Cribl announced on November 10 that it has acquired Tero, a startup whose software estimates how much of a company’s observability data is waste and shows engineers which pipelines are producing it. The price was not disclosed. Neither company said how many customers Tero had, or how much recurring revenue it carried.
Tero’s three co-founders are joining with their engineering team. Ben Johnson, who was chief executive, becomes Cribl’s vice president of observability. Adam Cohen and Nihar Singhal, the startup’s chief technology officer and chief operating officer, come with him.
Johnson is not a new name in this corner of infrastructure software. He co-founded Timber, which built the open source Vector pipeline for moving logs and metrics and was sold to Datadog in 2021. Vector’s pitch was unglamorous: take data from wherever it is produced and send it wherever it needs to go, without writing a separate agent for every destination.
Cribl’s product does something similar one layer up. Companies install it between their applications and their monitoring and security back ends, then use it to drop, reshape or reroute telemetry before it lands in a system that bills by the gigabyte. Cribl says half of the Fortune 100 use the platform, which it now describes as an AI platform for telemetry, with its own SIEM, observability and security operations products running on the same infrastructure.
Tero’s contribution is measurement rather than movement.
Its software looked at what an organisation was already sending and put a number on the share that nobody queried, alerted on or retained. That figure is useful in a sales conversation. Telemetry bills are a function of volume and retention, and most engineering leaders can say roughly what they spend without being able to say which dashboards, logs or traces justified it. Vendors price on ingested volume, retained volume or the count of active series, and the three move independently, so one team can raise a bill without touching the dashboards anyone relies on.
A tool that answers that question changes the argument inside a company.
Clint Sharp, Cribl’s co-founder and chief executive, framed the hire around who governs the data. Johnson described the choice in the company’s statement as competing with Cribl or building with it, and said the platform, the customers and the momentum settled the question. Neither comment addresses price, headcount or what happens to Tero’s existing product.
The deal is the third Cribl has closed in four months. It bought CardinalOps in July and the AI security operations technology of Radiant Security in August. Read together, the purchases move Cribl from a routing layer into products that sit on top of the data it routes: detection, response, and now an audit of what is worth keeping.
That direction carries a cost structure. A company that only moves data is paid for the movement. A company that also sells the decision about what to keep attaches itself to the budget line that the movement created. Observability vendors have spent a decade selling more collection, more retention and more dashboards, and the bill for that model has grown large enough that finance teams now ask about it. The answers are usually assembled by hand, in spreadsheets, by whoever owns the platform.
Tero was automating that answer. Its software identified low-value data across tools and let engineers act on the finding inside the tools they already used, which is a smaller engineering lift than migrating to a new back end. Whether that is a product or a feature is the open question, and Cribl’s answer will show up in how it prices the capability and whether the Tero name survives the integration.
There is a structural reason to think it becomes part of the plumbing. A routing platform already sits at the point where every byte passes, which is the natural place to enforce a decision about which bytes to drop. Put a score on the traffic at that point and the audit stops being a separate purchase.
Competitors are working the same seam. Datadog, which bought Johnson’s last company, sells pipelines and retention of its own. Grafana and the cloud providers’ native tools have argued for years that collection is commoditised and the value sits in the query layer. Cribl’s position is the inverse: whoever decides what enters the query layer holds the ground.
For the engineers who run these pipelines, the practical question is narrower than the strategy. Telemetry is often kept because deleting it requires knowing what depends on it, and that knowledge is usually missing. A scoring tool that runs against existing pipelines is a way to find out without switching anything off first, which is why the measurement function tends to get adopted before the migration it implies.
What the acquisition does not tell you is scale. Cribl has not said how many customers use its security products, how much of its revenue comes from them, or where Tero’s technology will appear in the platform first. The company’s next scheduled public appearance is a booth at KubeCon + CloudNativeCon North America in Salt Lake City, a developer conference where product direction is usually discussed in general terms.
Two things will be visible before any of that is confirmed. One is packaging: whether telemetry scoring is sold as a module, bundled into existing tiers, or given away to defend the routing business. The other is hiring. Tero’s team is small, and the roadmap Johnson now owns spans host monitoring, application performance monitoring, federated observability and AI-native observability, four areas where Cribl competes against companies with far larger engineering organisations.
Cribl’s own description of the platform has shifted toward AI traffic: routing and governing model calls, protecting sensitive data in prompts, watching cost and risk. That is a market with loud demand and unsettled billing, and it gives the company a reason to own the point where data is inspected rather than the screens where it is read. A meter for waste fits that story. It measures the thing customers are already paying for and cannot yet see.