Scanner Reviews & Product Details

Scanner is a radically different way to detect threats in security data. Most security teams run a SIEM at the center of their stack. But SIEMs price on ingestion volume and cap retention at around 30 days, which forces a painful tradeoff: teams end up diverting 95% of their log data to object storage like S3 just to keep costs manageable. The result is a SIEM that covers a thin slice of your environment and a data lake full of logs no one can practically search or run detections against. Scanner works differently at every layer. Storage: We index semi-structured and unstructured log data directly in your S3 buckets. No ingestion pipelines, no re-ingestion, no schema work. Your data stays where it is. Detection: Logs stream into a numerically efficient cache where detections run continuously. There's no batch job, no scheduled query scanning your entire dataset. Detections operate on the stream itself. Investigation: When an analyst or agent runs a query, Scanner spins up short-lived compute that exists only for the duration of that query and then disappears. The indexes narrow the search space by orders of magnitude before any data is read, so even petabyte-scale queries resolve in seconds. Query compute is active less than 1% of the day. The rest of the time, it doesn't exist. The result is a system where petabytes of security data are searchable in seconds, detections run continuously, and costs scale with actual usage rather than data volume. Today, AI agents are Scanner's most prolific users, investigating alerts and hunting threats around the clock. Teams at Notion, Ramp, and Benchling use Scanner as their core security data layer.

Product Website

Seller

Scanner

Discussions

Scanner Community

Overview by

Alex LeBeouf

Pricing

Pricing provided by Scanner.

Multi-Tenant Managed Scanner

Contact Us

500 GB

View More Pricing Information

Scanner Media

Scanner Demo - The Security Data Layer for the Era of Agents

Visibility across all your logs—not just what fits in a SIEM. Search and detect across petabytes in seconds, directly in your object storage. Built for AI agents and modern security teams

Build Your Security Data Lake in Hours. Connect dozens of log sources with zero custom code. Transform and enrich your data during ingestion. Store everything in your own S3 buckets with complete data ownership.

Search Petabytes in Seconds. Full-text search across years of security logs in seconds, not hours. Inverted indexes and serverless execution make iterative investigation actually possible.

Run Hundreds of Detection Rules at Scale. Streaming detection engine runs hundreds of rules simultaneously without scanning the same data repeatedly. Start with 400+ out-of-the-box rules or write custom detections as code.

Built for the AI Security Era. Traditional SIEMs can't handle AI workloads. Queries are too slow and too expensive for agents to explore freely. Scanner is the only security data lake with the speed and economics to make AI-driven security actually viable.

This is MCP & SecOps Agents on Scanner. Watch us run security workflows with AI: 50+ queries across 100TB of data, a full year of logs - each completing in seconds. In Athena, a single query on the same data took 10+ minutes.

This is Search & Investigate on Scanner. Watch us query 3 years of CloudTrail data (350TB) and get results in 25 seconds. In Athena, this would take 6 hours and cost hundreds of dollars.

Official Downloads

(2)

edit

Building Your First AI SOC Agents: Foundations & Your First Agent

Our Test of AI in the SOC Proves Humans and AI Are Better Together

G2 reviews are authentic and verified.

Here's how.

GE

Gilberto E.

Security Engineer

Mid-Market (51-1000 emp.)

2/19/2026

"Seamless Integration and Fast Results"

4/5

What do you like best about Scanner?

The flexibility in log ingestion. When dealing with a SIEM or any search tool, the easiness and ability to get data ingested is top priority. I like how Scanner allows ingestion straight from AWS S3 buckets, which just adds to the flexibility of getting data in, quick, easy and start querying.

Secondly, the speed of querying is surprising. I have only seen this speed in a couple of other products, but within Scanner it's a huge plus aside from the ease of log ingestion. Getting the data in, and then quickly querying data is what makes Scanner great for teams. Review collected by and hosted on G2.com.

What do you dislike about Scanner?

Currently the only downside I see within Scanner, is the early stage that it is in. While I do see it as a disruptor in the space, it is still changing and being updated that can make it difficult for a team that just wants a drop in replacement of a tool.

Last thing I would mention is the lack of more complex query language. While I know that this is being improved on and changing, currently it can be seen as a downside if teams are looking for a direct replacement. Review collected by and hosted on G2.com.

What problems is Scanner solving and how is that benefiting you?

It was a drop in replacement of our previous search tool. Not only that but the integration was seamless, and allows for our team to quickly get in and search during need. While we had a pretty large timeframe to get it integrated, we were amazed at how fast we integrated it, got data onboarded and it was ready to go. Having a centralized place with all of our logs finally, makes it useful and supports our maturity as a security organization. Review collected by and hosted on G2.com.

UC

Verified User in Computer & Network Security

Small-Business (50 or fewer emp.)

2/19/2026

"Fast, Powerful Log Search in Your Own S3—Plus Detection Rules as Code"

5/5

What do you like best about Scanner?

Scanner is one of those products that makes you wonder why everyone else made this so complicated. Logs stay in your S3 buckets, Scanner indexes them and makes them searchable. No shipping data to a vendor's environment, no surprise ingestion bills, no waiting forever for a query to come back. The search speed is genuinely impressive and the full text search across schema-less data is a huge deal because in the real world your logs are messy and you don't always know what field you're looking for. Detection rules as code through GitHub is exactly how detection engineering should work in 2026 and that workflow alone puts it ahead of platforms where you're clicking through a UI to build rules one at a time. Review collected by and hosted on G2.com.

What do you dislike about Scanner?

The biggest gap right now is that Scanner only supports AWS for its underlying infrastructure. If your organization runs on Google Cloud or Azure you're out of luck for the time being. They've indicated multi-cloud support is on the roadmap but as of today it's an AWS-only play. That's not a dealbreaker if you're already in AWS but it does limit who can realistically adopt it. Review collected by and hosted on G2.com.

What problems is Scanner solving and how is that benefiting you?

Scanner solves the two biggest problems in security log management: cost and speed. Traditional SIEMs make you choose between retaining the logs you need and staying within budget, so teams end up cutting log sources or shortening retention windows just to keep costs manageable. That creates blind spots. Scanner eliminates that tradeoff because your logs just sit in S3 at S3 prices and you can keep everything for as long as you need to. On the speed side, being able to search across months of data in seconds completely changes how you approach investigations and threat hunting. You're not scoping your queries down to tiny time windows just to get results back in a reasonable amount of time anymore. You actually get to do the work. Review collected by and hosted on G2.com.

NO

Nick O.

2/19/2026

"Lightning-Fast Data Indexing with Seamless AI Integration"

5/5

What do you like best about Scanner?

I really like the massive scale and efficiency of Scanner as it can ingest and index tens of terabytes of data rapidly. The cost-to-performance ratio is a significant advantage. Another great aspect is the simplified ingestion; creating a pipeline is effortless by just dropping raw data into an AWS S3 bucket. It's designed for security engineers, not just developers. I also appreciate the true data sovereignty because both the company data and its indices reside in our AWS S3 storage, ensuring full control which is highly attractive for companies with strict compliance and regulatory requirements. Additionally, the seamless AI integration, being fully compatible with Claude-Code and the Claude SDK, is fantastic. Setting it up and getting onboarded was very easy, taking just one day. Review collected by and hosted on G2.com.

What do you dislike about Scanner?

There are limitations in the event triggers for alerting. When an event is triggered, I'd like to selectively filter only the data I need from the associated indices, then send an alerting message (e.g., to Slack) or transmit it to another third party via webhook. Currently, it's impossible to select only the necessary data from multiple indices. This adds a few extra tasks for me because I have to receive the entire original alerting message and process it once. Review collected by and hosted on G2.com.

IT

Itamar T.

IT Security Engineer

Mid-Market (51-1000 emp.)

2/17/2026

"Fast Querying with Responsive Support"

4.5/5

What do you like best about Scanner?

I find the querying incredibly fast, which allows me to skim through whole terabytes of data in just a few seconds. This speed is especially noticeable when writing detections on massive datasets, as the latency is relatively low. Additionally, during active investigations using manual queries, the results are lightning fast, especially with some expertise. I also appreciate how responsive their team is to our feature requests. We are design partners with them, and they release agreed-upon features relatively quickly. Review collected by and hosted on G2.com.

What do you dislike about Scanner?

The querying language is not sufficiently documented. The documentation shows the basic syntax of the queries, but more contextual examples like common practices of how specific functions are used could be great. Additionally, not having the ability to create a multiple source detection (ex. a single detection querying EDR and MDM logs and crossing them is impossible). There is no native way to create reliable log source monitoring, so once your log source shuts down, it is up to the user to notice it. Review collected by and hosted on G2.com.

TO

Trisha O.

2/12/2026

"Flexible and Cost-Effective Log Management Solution"

3.5/5

What do you like best about Scanner?

I love the flexibility of Scanner, especially how I can ingest different types of log data into it and then search efficiently. The indexing and categorization of data make it easy to manage, and the way it reads and formats data is really good. Once I see it in their console, everything is well formatted and nicely displayed in a table-like way, with columns and values, making it easier for me to look at the results. I also appreciate that I can query data at a reasonable price, and it uses our own S3 buckets, which keeps costs lower compared to storing data on other platforms. Review collected by and hosted on G2.com.

What do you dislike about Scanner?

I guess sometimes I struggle with pulling data that was not ingested for some time. Having more flexibility when data is missed and how I can re-ingest that would be good. There's more documentation or a better way for me to re-ingest when data didn't get ingested. I had some missed logs because of a new environment change and didn't get a notification about it. I'm trying to work on how to re-ingest those. I also think having better documentation would help. We had to manually adjust some configurations that should have been automated during setup. Having a diagram or architecture of how Scanner works and how to set it up in our environment would help us picture how it will work and make adjustments accordingly. Review collected by and hosted on G2.com.

GG

Guy G.

2/17/2026

"Efficient SIEM with Rapid Log Integration"

5/5

What do you like best about Scanner?

I appreciate that I can add new log sources to Scanner in a matter of minutes, and its efficient indexing makes queries really fast. I like that I can write and manage my detections in Scanner as code, which helps with version control, along with the overall ease of work. I find the initial setup to be quite easy, and the Scanner team is very responsive. Review collected by and hosted on G2.com.

What do you dislike about Scanner?

There's a bit of a learning curve for new members, and they might take time to learn how to use Scanner. Also, there isn't any log source monitoring. Review collected by and hosted on G2.com.