Matano
Matano is a Y Combinator-backed, open-source cloud-native SIEM built as a zero-ops security data lake deployed directly inside a customer's own AWS account, positioned as a low-cost alternative to Splunk and Elastic for security log analytics.
Visit Website ↗ + Add to CompareOverview
Matano provides a security data lake, built on Apache Iceberg, that deploys serverlessly inside a customer’s own AWS account rather than requiring them to ship logs to a third-party-hosted SIEM. It offers detection-as-code written in Python and positions itself as a high-scale, low-cost, zero-ops alternative to traditional SIEM platforms like Splunk and Elastic that carry substantial licensing and operational overhead.
Founded by Samrose Ahmed and Shaeq Ahmed, Matano went through Y Combinator’s Winter 2023 batch, is based in Seattle, Washington, and has released its core platform as open-source software under the Apache 2.0 license.
Innovation Matrix Assessment
As a two-founder team, Matano built and open-sourced a functioning cloud-native SIEM data lake with detection-as-code capabilities within roughly two years of founding.
Removing SIEM licensing cost ceilings and operational overhead directly addresses a well-known pain point that forces many security teams to under-ingest logs relative to what they actually need for detection.
As a very small, two-founder company with no disclosed funding amount or named enterprise customers found, independently verifiable market traction is currently limited.
A customer-account-native, open-source security data lake architecture is a genuine structural departure from SaaS-hosted SIEM platforms, directly challenging the cost and lock-in model of incumbents like Splunk.
No independent, third-party benchmark of detection coverage or query performance was found; effectiveness is currently unverified beyond the open-source project's own documentation.
SIEM cost and scalability pain is a long-standing, worsening problem as log volumes grow, keeping low-cost, customer-owned security data lake architectures strategically relevant.
Why CISOs Should Care
SIEM licensing costs scale punishingly with log volume, often forcing security teams to limit what they ingest and therefore what they can detect; Matano's customer-owned, serverless architecture removes both the cost ceiling and the operational burden of running SIEM infrastructure.
What Makes It Different
Deploying entirely inside the customer's own AWS account, on an open-source Apache Iceberg data lake foundation, is architecturally distinct from SaaS-hosted SIEM platforms, giving customers full data ownership and avoiding vendor data-egress lock-in.
The Matrix Verdict
48/100 — EMERGING / UNRANKED
A small, technically credible open-source SIEM alternative addressing real cost and lock-in pain points in security log analytics; scores are conservative given its very small team and lack of disclosed funding or customer data.
Editorial Note: Claims vs. Verified Findings
YC batch, founders, headquarters, and open-source licensing are independently confirmed via Matano's Y Combinator company page; specific funding amount and customer adoption figures are not disclosed.
Sources
Alternatives to Matano
Wiz
Agentless, graph-based cloud security platform that maps multi-cloud risk end-to-end, now owned by Google after a record $32B…
Chainguard
Provides hardened, minimal, continuously-rebuilt container images and software packages to eliminate vulnerabilities before they reach production.
Microsoft Defender for Cloud
Microsoft's built-in cloud-native application protection platform, unifying CSPM, workload protection, and DevOps security natively across Azure, AWS, and…
Sysdig
The company behind Falco, the CNCF's runtime security standard, offering an eBPF/kernel-level CNAPP built on live syscall-based threat…
Obsidian Security
Obsidian Security provides a SaaS security posture management (SSPM) platform that detects identity-centric threats and misconfigurations across enterprise…
Upwind Security
Fast-growing, venture-backed CNAPP startup combining agentless scanning with eBPF runtime sensors for real-time cloud and AI workload risk…