Partnering with Scanner: Every Log Tells a Story—If You Can Find It Fast Enough

Security teams have been making a brutal tradeoff for years: keep a little log data hot and searchable, or stash the rest in cheap storage and hope nothing urgent happens. That model breaks the moment there’s a breach, an audit, or a forensic hunt. Then the evidence is there, somewhere in Amazon S3, but not in a form anyone can use quickly.

Sequoia is betting that Scanner fixes that problem at the root. The company built a log search engine specifically for object storage, using an inverted index that points field values straight to file regions in S3. The practical result is blunt and appealing: a petabyte of logs becomes interactive, searches that used to take hours finish in seconds, and a streaming detection engine can keep hundreds of rules running across tens of terabytes a day without re-reading everything each time.

The customer list helps explain why Sequoia moved fast. Notion, Ramp, Benchling, Confluent, Lemonade and BeyondTrust are already using Scanner, and these aren’t casual pilots. Benchling switched after another vendor imposed a tenfold price increase, and its head of security engineering called the move one of the best technical decisions the team had made. Ramp started with security logs, then pushed Scanner into application logs and cut its SIEM bill along the way. Notion’s detection and response team went a step further and built an internal AI agent that runs investigations on its own.

That last detail is the real tell. Scanner is landing right as security operations starts to bend around AI agents that can ask questions, follow leads and keep moving. Those systems can’t wait minutes for each query, and they definitely can’t wait hours. Within weeks of Scanner’s MCP release, nearly a third of its customers were using it in production, and agents were already making up 80% of queries on the platform. Sequoia isn’t just backing a faster search tool here. It’s backing the plumbing for a very different kind of security workflow.