three major hyperscalers. Customer evidence is thin in public sources, with DCSO (an MDR provider) the sole named reference customer. Strategic partnerships extend reach into European sovereign cyber defense (secunet, June 2026), OCSF-focused consulting (HOOP Cyber, March 2025), and threat intelligence (Ticura, Aquila I).
Tenzir was founded in 2019 by Matthias Vallentin, building on his UC Berkeley PhD research on the VAST (Visibility Across Space and Time) project, which was rebranded and consolidated under the Tenzir name in 2023. The Platform reached general availability at Black Hat 2024. The company has raised approximately $3.96M across three disclosed rounds, led by eCAPITAL Entrepreneurial Partners with Giesecke+Devrient Ventures as a strategic backer. Leadership comprises CEO Matthias Vallentin, COO and VP Sales Johan Hesse (previously ~25 years at secunet in high-assurance cybersecurity), and CLO Julia Vallentin. Headcount is 11-50 employees and the legal entity is Tenzir GmbH, registered in Hamburg, Germany.
Tenzir firmographics
Firmographics- Name
- Tenzir
- Legal name
- Tenzir GmbH
- Website
- https://tenzir.com
- Company type
- Private
- Founded year
- 2019
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- Tenzir GmbH operates an open-source AI-assisted security data pipeline platform that enables enterprise SOCs, MDR providers, and security teams to collect, normalize, enrich, detect, and route telemetry across SIEMs, SOAR, XDR, and data lakes via a freemium-to-enterprise model.
- Ownership category
- akta.pro rank
Tenzir industry classification
Industry- Product category
- Security Data Pipeline Platform
- NAICS
- Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (518210)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Security Data Lake, Telemetry Pipelines & Observability Security (HDADAGAH)
- akta.pro secondary industry
- Observability Data Platforms (O11y Pipelines, Telemetry Backends) (HDABAJAJ)
Keywords
Where Tenzir is headquartered
LocationHeadquarters
- HQ city
- Hamburg
- HQ country
- Germany
- HQ region
- Europe
Offices1 record
Markets served
Tenzir business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Technology or R&D, Personnel, Infrastructure, Marketing or Sales, Operations
Revenue model
- Enterprise Edition Subscription: Commercial subscription-based licensing for the Enterprise Edition, which includes additional features and commercial support beyond the free Community Edition. Requires active subscription for use.
- Community Edition: Free tier with limited functionality (1 Node, 500 GB/day data limit) that serves as a product-led growth entry point to drive adoption and potential conversion to Enterprise Edition.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Others | Community Edition - Free tier for individual users and evaluation |
| Subscription | Annual | Enterprise Edition - Commercial subscription for advanced features and support |
Go-to-market motion2 records
Distribution channels4 records
Marketing channels8 records
Tenzir product offering
Product offeringCore offering
Tenzir is a security-native AI-powered data pipeline platform that enables security teams to collect, parse, shape, normalize (OCSF/ASIM/ECS), enrich, detect (Sigma/YARA/Python), store (Parquet), search, replay, and route security data. The platform deploys across hyperscaler (AWS, Azure, GCP), on-premises self-hosted, and SaaS environments, and ships with 150+ integrations for SIEM, SOAR, XDR, and data lake destinations. It is offered under an open-core model with a free Community Edition and a commercial Enterprise Edition.
Product overview
Tenzir is a security-native data pipeline platform offered in three editions: Open-Source (BSD-3-Clause licensed Node), Community Edition (free tier with Platform, App, and one Node), and Enterprise Edition (commercial subscription). The platform consists of three architectural components: Node (tenzir-node binary managing pipelines and storage), Platform (central SaaS control plane), and App (web UI for managing Nodes and exploring data). The platform enables security teams to command their security data through capabilities including collect, parse, shape, optimize, normalize (OCSF/ASIM/ECS), anonymize, enrich, detect (Sigma/YARA/Python), store (Parquet), search, replay, and route. Tenzir supports deployment as hyperscaler-native, on-premises/self-hosted, or SaaS, integrating with over 150 data sources and destinations including SIEM/SOAR/XDR platforms.
Differentiator
Problem solved
Functional benefit
Products and services
- Tenzir Platform AI-powered security data pipeline platform that enables security teams to collect, parse, shape, normalize, enrich, detect, store, search, replay, and route security data across hybrid environments. Supports hyperscaler, on-premises, and SaaS deployment, and ships as three architectural components (Node, Platform control plane, and App web UI) under an open-core license.
- Tenzir Node (tenzir-node) The standalone binary executable (tenzir-node) that manages pipelines and storage. Consists of closed-source proprietary code, open-source BSD 3-Clause licensed code, and third-party open-source dependencies.
- Tenzir App Browser-based web application for accessing the Tenzir Platform, managing Nodes and pipelines, and exploring security data interactively. Includes the App Frontend (browser) and App Backend (hosted in the Platform).
- Tenzir Query Language (TQL) Domain-specific query language for interacting with Tenzir pipelines and performing search, aggregation, and transformation operations on security data.
Quantifiable outcome
- <1 minute data onboarding with AI-accelerated MCP server
- +2 more outcomes
Companies that use Tenzir
Customer profileNamed customers1 record
Segments3 records
Ideal customer profiles4 records
Tenzir technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Integration21 records
AI capability3 records
Feature5 records
Tenzir partnerships and signals
Strategic signalPartnerships
Seven partnerships are on record, tiered core, major and minor.
- secunetcoresecunet is Germany's leading cybersecurity company providing high-assurance products and consulting, including the secunet edge gateway platform that secures distributed infrastructures across government, defense, healthcare, and critical sectors. Tenzir partnered with secunet to bring sovereign cyber defense to the network edge.
- HOOP CybercoreHOOP Cyber is a cyber data engineering consultancy dedicated to empowering organisations with data-driven security solutions that are both effective and cost-optimised. Partnership focuses on redefining security data lakes and OCSF adoption.
- DCSOcoreDCSO delivers Managed Detection & Response (MDR) services combining sharp threat intelligence with operational expertise, enabling SecOps teams to detect, respond, and stay resilient against evolving threats. DCSO serves as a reference customer for Tenzir's platform capabilities.
- ComputacentermajorComputacenter is a leading independent technology and services provider trusted by large enterprises and public sector organizations. Deep expertise in SIEM, SOAR, EDR, and threat intelligence helps customers build integrated cyber defense ecosystems aligned to MITRE ATT&CK and CIS frameworks.
- trustunitminorTrustunit is a Turkish cybersecurity company specializing in tailored security solutions and consultancy. Focus on guiding organizations securely through digital transformation, offering services across risk management, threat intelligence, and operational security strategies.
- ectacomminorectacom is an independent business development distributor specializing in complex cybersecurity solutions. Serves as a trusted technology enabler providing partners with visionary technologies, deep technical expertise, and comprehensive services.
- Security Data WorksminorSecurity Data Works is an independent lab and advisory practice for security data engineering. Through open benchmarks, vendor-neutral capability matrices, and fixed-scope architecture engagements, they help organizations validate telemetry health and design performant security data architectures.
Scale indicators4 records
Recent moves7 records
Expansion highlights6 records
Tenzir competitors and assessment
Company assessmentBroad incumbents
- Exabeam: Exabeam is an AI-driven SIEM and security analytics platform with its own data ingestion and normalization pipeline, competing for SOC budgets that Tenzir's customers also control.
- Splunk: Splunk (now part of Cisco) is the dominant SIEM and observability platform that Tenzir complements (and partially substitutes for in routing layers). Splunk's own ingest pricing and pipeline features define the cost pain point Tenzir targets.
- Elastic: Elastic provides search, analytics, and SIEM capabilities (Elastic Security) and is a native integration destination for Tenzir. It overlaps with Tenzir where customers use Elastic as the primary security data backend.
- Datadog: Datadog is a leading cloud observability and security platform with its own open-source Vector pipeline. It competes with Tenzir for observability data pipeline budgets and is a potential hyperscaler-style incumbent.
- Sumo Logic: Sumo Logic is a cloud-native log analytics and SIEM platform with integrated ingest pipeline capabilities, competing for the same security data infrastructure budgets Tenzir targets.
- Confluent: Confluent's Kafka-based streaming platform is a complementary (and sometimes competing) infrastructure choice for security data pipelines; Tenzir integrates with Kafka while Confluent Cloud offers an alternative streaming substrate.
- Google Security Operations (Chronicle): Google's cloud-native SIEM offers native pipeline, ingestion, and OCSF-aligned capabilities — a key hyperscaler-native alternative that Tenzir both integrates with and competes against for cloud-centric buyers.
Direct peers
- Cribl: Cribl Stream is a security and observability data routing/pipeline platform that competes most directly with Tenzir — both target SOC/MDR/enterprise buyers with vendor-neutral pipeline, normalization, and cost-control value propositions.
- Mezmo: Mezmo (formerly LogDNA) is a cloud-native observability data pipeline platform that ingests, routes, and archives log/telemetry data — directly overlapping Tenzir's pipeline positioning for hybrid and cloud environments.
Others
- Snowflake: Snowflake is a primary analytics destination that Tenzir routes security data into. It is adjacent rather than directly competitive — Tenzir enables security data lakes on Snowflake but does not replace its warehouse role.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks6 records
Key highlights6 records
Customer concentration
Tenzir social profiles
Digital presenceTenzir compliance and trust
Trust signalCompliance1 record
Tenzir financial estimates
Financial estimateRevenue estimate
Valuation estimate
Tenzir leadership team
Management profileNumber of profiles
Profiles3 records
Tenzir funding detail
Funding detailFunding overview
Funding rounds3 records
Investors2 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Tenzir M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Tenzir
What does Tenzir do?
Tenzir is a security-native AI-powered data pipeline platform that enables security teams to collect, parse, shape, normalize (OCSF/ASIM/ECS), enrich, detect (Sigma/YARA/Python), store (Parquet), search, replay, and route security data. The platform deploys across hyperscaler (AWS, Azure, GCP), on-premises self-hosted, and SaaS environments, and ships with 150+ integrations for SIEM, SOAR, XDR, and data lake destinations. It is offered under an open-core model with a free Community Edition and a commercial Enterprise Edition.
Is Tenzir a public or private company?
Tenzir is a private company. It is classified as venture growth investor backed and is currently operating.
When was Tenzir founded?
Tenzir was founded in 2019. It employs 11 to 50 people.
Where is Tenzir based?
Tenzir is headquartered in Hamburg, Germany, in the Europe region.
How does Tenzir make money?
Two revenue lines are on record. Enterprise Edition Subscription is the primary driver. The others are community Edition.
Who are Tenzir's main competitors?
Broad incumbents on record are Exabeam, Splunk, Elastic, Datadog, Sumo Logic, Confluent and Google Security Operations (Chronicle). Direct peers are Cribl and Mezmo. Snowflake is listed as an others.
Does Tenzir have an API?
No public API is recorded for Tenzir.
What industry is Tenzir in?
Tenzir's product category is Security Data Pipeline Platform. Its primary akta.pro industry code is HDADAGAH, Security Data Lake, Telemetry Pipelines & Observability Security, with a secondary code of HDABAJAJ, Observability Data Platforms (O11y Pipelines, Telemetry Backends). Its NAICS code is 518210 and its SIC code is 7372.