Cribl is building APM and host monitoring onto the platform that already carries its customers' telemetry
Cribl acquires Tero, bringing Vector co-creator Ben Johnson's team to build APM, host monitoring and AI-native observability on its telemetry platform.
Cribl acquires Tero, a startup that measures how much observability data is waste, to build host monitoring and application performance monitoring (APM) on the platform where its customers already route telemetry. The deal, announced in San Francisco on November 10, 2026, brings in Vector co-creator Ben Johnson and his engineers.
Key points
- Cribl announced on November 10, 2026 that it has acquired Tero, and Tero's three co-founders, Ben Johnson, Adam Cohen and Nihar Singhal, are moving to Cribl with their engineers.
- Johnson, now Cribl's VP of Observability, co-founded Timber, the maker of the open source Vector pipeline, which Datadog acquired in 2021.
- Cribl says the team will help lead its roadmap for host monitoring, APM, federated observability and AI-native observability.
- Tero is Cribl's third acquisition in four months, after CardinalOps in July and Radiant Security's AI SOC technology in August.
- In Grafana Labs' Observability Survey 2026, 65% of 1,363 respondents named cost as an important factor in choosing observability tools, the most common answer.
What does Cribl get as it acquires Tero?
It gets a team that built software to find the telemetry nobody needs, led by an engineer Cribl's CEO says has spent a decade helping engineers control their data. According to Cribl, Tero's technology measures what share of an organization's telemetry is waste, points out low-value data across its observability tools, and lets engineers correct it inside the tools they run today.
That is a problem the people who pay for observability already feel. In Grafana Labs' Observability Survey 2026, cost was the most cited tool selection criterion, at 65%, and signal-to-noise was among the top three concerns, at 34%, just behind complexity at 38%.
Johnson ran Tero as CEO, with Adam Cohen as CTO and Nihar Singhal as COO. Before that he was co-founder and CTO of Timber Technologies, which Datadog bought in February 2021 and described at the time as the developer of Vector, a vendor-agnostic observability data pipeline.
We started Tero to help engineers understand their telemetry, not just collect more of it. Watching what Cribl was shipping, it became clear we could either compete with them or build it together.
— Ben Johnson, VP of Observability, Cribl
What will the Tero team build at Cribl?
It will build monitoring that runs on Cribl's own platform rather than in a separate product. Cribl says the team will help lead its work on host monitoring, APM, federated observability and AI-native observability, and put those on the platform where customers already gather, route and trim their telemetry.
Now he and his team will help us take the next step, building observability directly on the platform our customers already trust with their data, for engineers and the AI agents working alongside them.
— Clint Sharp, co-founder and CEO, Cribl
In a post on Cribl's blog, Johnson argues that when observability is split by product line, an AI agent investigating an incident can only reach the evidence those products hold. He writes that dashboards and monitors should be applications on one shared foundation that belongs to the customer, not separate silos each holding its own copy of the data.
How does Tero fit Cribl's other acquisitions this year?
It is the third deal in four months. Cribl bought CardinalOps in July and Radiant Security's AI SOC technology in August, and says the three together move it toward its own observability and security capabilities on one open telemetry platform. The company says that platform already powers its own SIEM, observability and AI SOC products, and that half of the Fortune 100 trust it.
What does the Tero deal mean for platform and SRE teams?
Our analysis: for teams that already send logs and metrics through Cribl, the plan points to monitoring built on the data they route today, rather than another tool with another copy of it; Cribl says its platform lets customers send data anywhere without paying to store it twice. Tero's focus on low-value data speaks to the cost and signal-to-noise worries practitioners report in Grafana Labs' survey. Cribl also names AI agents, alongside engineers, as the users of what it builds, part of the wider impact of AI on software development. For the case for watching systems before they fail, see our Q&A on how proactive system monitoring can avert major issues.
Frequently asked questions
Who leads observability at Cribl now?
Ben Johnson, Tero's co-founder and CEO, has joined Cribl as VP of Observability, according to the announcement.
What is Vector?
Vector is an open source tool for building observability data pipelines. It was created by Timber, which Johnson co-founded, and Datadog acquired Timber in 2021.
What is Cribl?
Cribl calls itself the AI Platform for Telemetry: one shared platform for IT and security data that runs its own SIEM, observability and AI SOC products, as well as tools customers and their AI agents build on it.
When was Cribl founded?
Cribl was founded in 2018. It is remote-first and has an office in San Francisco.
Sources
- Cribl Acquires Tero to Lead Observability Into the AI Era: press release from Cribl via GlobeNewswire, 10 November 2026.
- Why Tero is joining Cribl: Ben Johnson on Cribl's blog, 10 November 2026.
- Datadog Acquires Timber Technologies: Datadog press release, 11 February 2021.
- Observability Survey 2026: Grafana Labs' annual survey of 1,363 practitioners, conducted October 2025 to January 2026.
- Tero: Tero's website.
- Vector: the Vector project's website.