Brickster Newsletter

Databricks bought a security company. There is still nothing to buy.

The Panther acquisition closed Monday. The product it feeds is an invite-only preview, which makes this a strategy story, not a shopping opportunity.

On Monday, August 3, Databricks completed its acquisition of Panther Labs, a company that makes software for security teams. It is Databricks’ third security purchase in a row, after Antimatter and SiftD.ai, and the terms were not disclosed, so any price you see attached to this deal is somebody’s guess. Panther’s technology feeds a product called Lakewatch, Databricks’ entry into the SIEM (security information and event management) market: in plain words, the software that watches a company’s systems for break-ins.

Here is the part the press release glides past: you cannot buy any of this yet. Lakewatch has been in Private Preview, an invite-only test phase, since March 24, with Adobe and Dropbox as early customers and National Australia Bank among its five design partners. Databricks has not committed a date for broader availability. And as of publication, most trade coverage still reflects the June 16 announcement of the deal rather than this week’s completion, so if this issue is where you heard the news, you are not behind.

The business logic is worth understanding even with nothing to purchase. Today, most companies pay a separate security vendor to store a second copy of their activity data, the Splunk-style model, and that second copy comes with its own bill and its own team. Databricks wants the security data to live where the business data already lives: one copy, one bill, one team. Its announcement criticizes the older model in entirely generic terms, naming no competitor and quoting no prices, so read it as positioning rather than a price sheet. One detail worth saving for your next conversation with a Snowflake rep, though. Panther’s 2021 funding round, $120 million led by the investment firm Coatue at a $1.4 billion valuation, included Snowflake Ventures. Databricks’ chief rival was an early backer of the company Databricks just bought.

THE DEAL

What Databricks bought

Panther Labs makes software that helps security teams spot intrusions. This is Databricks’ third security acquisition, and the price was not disclosed. The $1.4B figure floating around is Panther’s own private valuation from its 2021 funding round, not what Databricks paid.

THE PRODUCT

Lakewatch is invite-only

The product Panther plugs into has been in Private Preview, an invite-only test phase, since March 24. Adobe and Dropbox are early customers; National Australia Bank is one of five design partners. Databricks has committed no date for broader availability. You cannot buy this yet.

THE PITCH

One copy, one bill, one team

The strategy is to stop paying a separate security vendor to store your company’s data twice. Databricks’ criticism of that older model names no competitor and quotes no prices, so treat it as an opening argument, not evidence.

THE IRONY

Snowflake was an early backer

Panther’s 2021 funding round included Snowflake Ventures, the investing arm of Databricks’ chief rival. Snowflake helped fund the company its competitor now owns. No moral here, just a very good trivia answer.

🔗 Resources

→ The completion announcement — Databricks’ own post, published August 3. Read it for the strategy; notice it contains no price and no launch dates.

→ Brickster news feed — We will flag it the day Lakewatch actually goes on sale.

Genie’s free period is over; the first real bill lands this month

Genie is the Databricks assistant that lets people ask data questions in plain English. Its two main products, Genie One and Genie Agents, were free through July 31. August is the first month companies actually pay. Each user keeps a monthly free allowance, worth $10.50 in the US East region (the dollar figure varies by region), but it covers the AI part only; the computing that runs the queries bills separately, so a team can sit inside the free allowance and still get an invoice. Automations, the robot accounts that call Genie on a schedule with no human involved, get no free allowance at all and have been billing since July 8. So has Genie Code, which was never in the free window. Both changes surfaced in release notes rather than a launch post: the free period, and the July 21 corrections that zeroed out earlier Genie One and Genie Agents charges. Two questions for your team this week: are any automations calling Genie, and has anyone opened the August bill?

The 84.5% claim comes with a 28-question asterisk

Databricks’ most quoted number right now, that Genie answers 84.5% of questions correctly on the first attempt against 52.4% for the strongest general-purpose coding agent, comes from an internal Databricks test of just 28 questions, run in June 2026 with the competitors kept anonymous. It is also not new; it comes from the June 16 launch post. Genie may well be a fine product. But a 28-question in-house test is a demo, not independent proof, and the feature it advertises, Genie Ontology, is still labeled “preview.” If the number shows up in a deck at your company, the 28-question qualifier belongs in the same sentence, every time.

One change already landed, one hard deadline, and one “eventually”

All of it comes from Databricks’ own “what’s coming” page. On July 24, the tool engineering teams use to ship their work (Declarative Automation Bundles) switched to a new deployment engine by default, migrating projects still on the old Terraform engine; if your team has not checked, that change has already landed. The old engine will eventually be removed entirely, with no date committed. And on September 14, a change to workspace permissions (the workspace entitlement migration) becomes permanent. That last one has a stage most summaries drop: workspaces that never made a choice were automatically enrolled on July 27, so a decision may already have been made for your company. One short email to your engineering lead covers all of it: “Have we checked the July 24 bundles change, and are we ready for September 14?”

Messy data just got a fully supported home

Companies collect piles of data that never fit neatly into rows and columns: application logs, event streams, the JSON records modern software produces. Databricks’ feature for handling that data, called Variant, is now Generally Available, which is industry-speak for fully supported and safe to rely on in production. Databricks says it reads this data up to 30 times faster than storing it as raw text once a feature called shredding kicks in (about 8 times without); those are the company’s own measurements, so label them that way if you repeat them. The caution, in plain words, is that existing tables do not get the new speed automatically: newly created tables get it, older ones need a manual switch, and the fastest paths need recent software versions, details your engineering team owns. The announcement post is dated August 3; per the release notes, the feature quietly crossed the line back in July.

Quick links this week:

→ brickster.ai/news — The week’s Databricks headlines in one feed, including the Panther close, which most trade coverage had not caught up to as we published.

→ brickster.ai/releases — The release notes, tracked daily. The Genie billing change and this issue’s deadlines surfaced there first, not on the blog.

→ brickster.ai/assistant — Ask in plain English, “what changes in September?”, and get an answer with sources.

🛡️ Wondering what a security lakehouse would mean for your company?

The Brickster Assistant searches our full archive and answers with citations.

Enjoying the Brickster Newsletter?

Forward this to a colleague who works with Databricks.