Cribl buys Tero to build observability for humans and AI agents

By Rebecca Stone

Cribl announced on November 10, 2026, that it had acquired Tero, a company whose technology identifies low-value observability data. The deal is Cribl’s third acquisition in four months.

Tero’s founders and engineers will join Cribl to develop observability for engineers and AI agents. Ben Johnson, Adam Cohen and Nihar Singhal, formerly Tero’s CEO, CTO and COO, respectively, will help lead Cribl’s observability roadmap. Johnson becomes VP of Observability.

Cribl said the team will work on four areas on the platform customers already use to collect, route and optimize telemetry:

• Host monitoring
• Application performance monitoring (APM)
• Federated observability
• AI-native observability

Johnson previously co-founded Timber, creator of the open-source Vector observability pipeline. Datadog acquired Timber in 2021.

The acquisition marks a shift in the scope of Cribl’s product work. Its platform already collects, routes and optimizes telemetry. Tero adds a value judgment at that point in the workflow, while the broader roadmap places first-party monitoring and agent access above the same foundation. Cribl says the goal is to extend the platform without creating isolated stores for each new application.

Why did Cribl acquire Tero?

Tero’s technology measures how much of an organization’s telemetry is waste. It locates low-value data across observability tools and lets engineers address that data within existing tools. Cribl said the acquisition adds a data-value decision to its collection and routing work: teams must determine which telemetry merits retention and analysis.

The deal extends Cribl’s role from collecting and routing telemetry to assessing its value for retention and analysis. Cribl says that step carries cost stakes. Johnson said flexible routing has not eliminated the expense of retaining and querying telemetry that goes unread.

Useful data depends on knowing how services connect, what changed and which signals engineers consult during incidents. Cribl said that context often remains undocumented and held by engineers. It can guide a human investigation, but Johnson said the arrangement breaks down when an AI agent conducts the investigation.

That decision has two sides: cost and investigative usefulness. Johnson said teams need signals connected to service dependencies and incidents, not simply a larger volume of collected data. The combination addresses both low-value telemetry and the context required to act on high-value data.

What changes for AI-agent investigations?

Johnson described AI agents as emerging primary consumers of production data alongside engineers. He said both groups need the underlying data and context required to interpret it. His example was an agent investigating a latency spike.

The agent must connect the symptom to a deployment from an hour earlier, the code change behind that deployment and a downstream service that started timing out. Johnson said separate observability products can restrict the evidence available during that investigation. The required chain spans production history rather than a single monitoring view.

Johnson’s example shows why agent access cannot stop at a single alert. The agent must follow relationships among events and systems that may live under different product boundaries. Cribl’s shared production context is intended to preserve those links once and make them available to human and machine investigators.

The proposed architecture would maintain production understanding once as a shared resource for engineers and agents. Host monitoring and APM would operate as applications on that foundation, rather than independent product stores duplicating the same telemetry. The contrast matters because fragmented stores can divide the evidence required for a cross-system investigation.

Johnson, his co-founders and Tero founding engineer Jacob Aronoff will bring Tero’s work on agent access and production understanding to Cribl. Their assignment joins data-value analysis with the context needed to interpret telemetry during an incident.

How does Cribl plan to govern agent access?

In a July 28, 2026 post on agentic telemetry, Cribl CEO Clint Sharp defined the term as telemetry managed for people and AI agents together. Sharp said the approach combines human, machine and AI context so authorized users can query data where it resides.

Federated search, also called search-in-place, brings queries to data in lakes, object storage, lakehouses and existing tools. The method avoids requiring an organization to centralize the data first. The query travels to the retained information instead, preserving the location of existing production datasets.

Cribl said agent access also requires:

• Identity
• Role-based access control
• Audit
• Lineage
• Budget controls
• Human inspection of queries and actions

The combination addresses both location and authority. Sharp said authorized users query data where it resides; Cribl then lists the controls required before agents can use that access. The list covers permission, traceability, spending and oversight as parts of the same agent-access model.

“Models will change. Agents will change. Interfaces will change. Your telemetry is the durable asset,” Sharp wrote.

Where does Tero fit in Cribl’s acquisition strategy?

The Tero deal follows CardinalOps in July 2026 and Radiant Security’s AI security operations center technology in August 2026. Cribl says the three acquisitions extend the business toward first-party observability and security capabilities on one open telemetry platform. The sequence moves the company beyond its established role in collection and routing.

Tero adds expertise in data value, production context and agent access. At the same time, the planned monitoring work would place more first-party applications on the shared telemetry foundation. Cribl’s strategy now links those additions to a common architecture rather than separate product stores.

Cribl identified the central test: whether the company can give authorized agents broad access to usable production evidence without recreating the isolated data stores and ungoverned access that its architecture aims to avoid. That test links product breadth to control over production telemetry.

Cribl’s next test is operational: show that authorized agents can use broad production evidence across existing stores while preserving identity, audit, lineage, budget limits and human inspection.