Ziggiz builds a “Cyber Lakehouse”: a semantic data platform that collects security telemetry, works out what each field means and turns it into a single model ready for detection. It is aimed at security operations teams whose analytics stall because every new log source needs weeks of manual mapping and data preparation.
The platform runs on Databricks, so teams build on the lakehouse they already have, and it serves both commercial security teams and government agencies.
At A Glance
| Vendor | Ziggiz |
|---|---|
| Category | Security data platform and cyber lakehouse (Security Operations) |
| Deployment | Runs on Databricks, managing the Delta Lake layer |
| Public sector | ESCAPE platform through Carahsoft |
| Founded | 2023, Chattanooga |
| Market classification | Security Operations |
What Ziggiz Does
Security teams collect authentication events, firewall logs, endpoint data and network flows from dozens of tools, each with its own field names. Before any detection rule can run, someone has to map and normalise all of it. Ziggiz automates that step, using a mix of artificial intelligence, predictive analytics and human-guided logic to understand the context of the data and structure it, so that disparate sources can be analysed consistently. The platform handles high volume collection, manages the Delta Lake layer without manual schema work and delivers a semantic model that detection teams can use straight away.
Products
ESCAPE Platform
ESCAPE is the version of the platform packaged for public sector agencies that struggle with scattered telemetry and slow data onboarding. It automates ingestion and normalisation, builds identity, asset and threat knowledge graphs from fragmented data, and feeds those graphs to AI-driven incident detection tools. Agencies get real time visibility across their sources and a consistent base for Zero Trust and JADC2 programmes, with simpler audits against FedRAMP, CMMC, HIPAA and NERC-CIP.
Semantic Data Model
The semantic model recognises what a field represents regardless of what each vendor calls it, so a source IP from a firewall and one from an endpoint agent are treated as the same thing. That lets enrichment be applied once, consistently, across every source, and gives detection engineers one model to write rules against. The model is detection ready out of the box, so teams can start on rules rather than on data preparation.
Ingest Time Enrichment
IP enrichment happens while data is being ingested, before detection rules run. Each address gains geolocation, ASN, network type and hosting classification. For streaming data the enrichment uses local database deployments rather than API lookups.
How It Works
| Component | What it does |
|---|---|
| Collection | Ziggiz ingests security telemetry from across the environment, including authentication, firewall, endpoint and network flow data. |
| Normalisation | The semantic model interprets fields from each source and maps them into one structure, with no manual schema mapping. |
| Enrichment | An enrichment decision tree “prioritizes internal network data first” and falls back to IPinfo datasets for public addresses. |
| Storage and detection | Data lands in a Delta Lake layer on Databricks that Ziggiz manages, and the resulting model is ready for detection rules and AI-driven incident detection. |
Integrations
| Area | Integrations |
|---|---|
| Data platform | Databricks, Delta Lake, Unity Catalog, AI/BI and Lakewatch |
| IP intelligence | IPinfo |
Company Background
| Founded | 2023. |
|---|---|
| Headquarters | Chattanooga, United States. |
| Public sector | Carahsoft offers Ziggiz solutions to federal, state and local government agencies. |
Note: This overview is compiled from Ziggiz’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.