Databricks' Ali Ghodsi on AI Automation at RSAC2026

Looking forward to hearing Ali Ghodsi's keynote at #RSAC2026! We believe modern security is, at its core, a large-scale data and automation challenge. That's why I'm meeting with our AI-native customers about building scalable, agent-first security architectures on the #Lakehouse with Databricks. DM me to set up a conversation with our CISO and security architects behind this project.

Cybersecurity is a big data domain. And Databricks/Apache Spark are really natural tools to handle cybersecurity workloads... I really came to Apache Spark more than 10 years ago at McAfee, when we started to handle a lot of cybersecurity data. And every year since then, I've seen more and more workloads moving to Spark/Databricks. P.S. check our industry solutions page for cybersecurity: https://lnkd.in/dmVKDND9

Databricks CEO and co-founder Ali Ghodsi is taking the stage at #RSAC2026 to address the most critical challenge in security: the shift from manual operations to machine-scale AI automation. Hear why today's security stack — built for yesterday's data volumes and human-speed threats — is no longer enough. Ali will break down what's coming next and why an open, agent-first architecture is the path forward for CISOs.

Legacy SecOps Architecture: "Filter the logs before we ingest them so we don't blow the SIEM budget." Modern SecOps Architecture: "Ingest 100% of the telemetry into the Lakehouse and let AI agents hunt the threats." The mean time for an attacker to exploit a vulnerability has collapsed to under two days. Human-speed responses to machine-speed threats no longer work. Databricks just addressed this bottleneck with Lakewatch. Instead of bolting AI onto a closed, expensive SIEM, they’ve moved the SIEM to the Lakehouse. The architectural impact: 1. Zero Ingestion Tax: Decoupled storage means you don't pay a premium just to retain your logs. 2. Open Standards: Data is natively stored in OCSF formats and governed by Unity Catalog. 3. Agentic Defense: Embedded AI translates complex threat-hunting into natural language and automates response. At C5i , we’re actively running POCs with this tech, helping organizations realize that security isn't a separate silo anymore—it’s a data problem. The evolution from physical perimeters to agent-driven intelligence is here. #SystemsArchitecture #Databricks #Cybersecurity #Lakewatch #DataIntelligence #Modernization #C5i

Two platforms that 95% of the Fortune 500 already rely on — one webinar. Anaconda & Snowflake sat down to talk about something that doesn't get enough attention in enterprise AI: what happens between model development and production deployment. If your team is navigating open source security, scaling AI initiatives, or trying to reduce technical debt, this conversation is directly relevant to the challenges you're solving right now. Watch on demand: https://bit.ly/3MLujfo

We just created the GitHub organisation for Bawbel — the agentic AI security platform built around the AVE (Agentic Vulnerability Enumeration) standard and PiranhaDB threat intelligence database. If you work in DevSecOps, AI security, or are deploying AI agents in production — I would love to hear from you. What does your current process look like for governing AI skills, MCP servers, or system prompts before they reach production? github.com/bawbel bawbel.io #AISecrity #DevSecOps #AgenticAI #MCP #LLMSecurity

Databricks' acquisition of Antimatter and SiftD.ai is not just M&A news, but a sign that security is becoming a data platform battle. Alongside the deals, Databricks launched Lakewatch, which it describes as an open, agentic SIEM. Its pitch is telling: open architecture, large-scale telemetry, AI-driven hunting, detection as code, and governance sitting natively in the platform. Databricks says Antimatter adds secure authentication and authorisation for AI agents, while SiftD.ai brings detection engineering and threat analytics expertise. The important point isn't that AI is being added to security, rather that security itself is being re-architected around data gravity, governance, and agentic workflows.

Databricks launched Lakewatch last week. A SIEM on the Lakehouse. Real detection rules, AI triage, OCSF normalization, all running on Delta tables. It's a serious product. And it has a blind spot. Lakewatch processes the data that arrives. It has no concept of what should arrive. If 47 endpoints stop sending EDR telemetry after a bad Windows update, Lakewatch just has fewer events to analyze. No alert fires. No dashboard turns red. The pipeline is green. The detections are running. And you're completely blind on 47 machines. This is the gap SilentPulse fills. We monitor the pipeline itself, per asset, per source, per hop. When something goes silent, we catch it before attackers exploit the gap. Today we released v0.1.7 of our Databricks integration with streaming support: - foreachBatch telemetry - full per-asset heartbeat, volume, completeness, and freshness from streaming pipelines - PySpark DataSource - read SilentPulse alerts, flows, and coverage with spark.read.format("silentpulse") - Metric Views - governed KPIs for blind spot hours, silent feeds, detection coverage - AI Functions - ai_classify for root cause analysis, ai_summarize for executive briefings - Native SDP pipeline support with dp.foreach_batch_sink Full walkthrough with real data, a real failure simulation, and every screenshot: https://lnkd.in/dmQ3PAxs Open source (Apache 2.0): https://lnkd.in/d4r2FYpq Lakewatch detects threats. SilentPulse makes sure the data reaches Lakewatch in the first place. #databricks #lakewatch #security #siem #silentpulse #pyspark #observability https://lnkd.in/dhZw-zeu

Databricks just dropped Lakewatch - an agentic SIEM built on the lakehouse. AI triage, Detection-as-Code, unified security telemetry. Really excited to see this space moving forward. And honestly? It makes what we're building at SilentPulse even more relevant. Here's the thing. A SIEM processes what arrives. But it has zero concept of what should arrive. If 47 endpoints go quiet after a bad Windows update, your SIEM just sees fewer events. No alert fires. You're blind and you don't even know it. That's the missing piece. And we've got it. SilentPulse watches the pipeline itself. Every asset, every hop, every data source. If something goes silent, you know before the attacker does. We just shipped an open-source Databricks integration - decorators for SDP pipelines, streaming telemetry, PySpark DataSource, Unity Catalog discovery. All Apache 2.0. The really cool part? You can cross-reference Lakewatch detections with SilentPulse visibility data right inside Databricks. "Was this threat caught despite degraded telemetry? Or are there hosts where attacks could be hiding because the data never made it?" Built after hours by a group of friends who've spent years in security and data engineering and got tired of the same blind spots showing up everywhere. No VC, no big team. Just people who know the problem because they've lived it. Lakewatch + SilentPulse. Detection + visibility. The full picture. More in our blog post below and 🥩 on my personal blog: https://lnkd.in/dfgtEinc #databricks #lakewatch #cybersecurity #siem #opensource #securityoperations #silentpulse

Databricks Launches Lakewatch AI Platform to Disrupt SIEM Market 📌 Databricks launches Lakewatch, an AI-powered, open-agentic SIEM platform that flips the game by charging for computational work-not data storage-making it a radical disruption to traditional security pricing. Designed to handle petabytes of multi-modal telemetry without vendor lock-in, Lakewatch unifies security, IT, and business data to beat AI-driven attackers with speed and autonomy. 🔗 Read more: https://lnkd.in/dVsXv4b9 #Databricks #Lakewatch #Siem #Agenticsecurity #Aithreats