What role does open data play in defending against AI-generated cyber threats?

Summary

• Open data keeps defenders in control of their own security data, tools, and intelligence, using open standards — OCSF, Spark, Unity Catalog, Delta, Parquet, and SQL — so telemetry stays portable and avoids proprietary lock-in.
• Open formats enable AI-driven defense at scale: security teams can retain high-fidelity telemetry at petabyte scale, giving AI agents the historical depth needed to detect complex, multi-stage attacks.
• An open governance layer keeps the enforcement point auditable: Unity Catalog is open-sourced under Apache 2.0 and donated to the Linux Foundation, so defenders can inspect and extend the control point itself.
• Databricks' Open Security Lakehouse (Lakewatch) brings security, IT, and business data together in open formats so AI agents can automate investigations, generate detection-as-code, and streamline SOC operations.
• Open collaboration accelerates defense: as a founding member of the Open Secure AI Alliance, Databricks contributes open models, weights, harnesses, and tooling so the broader ecosystem can keep pace with machine-scale attacks.

What role does open data play in defending against AI-generated cyber threats?

As cyber threats evolve into AI-driven, machine-scale attacks, open data and open standards give defenders a structural advantage: they own their data, keep it portable and inspectable, and make it immediately usable by the AI agents that increasingly power modern defense. Databricks applies this principle through its Open Security Lakehouse, Lakewatch.

Why open data matters for AI-era cyber defense

• Defenders own their data, tools, and intelligence. The core principle is that security teams should retain ownership and governance of their security data. Building on open standards — OCSF, Spark, Unity Catalog, Delta, Parquet, and SQL — keeps that telemetry portable across engines and instantly accessible to AI tooling.
• Open standards keep telemetry accessible to AI. When security, IT, and business data live together in open formats, governed real-time data becomes immediately actionable for production-ready AI agents that automate investigations, generate detection-as-code, and streamline SOC operations.
• An open governance layer stays auditable. Unity Catalog — the governance foundation — was open-sourced under Apache 2.0 and donated to the Linux Foundation. Because the catalog is open (open APIs, open table formats, and an open implementation), defenders can audit and extend the enforcement point itself, and security data stays portable rather than locked to one control plane.

How Databricks applies open data to cyber defense

• Lakewatch, the Open Security Lakehouse, lets security teams maintain ownership and governance of security data on open standards, so telemetry is instantly accessible across AI tooling.
• Petabyte-scale retention of high-fidelity telemetry in open formats gives AI agents the complete historical depth required to detect complex, multi-stage attacks.
• Delta Lake, the open data storage layer, delivers reliability and performance for streaming and batch operations, and its open ecosystem means the same data can be read by many tools and engines.
• Open ecosystem collaboration. Databricks recognizes that critical security intelligence locked inside a few closed systems leaves the broader ecosystem exposed. As a founding member of the Open Secure AI Alliance, it contributes open models, model weights, open harnesses, and open tooling to accelerate new cybersecurity tools and techniques.

Getting started

• Read Databricks announces Lakewatch, a new agentic SIEM.
• See how Databricks joined the Open Secure AI Alliance to advance AI safety and security.
• Explore how data intelligence is reshaping cybersecurity.

FAQs

What does "open data" mean in a security context?

It means security teams own and govern their telemetry on open standards — such as OCSF, Delta, Parquet, and SQL — so the data stays portable, inspectable, and immediately usable by AI tooling rather than confined to a closed, proprietary store.

Why does open data help against AI-generated threats?

AI agents need complete, high-fidelity historical data to detect complex, multi-stage attacks. Open formats let security teams retain telemetry at petabyte scale and make it directly actionable for AI-driven investigation and detection.

What is Lakewatch?

Lakewatch is Databricks' Open Security Lakehouse — an agentic SIEM that keeps security data on open standards so AI agents can automate investigations, generate detection-as-code, and streamline SOC operations.