Name

Scanner.dev

Legal name

Scanner, Inc.

Website

https://scanner.dev

Company type

Private

Founded year

2021

Operating status

Operating

Headcount range

11–50 employees

Ownership category

akta.pro rank

Product category

Cloud-native Security Data Lake / SIEM Alternative

NAICS

Software Publishers (513210), Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (51821)

SIC

Services-Prepackaged Software (7372), Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Cloud Security Logging, SIEM/SOAR & Threat Detection (HDABAHAL)

akta.pro secondary industry

Log Management & Analytics (HDABAJAC)

Keywords

• Security data lake
• Cloud-native SIEM
• Threat detection platform
• Log search analytics
• AI-powered SOC

Headquarters

HQ city

San Francisco

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Infrastructure, Marketing or Sales, Operations

Revenue model

1. Managed Scanner (Multi-Tenant): Multi-tenant cloud deployment where Scanner runs the compute infrastructure. Best for fast-growing companies wanting zero-ops experience. Pricing based on daily log volume.
2. Managed Scanner (Single-Tenant): Dedicated AWS account for each customer with Scanner control plane. Enhanced performance with dedicated resources. For mid-sized companies requiring compliance and dedicated SOC operations.
3. Bring Your Own Cloud (BYOC): Scanner compute runs entirely within customer's own AWS account. All data and processing stays in AWS accounts owned by customer. For large organizations requiring enterprise-wide security operations and strict regulatory compliance.

Pricing tiers

Go-to-market motion3 records

Distribution channels3 records

Marketing channels9 records

Core offering

Scanner.dev sells a cloud-native security data lake platform that indexes log data directly inside customer-owned Amazon S3 buckets using a proprietary S3-native inverted index. It delivers SIEM-grade search speed (up to 700x faster than Amazon Athena), continuous streaming threat detection with 400+ out-of-the-box rules, schema-less ingestion from 30+ sources, and native AI agent access via Model Context Protocol for incident response and threat hunting.

Product overview

Scanner.dev offers a unified security data lake platform built around a specialized inverted index designed for object storage (S3). The core platform consists of Scanner (the main product), complemented by four integrated modules: Scanner Collect for data ingestion from 30+ sources, Search & Investigate for hyper-fast full-text search across petabytes, Detections & Response for streaming threat detection with 400+ out-of-the-box rules, and MCP & APIs for AI agent integration. The platform supports three deployment models: Multi-Tenant Managed Scanner (shared infrastructure), Single-Tenant Managed Scanner (dedicated AWS account), and Bring Your Own Cloud (customer-controlled infrastructure). All models keep customer data in their own S3 buckets with full data sovereignty.

Differentiator

Problem solved

Functional benefit

Products and services

• Scanner Core Platform Cloud-native security data lake that indexes data directly in S3 where it already lives, enabling hyper-fast search across petabytes of logs, continuous threat detection, and AI agent integration. Replaces traditional SIEMs with unlimited retention at lower costs; targets SOC teams, detection engineers, and incident responders.
• Scanner Collect Data ingestion module that seamlessly ingests logs from 30+ pre-built integrations including AWS CloudTrail, Azure, GCP, Okta, GitHub, and more. Features schema-less architecture supporting JSON, CSV, plaintext, and Parquet formats without ETL requirements; for security and platform teams.
• Search & Investigate Lightning-fast full-text search engine that enables security teams to search petabytes of logs in seconds for indicators of compromise and threat hunting investigations; performance up to 700x faster than Amazon Athena.
• Detections & Response

Quantifiable outcome

• 84% reduction in investigation time using Scanner with AI agent
• +6 more outcomes

Named customers8 records

Segments4 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration26 records

AI capability7 records

Feature9 records

Partnerships

Three partnerships are on record, tiered design partner, core infrastructure and core platform.

• Notiondesign partnerTechnology or IntegrationNotion uses Scanner as a core data source for their security AI agent 'Scruff', achieving 84% reduction in investigation time. Notion publicly wrote about their Scanner integration.
• AWS (Amazon Web Services)core infrastructureTechnology or IntegrationScanner is built on AWS and indexes data directly in customer S3 buckets. BYOC deployment option runs entirely within customer's AWS account. AWS re:Invent event participation.
• GitHubcore platformTechnology or IntegrationDetection-as-code implementation with GitHub CI/CD integration. Public GitHub repositories for detection rules (scanner-inc/detection-rules-*). Detection rules managed directly from GitHub repositories.

Scale indicators6 records

Recent moves6 records

Expansion highlights7 records

Broad incumbents

• Exabeam: Exabeam is an established SIEM and security analytics vendor with a cloud-native data lake architecture and AI-driven detection capabilities. It competes with Scanner in mid-market and enterprise SOC replacement opportunities, with a much larger sales motion and broader product suite.
• Splunk: Splunk is the dominant enterprise SIEM that Scanner is explicitly positioned against. With Cisco's backing and a massive installed base, Splunk is the incumbent alternative whose cost and retention limitations Scanner attacks. Any Splunk product innovation in cheap long-term retention would directly compress Scanner's value proposition.
• Sumo Logic: Sumo Logic is a cloud-native SIEM and log analytics platform with significant overlap in customer base (security teams needing log search and threat detection). It competes with Scanner on the same 'modern SIEM' positioning but at significantly larger scale and with broader analytics coverage.
• Snowflake: Snowflake is a cloud data platform increasingly used as the foundation for security data lakes, and competes with Scanner when security teams choose to build on Snowflake's separation of storage and compute. It is a broader platform play rather than a security-specialized peer, but is often on the buyer's evaluation shortlist alongside Scanner.
• Microsoft Sentinel: Microsoft Sentinel is a cloud-native SIEM deeply integrated with the Azure ecosystem and increasingly with AWS data sources. It competes head-on with Scanner for cloud security data lake workloads, especially in Microsoft-heavy enterprise accounts, and benefits from a bundled go-to-market motion that Scanner cannot match.

Direct peers

• ChaosSearch: ChaosSearch indexes log data directly in S3 (the same architectural premise as Scanner) and provides a search/analytics layer on top of object storage. The two companies share the S3-native data lake thesis, though ChaosSearch historically focuses more on log analytics and compliance use cases than detection.
• Devo Technology: Devo offers a cloud-native SIEM with a security data lake at its core, targeting similar SOC and security operations use cases as Scanner. Both emphasize real-time analytics on large volumes of machine data, though Devo carries a more traditional enterprise go-to-market and broader product portfolio.
• Panther Labs: Panther offers a cloud-native SIEM built on top of a security data lake with detection-as-code, similar to Scanner's core proposition. Both target modern security teams looking to replace Splunk with a more scalable, code-driven architecture and serve overlapping buyer personas in fast-growing technology companies.
• Hunters Security: Hunters provides a cloud-native SIEM and security data lake platform that aggregates logs, runs detections, and feeds SOC workflows. It targets the same 'SIEM replacement' buyer as Scanner, with comparable emphasis on reducing Splunk-class costs while improving detection quality and analyst experience.
• Cribl: Cribl's log routing and observability pipeline (Stream, Edge) addresses the same SIEM cost and data routing pain points that Scanner targets. Both companies position around reducing SIEM spend and enabling flexible data flow into security data lakes, with Cribl historically the incumbent 'data reduction' layer that Scanner increasingly overlaps with on the security data lake side.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/scanner_dev
• LinkedInlinkedin.com/company/scanner-dev

Compliance2 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds1 record

Investors3 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Scanner.dev