Land in the telemetry mess
Cribl enters at a point of real pain: exploding volumes of logs and telemetry flowing into expensive destinations. The wedge is an observability pipeline that sits in front of the mess and gives a team control over what goes where.
The land is low-threat by design. Cribl doesn't ask a buyer to replace their SIEM or their storage — it asks to sit in the path and route.
Prove control, not replacement
Neutrality is the strategy. Because Cribl doesn't compete with the destinations, adopting it carries little switching risk — and that low threat is exactly what makes the initial deal easy to justify. The buyer keeps their existing stack and gains control over cost and routing.
Become the neutral layer
Expansion follows from position. Once Cribl is the routing and reduction layer, it becomes the natural place to add more sources, more destinations, and more of the investigation path. The account grows because the layer is where control already lives.
The lesson
Neutrality can be a wedge, not a weakness. Being the trusted layer that everything flows through beats being one more destination competing for the data — and it makes expansion a function of position rather than persuasion.