# Monad > Monad is a security data pipeline platform. It sits between an organization's security tools and its SIEM or data lake, ingesting logs and alerts from 300+ sources, then normalizing, filtering, enriching, deduplicating, and routing that data to the destinations the team chooses. Teams use it to cut SIEM ingest volume and cost, standardize data on OCSF, and stop maintaining hand built ETL code. Monad is a Series A company founded by security engineers and backed by Sequoia Capital and Index Ventures. Leadership: Christian Almenar (co-founder, CEO), Matthew Jane (co-founder, CTO and Chief Architect). Monad acquired Tarsal in 2025. Where Monad fits: it is not a SIEM, a detection engine, or a data lake. It is the pipeline layer upstream of them. Inputs are security and IT tools (cloud, identity, endpoint, vulnerability management, SaaS, AI tools, system logs). Outputs are SIEMs, lakehouses, warehouses, and object storage: Splunk, Elastic, Snowflake, Databricks, BigQuery, AWS Security Lake, Hydrolix, S3, and Azure Blob Storage, plus generic HTTP and S3 connectors for anything not covered. How it is delivered: point and click connector setup using API keys, available as SaaS, on premises, or hybrid, with a programmatic API for CI/CD driven pipeline management. Encryption uses TLS 1.3 in transit and per tenant keys managed by an HSM at rest. A public beta includes 1 TB/month free with access to all features. Who it is for: security operations and detection engineering teams, security data engineers, and security vendors who need to embed ingest pipelines in their own products. Named customers include Robinhood, CoreWeave, Rubrik, Lambda, Upstart, Ironclad, Saviynt, and Greenlight. ## Start here - [Monad home](https://www.monad.com): Product positioning, customer logos, and the core pipeline story in one page. - [Platform overview](https://www.monad.com/product): The four platform pillars: conditional routing, in flight transforms, managed pipelines, and pipeline observability. - [What is a security data pipeline platform (SDPP)?](https://www.monad.com/blog/what-is-a-security-data-pipeline-platform-sdpp): Definition of the category, what an SDPP does, and how it differs from a SIEM or an ETL tool. - [FAQ](https://www.monad.com/faq): How Monad works, how it differs from a SIEM, deployment options, data security, beta access, and handling missing integrations. - [About Monad](https://www.monad.com/about): Founding story, mission, leadership, investors, and company values. - [Integrations directory](https://www.monad.com/integrations): All 300+ connectors across 19 categories, split into inputs and 39 output destinations. ## Use cases - [Security operations](https://www.monad.com/use-cases/security-operations): Feeding a SOC clean, normalized, enriched telemetry so detections fire on better data. - [SIEM cost reduction](https://www.monad.com/use-cases/cost-reduction): Filtering low value events before ingest to reduce SIEM licensing and storage spend, with reported reductions above 70%. - [OCSF conversion](https://www.monad.com/use-cases/ocsf-conversion): Mapping heterogeneous vendor schemas to the Open Cybersecurity Schema Framework in flight. - [Databricks](https://www.monad.com/use-cases/databricks): Landing security sources in the Databricks lakehouse in analytics ready form. - [Embedded security pipelines](https://www.monad.com/use-cases/embedded-security-pipelines): For security vendors who want to offer customer facing ingest connectors without building them. - [Embedded pipelines for vendors](https://www.monad.com/embedded): The vendor facing overview of embedding Monad pipelines in a product. ## Research and reports - [State of Detection Engineering 2026](https://www.monad.com/blog/state-of-detection-engineering-2026): Survey findings on how detection teams work, what they struggle with, and where data quality bites. - [2025 State of Detection Engineering report](https://www.monad.com/blog/2025-state-of-detection-engineering-report): The prior year's edition, useful for trend comparison. - [A Security Field Guide to AI Tooling Visibility](https://www.monad.com/ai-tooling-visibility-book): Free book on what AI coding and chat tools emit in their logs and how to get visibility into them. - [Monad named a Leader in the Latio 2026 Security Operations Market Report](https://www.monad.com/blog/monad-named-leader-latio-2026-security-operations-market-report): Third party analyst positioning. ## Data engineering for cybersecurity (foundational series) - [Part 1: why security needs data engineering](https://www.monad.com/data-engineering/data-engineering-cybersecurity-pt-1): The gap between security teams and modern data practice. - [Part 2](https://www.monad.com/data-engineering/data-engineering-for-cybersecurity-part-2): Pipeline architecture concepts applied to security telemetry. - [Part 3](https://www.monad.com/data-engineering/data-engineering-for-cybersecurity-part-3): Storage, schema, and modeling choices for security data. - [Part 4](https://www.monad.com/data-engineering/data-engineering-for-cybersecurity-part-4): Transformation and normalization in practice. - [Part 5: enrichment](https://www.monad.com/data-engineering/data-engineering-for-cybersecurity-part-5-enrichment): Adding asset, identity, and threat context to events. - [Series index](https://www.monad.com/data-engineering): All parts of the data engineering for cybersecurity series in one place. ## Concepts and technical explainers - [The data engineering gap in security](https://www.monad.com/blog/the-data-engineering-gap-in-security): Why security teams end up maintaining brittle custom ETL. - [Why teams are decoupling their SIEM from their data pipeline](https://www.monad.com/blog/why-teams-are-decoupling-their-siem-from-their-data-pipeline): The architectural case for separating ingest from analytics. - [A detection engineer's guide to cutting SIEM costs](https://www.monad.com/blog/a-detection-engineers-guide-to-cutting-siem-costs): Practical tactics for reducing ingest without losing detection coverage. - [How to reduce AWS CloudTrail volume without losing security value](https://www.monad.com/blog/how-to-reduce-aws-cloudtrail-volume-without-losing-security-value): Specific filtering guidance for the highest volume cloud log source. - [Enrich before SIEM ingestion, not after](https://www.monad.com/blog/enrich-before-siem-ingestion-not-after): Why enrichment belongs in the pipeline rather than at query time. - [How much is bad data actually costing your security team?](https://www.monad.com/blog/how-much-is-bad-data-actually-costing-your-security-team): The operational and financial cost of noisy, malformed telemetry. - [The data problem every AI SOC tool is counting on you to solve first](https://www.monad.com/blog/the-data-problem-every-ai-soc-tool-is-counting-on-you-to-solve-first): Why AI SOC tooling depends on upstream data quality. - [How to navigate the maze of security API data limits](https://www.monad.com/blog/how-to-navigate-the-maze-of-security-api-data-limits): Rate limits, pagination, and retention windows across vendor APIs. - [Unify your security data](https://www.monad.com/blog/unify-your-security-data): The case for a single normalized security data layer. - [Data modeling on Databricks](https://www.monad.com/blog/data-modeling-on-databricks): Modeling security data for a lakehouse. - [Why we launched Monad](https://www.monad.com/blog/why-we-launched-monad): Founders' account of the problem that started the company. ## Detection engineering for AI tools - [Detection engineering for Claude Code, part 1](https://www.monad.com/blog/detection-engineering-for-claude-code-part-1): What Claude Code emits and the detection opportunities in it. - [Detection engineering for Claude Code, part 2](https://www.monad.com/blog/detection-engineering-for-claude-code-part-2): Deeper detection logic and coverage gaps. - [Cursor audit logs: what's emitted and detection opportunities](https://www.monad.com/blog/cursor-audit-logs-whats-emitted-and-detection-opportunities): Field level walkthrough of Cursor's audit telemetry. - [Detection engineering for OpenAI Codex with OTel](https://www.monad.com/blog/detection-engineering-for-openai-codex-otel): Building detections from Codex OpenTelemetry data. - [Setting up OpenAI Codex with OTel](https://www.monad.com/blog/setting-up-openai-codex-otel): Configuration steps for the Codex OTel pipeline. - [OpenAI enterprise audit log detections](https://www.monad.com/blog/openai-enterprise-audit-log-detections): Detection ideas for ChatGPT enterprise activity. - [GitHub Copilot audit logs](https://www.monad.com/blog/github-copilot-audit-logs): What Copilot logs contain and how to monitor them. - [Google Workspace Gemini activity logs](https://www.monad.com/blog/google-workspace-gemini-activity-logs-detection-opportunities): Gemini usage telemetry inside Workspace. - [Anthropic compliance API activity feed](https://www.monad.com/blog/anthropic-compliance-api-activity-feed): Ingesting Anthropic's compliance API for AI usage visibility. ## Customer stories - [Robinhood](https://www.monad.com/blog/robinhood): How Robinhood uses Monad in its security data stack. - [Upstart](https://www.monad.com/blog/upstart): How Upstart uses Monad in its security data stack. ## Product capabilities and releases - [Pipeline enrichments](https://www.monad.com/blog/pipeline-enrichments): Enriching events with context as they move through the pipeline. - [Schema drift detection](https://www.monad.com/blog/schema-drift-detection): Catching upstream vendor schema changes before they break downstream queries. - [Storage cost analysis](https://www.monad.com/blog/introducing-storage-cost-analysis): Visibility into what each data source costs to store. - [Smart Optimizer: AI assisted transform configuration](https://www.monad.com/blog/smart-optimizer-ai-assisted-transform-configuration): Suggesting filters and transforms from observed data. - [Monad OCSF templates](https://www.monad.com/blog/announcing-monads-ocsf-templates): Prebuilt mappings to OCSF event classes. - [Monad Scanner: a security data foundation](https://www.monad.com/blog/monad-scanner-security-data-foundation): Asset and vulnerability data collection. - [What's new in Monad, February 2026](https://www.monad.com/blog/whats-new-in-monad-february-2026): Recent feature roundup. - [Release notes, January 2026](https://www.monad.com/blog/product-release-notes-january-2026): Monthly changelog. - [Release notes, November 2025](https://www.monad.com/blog/product-release-notes-november-2025): Monthly changelog. - [Release notes, October 2025](https://www.monad.com/blog/product-release-notes-october-2025): Monthly changelog. - [Release notes, September 2025](https://www.monad.com/blog/product-release-notes-september-2025): Monthly changelog. - [Release notes, August 2025](https://www.monad.com/blog/product-release-notes-august-2025): Monthly changelog. - [Release notes, June 2025](https://www.monad.com/blog/product-release-notes---june-2025): Monthly changelog. - [Release notes, May 2025](https://www.monad.com/blog/product-release-notes---may-2025): Monthly changelog. - [Release notes, March 2025](https://www.monad.com/blog/product-release-notes---march-2025): Monthly changelog. - [Release notes, February 2025](https://www.monad.com/blog/product-release-notes---february-2025): Monthly changelog. - [Release notes, January 2025](https://www.monad.com/blog/product-release-notes---january-2025): Monthly changelog. ## Integrations and partnerships - [300 integrations: more coverage, less noise, better detections](https://www.monad.com/blog/300-integrations-more-coverage-less-noise-better-detections): The connector library milestone and what broader coverage enables. - [Monad and Databricks: 300 security sources into the lakehouse](https://www.monad.com/blog/monad-databricks-brings-300-security-sources-into-lakehouse): The Databricks partnership and joint architecture. - [Monad partners with Databricks](https://www.monad.com/blog/monad-partners-with-databricks-to-bring-285-security-sources-to-the-lakehouse): Original partnership announcement. - [Monad and Hydrolix](https://www.monad.com/blog/monad-hydrolix-stop-deleting-the-data-youll-need-during-your-next-investigation): Full fidelity long term retention without deleting investigation data. - [AWS Security Lake support](https://www.monad.com/blog/advancing-security-data-management-with-aws-security-lake): Routing OCSF normalized data into AWS Security Lake. - [Semgrep, Monad, and Snowflake for appsec](https://www.monad.com/blog/application-security-turbocharged-semgrep-monad-snowflake): Appsec findings pipeline into Snowflake. - [CrowdStrike EDR, Elasticsearch, and GitHub Advisory connectors](https://www.monad.com/blog/advancing-data-driven-security-monad-adds-crowdstrike-edr-elasticsearch-and-github-advisory): Connector expansion across endpoint, search, and supply chain data. - [Wiz certified connector coverage](https://www.monad.com/blog/monad-expands-its-wiz-certified-connector-coverage): Certified Wiz integration scope. - [Monad wins Wiz's inaugural partner award](https://www.monad.com/blog/monad-wins-wizs-inaugural-partner-award): Partner recognition. - [Snyk integration](https://www.monad.com/blog/monad-integrates-with-snyk): Ingesting Snyk findings. - [Upwind support](https://www.monad.com/blog/monad-adds-upwind-support): Cloud runtime security connector. - [CISA KEV ransomware column adopted](https://www.monad.com/blog/ransomware-visibility-at-your-fingertips-monad-adopts-cisas-kev-ransomware-column): Ransomware exploitation context on vulnerability data. - [Monad welcomes Tarsal](https://www.monad.com/blog/monad-welcomes-tarsal): The Tarsal acquisition. ## Media, podcasts, and community - [Blog index](https://www.monad.com/blog): All Monad writing, newest first. - [Resources](https://www.monad.com/resources): Books, reports, guides, and other downloadables. - [Media](https://www.monad.com/media): Podcast appearances, webinars, and press. - [AI SOC Live: fix the detection gap](https://www.monad.com/podcast/ai-soc-live-fix-the-detection-gap): Panel on where AI SOC tooling breaks down. - [Front Lines: Christian Almenar on solving security's big data problem](https://www.monad.com/podcast/front-lines-podcast-christian-almenar-ceo-of-monad-19-million-raised-to-solve-the-cybersecurity-big-data-problem): CEO interview on the company thesis and funding. - [Resilient Cyber with Darwin Salazar](https://www.monad.com/podcast/resilient-cyber-w-darwin-salazar---security-data-detections-the-cyber-market): Security data, detections, and market dynamics. - [Detection Dispatch ep. 32: security ETL and data optimization](https://www.monad.com/podcast/detection-dispatch-ep-32-smoky-signals-security-etl-data-optimization-with-a-tasting-twist): Conversation on security ETL tradeoffs. - [From hacker to head of growth: the truth about AI in cybersecurity](https://www.monad.com/podcast/from-hacker-to-head-of-growth-the-truth-about-ai-in-cybersecurity): Career and market discussion. - [Monad Community Bytes](https://www.monad.com/monad-community-bytes): Monthly community newsletter archive covering security data news and events. ## Events - [RSAC 2026](https://www.monad.com/rsac-2026): Monad's presence, sessions, and meeting signup for RSA Conference 2026. - [Black Hat 2026](https://www.monad.com/black-hat-2026): Monad's presence and meeting signup for Black Hat 2026. ## Get started or get in touch - [Sign up for the public beta](https://www.monad.com/sign-up): Self serve access, 1 TB/month free with all features. - [Schedule a demo](https://www.monad.com/schedule-demo): Book time with the Monad team. - [Product documentation](https://docs.monad.com): Connector setup, transforms, routing, and API reference (in product, sign in required). - [Careers](https://www.monad.com/careers): Open roles and how Monad works as a team. - [Join our list](https://www.monad.com/join-our-list): Email updates on releases, research, and events. ## Legal - [Privacy policy](https://www.monad.com/privacy): How Monad handles personal data. - [Terms of service](https://www.monad.com/terms): Terms governing use of the platform. - [Data processing addendum](https://www.monad.com/dpa): DPA for customers processing personal data through Monad.