Cribl Startup Diligence Report
Proceed to confirmatory software/SaaS diligence focused on ARR quality, NDR cohort durability, gross margin, consumption pricing exposure, data-security posture, enterprise contract terms and competitive displacement against incumbent observability/security platforms.
Cribl Startup Diligence Report
Cribl appears to be an active private enterprise software unicorn with strong public evidence for a 2024 Series E, over $100M ARR, large-enterprise adoption, product breadth and named customer logos. Public evidence still leaves audited financials, cohort quality, customer concentration, security artifacts, legal matters and cap-table terms unresolved.
The target competes against well-funded incumbents and specialized alternatives; win/loss and pricing evidence are not public.
Diligence request: Request source documents and specialist review before investment reliance.
Public product claims do not establish reliability, scalability, roadmap delivery, quality metrics or technical debt.
Diligence request: Request source documents and specialist review before investment reliance.
Audited financials, revenue quality, margin, burn, runway and forecast assumptions are not public.
Diligence request: Request source documents and specialist review before investment reliance.
The $3.5B valuation is a public headline; preferences, liquidation stack, secondary components and current fair value are private.
Diligence request: Request source documents and specialist review before investment reliance.
Public customer/adoption signals do not disclose revenue concentration, churn, renewals, contract terms or reference quality.
Diligence request: Request source documents and specialist review before investment reliance.
Supplier, infrastructure, site, cloud, manufacturing or partner dependencies may create concentration and continuity risks.
Diligence request: Request source documents and specialist review before investment reliance.
Litigation, regulatory correspondence, security/privacy/safety compliance, IP ownership and material contracts are not fully public.
Diligence request: Request source documents and specialist review before investment reliance.
Public leadership/headcount signals are insufficient to validate org depth, compensation, attrition, succession and retention.
Diligence request: Request source documents and specialist review before investment reliance.
Cribl's public valuation and financing anchors are visible, but financial statements, retention/unit economics, cash/debt and cap-table terms are private.
not publicly verifiable confidence: medium
Annual and quarterly financial information for the past three years: Audited financials, cohort data, customer concentration, burn/runway, cap table, debt, security reports and material contracts are not public.
| metric | public signal | diligence request | status |
|---|---|---|---|
| Revenue / ARR | Company states it surpassed $100M ARR. | Audited financials, revenue bridge, billings, bookings and revenue-recognition policy. | partially_verified |
| Gross margin / unit economics | Not publicly disclosed at diligence depth. | Gross margin by product/site/customer cohort and support or warranty cost. | not_publicly_verifiable |
| Retention / churn | Company states NDR over 130%; cohort waterfall not public. | GRR, NRR, logo churn, cohort waterfall and renewal pipeline. | partially_verified |
| Cash / runway / debt | No audited cash, burn, runway or debt schedule found. | Cash balance, burn, runway, debt instruments, covenants and liens. | not_publicly_verifiable |
not publicly verifiable confidence: medium
Financial Projections: Audited financials, cohort data, customer concentration, burn/runway, cap table, debt, security reports and material contracts are not public.
partially verified confidence: medium
Capital Structure: Audited financials, cohort data, customer concentration, burn/runway, cap table, debt, security reports and material contracts are not public.
| stakeholder | public position | diligence caveat | status |
|---|---|---|---|
| Named investors | GV / CapitalG / GIC / IVP / CRV; Customer reference program; Technology integrations | Ownership percentages, preferences, side letters and board rights not public. | partially_verified |
| Founders / employees | Clint Sharp; Michael McBride; Founding and executive team | Founder holdings, option pool, vesting and secondary sales not public. | not_publicly_verifiable |
| Debt / warrants / SAFEs | No complete public schedule found. | Request debt, warrant, SAFE/note and off-balance-sheet liability schedules. | not_publicly_verifiable |
partially verified confidence: medium
Other financial information: Audited financials, cohort data, customer concentration, burn/runway, cap table, debt, security reports and material contracts are not public.
| date | event | amount or valuation | source | verification status |
|---|---|---|---|---|
| 2021-08-25 | CB Insights unicorn date joined | $3.5B valuation in fetched CB row | SRC-001 | verified for public list entry |
| 2024-08-27 | Series E announcement | $319M round; valuation increased to $3.5B; total capital over $600M | SRC-003 | verified for public announcement |
| 2023-10 | ARR milestone cited in release | surpassed $100M ARR in less than four years | SRC-003 | verified for company statement |
| current | Current capitalization, preferences, debt and option pool | not_publicly_verifiable | company data-room request | not_publicly_verifiable |
Public sources verify active product positioning for Cribl; product quality, economics, roadmap and support obligations require private diligence.
partially verified confidence: medium
Description of each product: Cribl publicly markets an AI Platform for Telemetry with Stream, Edge, Search and Lake products.
| product | audience | public evidence | verification status |
|---|---|---|---|
| Cribl Stream | Observability pipeline users | Pricing page describes Stream as an observability pipeline. | verified for public listing |
| Cribl Edge | Endpoint / agent-based telemetry collection | Pricing page describes Edge as a scalable vendor-neutral agent. | verified for public listing |
| Cribl Search | Investigation and search workflows | Pricing page describes Search as a search and investigation solution. | verified for public listing |
| Cribl Lake | Storage and telemetry lake use cases | Pricing page describes Lake as a turnkey data lake. | verified for public listing |
| Cribl AI / AI Platform for Telemetry | AI-assisted telemetry management | Homepage and press materials market AI Platform for Telemetry positioning. | partially_verified |
| product or tier | public pricing signal | diligence request | verification status |
|---|---|---|---|
| Universal / flexible pricing | Company says flexible pricing lets customers allocate spend across products and services. | Request realized ACV, discount waterfall and usage-commit structure. | verified for public listing |
| Cloud / software license | Pricing page includes cloud and software license categories. | Request attach rates, renewals and gross margin by deployment model. | partially_verified |
| Stream / Edge / Search / Lake | Public pricing guide exists but full economics are gated or sales-led. | Request ARR by product and expansion cohorts. | partially_verified |
Public customer, adoption or partner signals exist for Cribl, but top-customer revenue, contract terms, renewal health and concentration remain unresolved.
partially verified confidence: medium
Top customers by application: Company materials claim over $100M ARR, a quarter of Fortune 500 as customers, over 130% NDR and named logos/stories, but top-customer revenue concentration is not public.
| customer or signal | public evidence | use case | verification status |
|---|---|---|---|
| Fortune 500 customers | Series E release says a quarter of Fortune 500 companies are customers. | Enterprise customer base | verified for company statement |
| Fortune 100 customers | Customer page references half of Fortune 100 and shows enterprise logos. | Large-enterprise penetration signal | verified for company statement |
| Siemens, Leidos, New Balance | Customer page displays these logos. | Public logo evidence only | verified for public logo listing |
| ServiceNow and Sophos stories | Customer page links to ServiceNow and Sophos stories; Series E release quotes Sophos. | Reference/case-study signal | partially_verified |
partially verified confidence: medium
Strategic relationships: Company materials claim over $100M ARR, a quarter of Fortune 500 as customers, over 130% NDR and named logos/stories, but top-customer revenue concentration is not public.
| partner | nature | public evidence | diligence gap |
|---|---|---|---|
| GV / CapitalG / GIC / IVP / CRV | Capital and board/support ecosystem | Series E investors publicly named. | Request commercial terms, exclusivity, economics and termination rights. |
| Customer reference program | Customer advocacy channel | Customer page invites/reference-program participation. | Request commercial terms, exclusivity, economics and termination rights. |
| Technology integrations | Ecosystem dependency | Homepage/product pages show broad telemetry ecosystem/integration positioning. | Request commercial terms, exclusivity, economics and termination rights. |
partially verified confidence: medium
Revenue by customer: Company materials claim over $100M ARR, a quarter of Fortune 500 as customers, over 130% NDR and named logos/stories, but top-customer revenue concentration is not public.
not publicly verifiable confidence: low
Significant relationships severed within the last two years: Company materials claim over $100M ARR, a quarter of Fortune 500 as customers, over 130% NDR and named logos/stories, but top-customer revenue concentration is not public.
partially verified confidence: medium
Top suppliers: Company materials claim over $100M ARR, a quarter of Fortune 500 as customers, over 130% NDR and named logos/stories, but top-customer revenue concentration is not public.
| supplier or dependency | role | public evidence | concentration risk |
|---|---|---|---|
| Public cloud infrastructure | Hosting and service delivery dependency | Cloud product exists but cloud/provider concentration not public. | not_publicly_verifiable |
| Security/observability ecosystem integrations | Integration and API dependency | Product value depends on routing and integrating with external tools. | partially_verified |
| Customer telemetry data sources | Usage/concentration risk | Customer value depends on data ingestion volume and quality. | not_publicly_verifiable |
Cribl operates in a competitive market where public positioning alone is insufficient; win/loss, pricing and buyer-reference evidence are required.
partially verified confidence: medium
Competitive landscape by market segment: Cribl competes in observability, telemetry pipelines, security data and SIEM-adjacent workflows against incumbents and cloud-native platforms.
| competitor | segment | public evidence | differentiator or threat |
|---|---|---|---|
| Splunk / Cisco | SIEM/log analytics and observability platform | Entrenched incumbent with large enterprise base. | Platform bundling and renewal leverage |
| Datadog | Cloud observability and security data | High-growth public incumbent with broad product suite. | Product breadth and brand |
| Elastic | Search/observability/security analytics | Open/search-native competitor. | Pricing and deployment flexibility |
| Grafana Labs | Open observability ecosystem | Private/open-source observability player. | Community and stack depth |
| axis | target position | competitor pressure | evidence |
|---|---|---|---|
| Product breadth | Public product suite visible. | Incumbents may offer broader bundles. | Cribl publicly markets an AI Platform for Telemetry with Stream, Edge, Search and Lake products. |
| Price / economics | Public price or packaging incomplete. | Pricing pressure and discounts unknown. | Cribl publishes a flexible pricing model and product suite packaging, but realized ACV, discounting, gross margin and usage cohorts are private. |
| Distribution / customer trust | Public partners/customers exist. | Customer references and win/loss not independently verified. | Company materials claim over $100M ARR, a quarter of Fortune 500 as customers, over 130% NDR and named logos/stories, but top-customer revenue concentration is not public. |
Public GTM signals indicate plausible channels for Cribl, but CAC, payback, quota attainment, pipeline source mix and marketing budget sufficiency are private.
partially verified confidence: medium
Strategy and implementation: Public GTM evidence includes enterprise direct sales, product-led trials/sandboxes, partner/reference programs and customer stories.
| channel | public evidence | diligence request | verification status |
|---|---|---|---|
| Enterprise direct sales | Large-enterprise ARR and Fortune 500 penetration claimed publicly. | Request pipeline, win/loss and quota attainment. | partially_verified |
| Product-led trial / sandboxes | Press release links to Cribl Sandboxes and website has trial CTAs. | Request trial-to-paid conversion and usage cohorts. | partially_verified |
| Customer stories/reference program | Customer page highlights references and stories. | Request reference quality and renewal outcomes. | partially_verified |
| Partner/integration ecosystem | Product value depends on telemetry destinations and sources. | Request partner-sourced pipeline and integration health. | partially_verified |
partially verified confidence: medium
Major Customers: Company materials claim over $100M ARR, a quarter of Fortune 500 as customers, over 130% NDR and named logos/stories, but top-customer revenue concentration is not public.
partially verified confidence: medium
Principal avenues for generating new business: Public GTM evidence includes enterprise direct sales, product-led trials/sandboxes, partner/reference programs and customer stories.
| signal | public evidence | interpretation |
|---|---|---|
| Series E / ARR milestone | $319M Series E and $100M ARR milestone create strong market signal. | Capital and scale signal |
| Customer page and Fortune claims | Customer page displays logos and press release claims Fortune penetration. | Customer trust signal |
| Pricing/product pages | Public portfolio and flexible pricing details are active. | Buyer education signal |
not publicly verifiable confidence: low
Sales force productivity model: Public GTM evidence includes enterprise direct sales, product-led trials/sandboxes, partner/reference programs and customer stories.
not publicly verifiable confidence: low
Ability to implement marketing plan with current and projected budgets: Public GTM evidence includes enterprise direct sales, product-led trials/sandboxes, partner/reference programs and customer stories.
Public technical and product signals support active R&D, but roadmap, technical debt, development cost, security posture and quality metrics are not public.
partially verified confidence: medium
Description of R&D organization: Public evidence supports active product development across Stream, Edge, Search, Lake and AI telemetry features, but roadmap, security backlog and reliability data are private.
| project or personnel | public evidence | status or role | verification status |
|---|---|---|---|
| Stream / Edge / Search / Lake portfolio | Products are listed in public pricing/product pages. | Commercial product suite | verified for public listing |
| AI Platform for Telemetry | Homepage and press materials use AI telemetry positioning. | AI product/platform roadmap signal | partially_verified |
| Product expansion | Series E release says multi-product adoption increased more than 300% over 12 months. | Expansion and R&D adoption signal | verified for company statement |
partially verified confidence: medium
New Product Pipeline: Public evidence supports active product development across Stream, Edge, Search, Lake and AI telemetry features, but roadmap, security backlog and reliability data are private.
| asset | public signal | diligence request | verification status |
|---|---|---|---|
| Telemetry routing and processing platform | Core product claims public. | Security architecture and performance test review required | partially_verified |
| Search, Lake and AI modules | Product pages list additional modules. | Roadmap and code quality review required | partially_verified |
| Customer data handling controls | Security/telemetry data use case implies sensitive data processing. | SOC, pen test, privacy and DPA review required | not_publicly_verifiable |
Public management/team evidence supports an active operating profile, while HRIS, compensation, retention and background checks remain private.
partially verified confidence: medium
Organization Chart: Cribl states it was founded in 2018, is remote-first with a San Francisco office and had more than 700 employees worldwide in the 2024 Series E release.
partially verified confidence: medium
Historical and projected headcount by function and location: Cribl states it was founded in 2018, is remote-first with a San Francisco office and had more than 700 employees worldwide in the 2024 Series E release.
| period | public headcount | source or evidence | verification status |
|---|---|---|---|
| 2018 | not_publicly_verifiable | Founded in 2018 per Cribl release | not_publicly_verifiable |
| 2024 | 700 | More than 700 employees worldwide per Series E release | partially_verified |
| current | not_publicly_verifiable | HRIS export required | not_publicly_verifiable |
partially verified confidence: medium
Senior management biographies: Cribl states it was founded in 2018, is remote-first with a San Francisco office and had more than 700 employees worldwide in the 2024 Series E release.
| name | role | public evidence | confidence |
|---|---|---|---|
| Clint Sharp | Co-founder and CEO | Quoted in Series E press release. | high |
| Michael McBride | GV general partner / board member | Series E release says he joined Cribl board. | high |
| Founding and executive team | Broader org chart not fully public in reviewed sources | Request executive biographies, HRIS and retention data. | not_publicly_verifiable |
not publicly verifiable confidence: low
Compensation arrangements: Cribl states it was founded in 2018, is remote-first with a San Francisco office and had more than 700 employees worldwide in the 2024 Series E release.
not publicly verifiable confidence: low
Incentive stock plans: Cribl states it was founded in 2018, is remote-first with a San Francisco office and had more than 700 employees worldwide in the 2024 Series E release.
not publicly verifiable confidence: low
Significant employee relations problems, past or present: Cribl states it was founded in 2018, is remote-first with a San Francisco office and had more than 700 employees worldwide in the 2024 Series E release.
not publicly verifiable confidence: low
Personnel Turnover: Cribl states it was founded in 2018, is remote-first with a San Francisco office and had more than 700 employees worldwide in the 2024 Series E release.
Public legal and regulatory evidence is incomplete; counsel review is required for litigation, regulatory, IP, privacy/security, safety, insurance and material contracts.
partially verified confidence: medium
Pending lawsuits against the Company: No public litigation schedule was verified; handling security and telemetry data creates privacy, security, FedRAMP/public-sector and contractual compliance diligence needs.
| matter | public status | diligence request | verification status |
|---|---|---|---|
| Pending lawsuits against company | No docket artifacts reviewed or verified. | Counsel litigation schedule required | not_publicly_verifiable |
| Privacy/security compliance | Telemetry/security data handling creates regulatory and contractual exposure. | Request SOC 2, ISO, pen test, DPIAs, DPAs and incident history | not_publicly_verifiable |
| Public-sector / regulated customers | Cribl.Cloud Government content exists in later company materials; formal authorization status requires review. | Request FedRAMP/public-sector compliance artifacts | partially_verified |
not publicly verifiable confidence: low
Pending lawsuits initiated by Company: No public litigation schedule was verified; handling security and telemetry data creates privacy, security, FedRAMP/public-sector and contractual compliance diligence needs.
not publicly verifiable confidence: low
Environmental and employee safety issues and liabilities: No public litigation schedule was verified; handling security and telemetry data creates privacy, security, FedRAMP/public-sector and contractual compliance diligence needs.
partially verified confidence: medium
Material patents, copyrights, licenses, and trademarks: No public litigation schedule was verified; handling security and telemetry data creates privacy, security, FedRAMP/public-sector and contractual compliance diligence needs.
| asset or exposure | public signal | required artifact | status |
|---|---|---|---|
| Telemetry routing and processing platform | Core product claims public. | Security architecture and performance test review required | partially_verified |
| Search, Lake and AI modules | Product pages list additional modules. | Roadmap and code quality review required | partially_verified |
| Customer data handling controls | Security/telemetry data use case implies sensitive data processing. | SOC, pen test, privacy and DPA review required | not_publicly_verifiable |
not publicly verifiable confidence: low
Insurance coverage and material exposures: No public litigation schedule was verified; handling security and telemetry data creates privacy, security, FedRAMP/public-sector and contractual compliance diligence needs.
not publicly verifiable confidence: low
Material contracts: No public litigation schedule was verified; handling security and telemetry data creates privacy, security, FedRAMP/public-sector and contractual compliance diligence needs.
not publicly verifiable confidence: medium
Regulatory agency problems: No public litigation schedule was verified; handling security and telemetry data creates privacy, security, FedRAMP/public-sector and contractual compliance diligence needs.
| agency or domain | public evidence | diligence request | status |
|---|---|---|---|
| Corporate / securities | Private-company status and financing are public; filings are not complete in public sources. | Corporate good standing, board approvals, securities filings and investor rights. | not_publicly_verifiable |
| Product / safety / security / privacy | No public litigation schedule was verified; handling security and telemetry data creates privacy, security, FedRAMP/public-sector and contractual compliance diligence needs. | Compliance policies, certifications, incident history and counsel memos. | not_publicly_verifiable |
| Material contracts | No complete material-contract schedule public. | Customer, supplier, cloud, partner, financing and lease agreements. | not_publicly_verifiable |
| ID | Claim | Status | Sources |
|---|---|---|---|
| EC-001 | CB Insights lists Cribl as a United States enterprise-tech unicorn valued at $3.5B, and company/independent funding sources corroborate a 2024 $3.5B valuation. | verified high | SRC-001SRC-003SRC-007SRC-008 |
| EC-002 | Cribl announced a $319M oversubscribed Series E in August 2024, with total capital secured over $600M and a valuation increased to $3.5B. | partially verified high | SRC-003SRC-007SRC-008 |
| EC-003 | Cribl publicly markets an AI Platform for Telemetry with Stream, Edge, Search and Lake products. | verified medium | SRC-002SRC-006 |
| EC-004 | Cribl publishes a flexible pricing model and product suite packaging, but realized ACV, discounting, gross margin and usage cohorts are private. | partially verified medium | SRC-005 |
| EC-005 | Company materials claim over $100M ARR, a quarter of Fortune 500 as customers, over 130% NDR and named logos/stories, but top-customer revenue concentration is not public. | partially verified medium | SRC-003SRC-004 |
| EC-006 | Cribl competes in observability, telemetry pipelines, security data and SIEM-adjacent workflows against incumbents and cloud-native platforms. | partially verified medium | SRC-002SRC-003 |
| EC-007 | Public GTM evidence includes enterprise direct sales, product-led trials/sandboxes, partner/reference programs and customer stories. | partially verified medium | SRC-002SRC-005 |
| EC-008 | Public evidence supports active product development across Stream, Edge, Search, Lake and AI telemetry features, but roadmap, security backlog and reliability data are private. | partially verified medium | SRC-002SRC-003SRC-006 |
| EC-009 | Cribl states it was founded in 2018, is remote-first with a San Francisco office and had more than 700 employees worldwide in the 2024 Series E release. | partially verified medium | SRC-003 |
| EC-010 | No public litigation schedule was verified; handling security and telemetry data creates privacy, security, FedRAMP/public-sector and contractual compliance diligence needs. | not publicly verifiable low | SRC-002SRC-003 |
| EC-011 | Audited financials, cohort data, customer concentration, burn/runway, cap table, debt, security reports and material contracts are not public. | not publicly verifiable high | SRC-001SRC-003 |
| EC-012 | The company appears eligible as an active private unicorn based on CB Insights list status, current company-owned product/customer pages and 2024 private financing announcements; no IPO/acquisition/shutdown evidence was found in reviewed public sources. | partially verified medium | SRC-001SRC-002SRC-003 |
| ID | Publisher | Title | Accessed |
|---|---|---|---|
| SRC-001 | CB Insights | CB Insights Global Unicorn Club | 2026-05-27 |
| SRC-002 | Cribl | Cribl company website | 2026-05-27 |
| SRC-003 | Cribl | Cribl Series E press release | 2026-05-27 |
| SRC-004 | Cribl | Cribl customers page | 2026-05-27 |
| SRC-005 | Cribl | Cribl pricing plans page | 2026-05-27 |
| SRC-006 | Cribl | Cribl products page | 2026-05-27 |
| SRC-007 | SecurityWeek | SecurityWeek article on Cribl Series E | 2026-05-27 |
| SRC-008 | Crunchbase News | Crunchbase News article on Cribl Series E | 2026-05-27 |
This report is a public-evidence diligence snapshot, not investment advice. Important financial, legal, technical, and contractual facts remain non-public and should be verified directly with management and primary documents before any investment decision.