Partnering with Scanner: Every Log Tells a Story—If You Can Find It Fast Enough

• Security teams drown in logs they can’t afford to store or search.
  • Typical SIEM retention: 10–30 days; rest sits dark in S3.
  • “Drown in logs we can’t afford to keep” — direct customer quote.
• Scanner: purpose-built log search engine for S3 object storage.
  • Inverted index maps field values to S3 file regions — not row scans.
  • Petabyte-scale queries drop from hours to seconds.
• Founders Cliff Crosland + Steven Wu: Stanford CS, ex-Accompany (acq. Cisco).
  • Built production-scale data infra at Accompany before founding Scanner.
• Customers: Notion, Ramp, Benchling, Confluent, Lemonade.
• MCP tool shipped; ~⅓ of customers in production within weeks.
• AI agents now drive 80% of Scanner queries.
  • Autonomous security investigations replacing hours of human analyst time.

Bogomil Balkansky (Sequoia) · 2026-03-10 · Read on sequoiacap.com