Gravwell

Gravwell is a data fusion platform built for security teams that need to search and correlate data Splunk-style tools struggle with once volume and variety grow past what a fixed schema can absorb. Rather than forcing logs into a predefined format at ingest time, Gravwell stores data in its native form — PCAP, NetFlow, Sysmon, binary telemetry, JSON, even video — and applies structure only when a query runs (schema-on-read). That architecture is the company’s core pitch: unlimited data types and retention without the parsing and normalization bottleneck that drives up cost and slows down investigations in conventional SIEM deployments.

Founded in 2017 and based in Coeur d’Alene, Idaho, Gravwell spent years as a bootstrapped, engineering-heavy shop selling primarily into government, defense, and critical-infrastructure environments that need air-gapped or on-premises deployment options alongside cloud. The company publicized early threat-hunting work at events like SC18’s SCinet, where its platform was used to help a network security team identify and respond to a large-scale DDoS attack in real time. In October 2025, Gravwell closed a $15.4 million Series A led by Two Bear Capital — a notably late first institutional round for a company founded in 2017, suggesting a long capital-efficient build before seeking outside growth capital.

The company competes against both entrenched SIEM incumbents and newer cloud-native log analytics platforms, and its differentiation rests almost entirely on ingest flexibility and query-time processing rather than a large pre-built detection content library. That makes it a fit for security teams with unusual or high-volume data sources (industrial control systems, packet capture, sensor telemetry) who have been burned by SIEM licensing costs tied to data volume, but it also means prospective buyers should weigh Gravwell’s smaller ecosystem and content library against the incumbents it displaces.