Cribl Buys Tero in Third Deal in Four Months, Targets AI-Agent Telemetry

Cribl announced on November 10, 2026 that it had acquired Tero, a company whose technology identifies low-value observability data. It's the telemetry company's third acquisition in four months, and Tero's founders and engineers are joining Cribl to build observability for two kinds of customers at once: human engineers and AI agents.

Tero's former CEO, CTO and COO — Ben Johnson, Adam Cohen and Nihar Singhal — will help lead Cribl's observability roadmap. Johnson becomes VP of Observability. His team will work on host monitoring, application performance monitoring (APM), federated observability and AI-native observability, all built on the platform customers already use to collect, route and optimize telemetry.

Johnson brings relevant history. He previously co-founded Timber, creator of the open-source Vector observability pipeline. Datadog acquired Timber in 2021.

What does Tero's technology actually do?

Tero measures how much of an organization's telemetry is waste, locates low-value data across observability tools, and lets engineers address it inside the tools they already use. That plugs a gap in Cribl's existing work: collection and routing now gain a data-value decision layer, where teams determine which telemetry merits retention and analysis.

Johnson said flexible routing had not eliminated the cost of retaining and querying telemetry that went unread. Knowing which data is useful depends on understanding how services connect, what changed, and which signals engineers consult during incidents. That knowledge is often undocumented and lives in engineers' heads.

It works when a human runs the investigation. The arrangement breaks down, Johnson argued, when an AI agent conducts it instead.

Why do AI agents change the architecture?

Johnson describes AI agents as emerging primary consumers of production data alongside engineers — and both groups need the same two things: the underlying data and the context to interpret it.

His example: an agent investigating a latency spike must connect the symptom to a deployment from an hour earlier, trace the code change behind that deployment, and identify a downstream service that started timing out. Separate observability products can restrict the evidence available to that investigation.

The proposed answer is a shared foundation. Production understanding gets maintained once, as a resource for both engineers and agents. Host monitoring and APM continue as applications on top of that foundation, rather than independent product stores duplicating the same telemetry.

Johnson, his co-founders and founding engineer Jacob Aronoff are bringing Tero's work on agent access and production understanding to Cribl.

What is 'agentic telemetry'?

Cribl CEO Clint Sharp defined the term in a July 28, 2026 post: telemetry managed for people and AI agents together. The approach combines human, machine and AI context so authorized users can query data where it resides.

Federated search — or search-in-place — brings queries to data in lakes, object storage, lakehouses and existing tools, rather than first centralizing the data. Agent access also requires identity, role-based access control, audit, lineage, budget controls, and human inspection of queries and actions.

"Models will change. Agents will change. Interfaces will change. Your telemetry is the durable asset," Sharp wrote.

How does this fit Cribl's acquisition streak?

The Tero deal follows two others in quick succession: CardinalOps in July 2026, and Radiant Security's AI security operations center technology in August 2026. Cribl says these acquisitions extend its business toward first-party observability and security capabilities on one open telemetry platform.

Tero specifically adds expertise in three areas: data value, production context, and agent access. The planned monitoring work would put more first-party applications on that shared foundation.

The central test, per the company's own framing, is whether Cribl can give authorized agents broad access to usable production evidence — without recreating the isolated data stores and ungoverned access its architecture is designed to avoid.