Quick Thoughts on Databricks Acquiring Panther

Research evidence excerpt

Quick Thoughts on Databricks Acquiring Panther

Deutsche Bank

Research

North America Industry Date

Software Cybersecurity 16 June 2026

Quick Thoughts on Databricks Acquiring

Brad Zelnick Panther

Research Analyst

+1-212-250-8563

What's new: This morning, Databricks announced their intention to acquire

Panther, an agentic SOC platform, with undisclosed terms. The acquisition is Nasr Islam

expected to extend the company's security lakehouse product, Lakewatch, which Research Associate

+1-212-250-6174 was released earlier this year. In particular, Panther accelerates Databricks'

agentic SOC vision by adding agentic workflows directly into core SOC workflows

while adding 100+ out-of-the-box integrations.

Our take: Assuming deal closure, Panther undoubtedly enhances Databricks'

standing within the next-gen SIEM/agentic SOC market by addressing some

notable product gaps (i.e., agentic workflows, improved correlation). Greater

automation - and perhaps in the future fully autonomous workflows - in particular

has surfaced as a critical demand from customers during our fieldwork. On the

surface, combining Databricks' cost-effective data lakehouse with Panther's

correlation, detection, and orchestration capabilities puts the updated Lakewatch

product in more direct competition with the leading agentic SOC tools from the

likes of MSFT, PANW, CRWD, GOOG, and S1. In particular, we suspect this

solution will be particularly interesting to customers with multi-cloud

environments and those with extensive cyber vendor sprawl (i.e., no clear center

of data gravity within their security stack).

That said, established cyber platforms retain a natural advantage in being present

in-line, within the enforcement layer (i.e., EDR/XDR, SSE), thus natively owning