Cribl acquired Tero on November 10, 2026, gaining technology that identifies low-value observability data and bringing its founders and engineers in-house. The founders will develop observability for engineers and AI agents on the platform customers use to collect, route and optimize telemetry. The deal is Cribl's third acquisition in four months, which matters because it shifts the company toward first-party observability applications.
Tero team and technology join Cribl roadmap
Ben Johnson, Adam Cohen and Nihar Singhal, formerly Tero's CEO, CTO and COO, will help lead Cribl's observability roadmap. Johnson becomes VP of Observability, with work planned on host monitoring, application performance monitoring, federated observability and AI-native observability. Johnson previously co-founded Timber, creator of the open-source Vector observability pipeline, which Datadog acquired in 2021. Founding engineer Jacob Aronoff is also moving to Cribl with the Tero work on agent access.
Tero's technology measures how much of an organization's telemetry is waste and locates low-value data across observability tools. Engineers can address that data within their existing tools rather than switching systems to act. The capability adds a retention decision to Cribl's collection and routing: teams must determine which telemetry merits retention and analysis. Johnson said flexible routing had not removed the cost of retaining and querying telemetry that went unread.
Useful data depends on knowing how services connect, what changed and which signals engineers consult during incidents. That knowledge is often undocumented and held by engineers, and it can guide a human investigation. The arrangement breaks down when an AI agent conducts the investigation without the same context. Johnson describes AI agents as emerging primary consumers of production data alongside engineers, with both groups needing data and context to interpret it.
What shared observability means for operations
For companies running production systems, the proposed architecture maintains production understanding once as a shared resource for engineers and agents. Host monitoring and APM would continue as applications on that foundation instead of independent product stores duplicating telemetry. A latency spike example shows the requirement: an agent must link the symptom to a deployment from an hour earlier, the code change behind it and a downstream service timing out. Separate products can restrict the evidence available to that investigation.
The approach carries governance requirements that buyers should verify before granting agents production access. Cribl CEO Clint Sharp defined agentic telemetry in a July 28, 2026 post as telemetry managed for people and AI agents together, combining human, machine and AI context. Federated search brings queries to data in lakes, object storage, lakehouses and existing tools rather than centralizing it first. Agent access also requires identity, role-based access control, audit, lineage, budget controls and human inspection of queries and actions.
The central marker is whether Cribl ships first-party monitoring on a shared foundation without recreating isolated stores and ungoverned access. The deal follows CardinalOps in July 2026 and Radiant Security's AI security operations center technology in August 2026. Cribl says the acquisitions extend its business toward first-party observability and security capabilities on one open telemetry platform. Sharp's formulation frames the test: "Models will change. Agents will change. Interfaces will change. Your telemetry is the durable asset."
