Cribl Buys Tero to Build Observability for Humans and AI Agents

Cribl announced on November 10, 2026 that it had acquired Tero, a company whose technology identifies low-value observability data. Tero’s founders and engineers are joining Cribl to develop observability for engineers and AI agents, marking the telemetry company’s third acquisition in four months.

Ben Johnson, Adam Cohen and Nihar Singhal, formerly Tero’s CEO, CTO and COO, will help lead Cribl’s observability roadmap. Johnson becomes VP of Observability, with the team working on host monitoring, application performance monitoring (APM), federated observability and AI-native observability on the platform customers already use to collect, route and optimize telemetry. Johnson previously co-founded Timber, creator of the open-source Vector observability pipeline. Datadog acquired Timber in 2021.

Tero’s Focus on Telemetry Value

Tero’s technology measures how much of an organization’s telemetry is waste, locates low-value data across observability tools and lets engineers address it within their existing tools. That adds a data-value decision to Cribl’s collection and routing work: teams also need to determine which telemetry merits retention and analysis.

In Johnson’s account of the acquisition, he said flexible routing had not eliminated the cost of retaining and querying telemetry that went unread. Identifying useful data depends on knowing how services connect, what changed and which signals engineers consult during incidents. That knowledge is often undocumented and held by engineers. It can guide a human investigation, but the arrangement breaks down when an AI agent conducts it.

A Shared Foundation for AI Agents

Johnson describes AI agents as emerging primary consumers of production data alongside engineers, with both groups needing the underlying data and the context to interpret it. His example is an agent investigating a latency spike: it must connect the symptom to a deployment from an hour earlier, the code change behind that deployment and a downstream service that started timing out. Separate observability products can restrict the evidence available to the investigation.

The proposed architecture maintains production understanding once as a shared resource for engineers and agents. Host monitoring and APM would continue as applications on that foundation, rather than independent product stores duplicating the same telemetry. Johnson, his co-founders and founding engineer Jacob Aronoff are bringing Tero’s work on agent access and production understanding to Cribl.

In a July 28, 2026 post on agentic telemetry, Cribl CEO Clint Sharp defined the term as telemetry managed for people and AI agents together. The approach combines human, machine and AI context so authorized users can query data where it resides.

Federated search, or search-in-place, brings queries to data in lakes, object storage, lakehouses and existing tools rather than first centralizing the data. Agent access also requires identity, role-based access control, audit, lineage, budget controls and human inspection of queries and actions. “Models will change. Agents will change. Interfaces will change. Your telemetry is the durable asset,” Sharp wrote.

Cribl’s Acquisition Strategy

The deal follows CardinalOps in July 2026 and Radiant Security’s AI security operations center technology in August 2026. Cribl says these acquisitions extend its business toward first-party observability and security capabilities on one open telemetry platform.

For Cribl, Tero adds expertise in data value, production context and agent access, while the planned monitoring work would put more first-party applications on that shared foundation. The central test is whether Cribl can give authorized agents broad access to usable production evidence without recreating the isolated data stores and ungoverned access its architecture is designed to avoid.