The bill arrived gradually, then all at once. At Accompany, the intelligent executive-assistant startup where Cliff Crosland and Steven Wu were early engineers, an annual logging expense that had once been about $10,000 climbed toward $1 million. The growth was not mysterious. Accompany crawled the public web, resolved people and companies, and assembled briefings before meetings. More scale meant more systems producing more records of what those systems were doing. The cost of remembering kept rising.
So the engineers made the sensible move. They sent much of the data to Amazon S3, where storage was cheap. The money problem eased. A second problem took its place: searching cloud storage was painfully slow. The logs were retained, but retrieving an answer from them could feel like sending evidence into a black hole.
Crosland has a history with black holes. In 2015 he published black-hole.js, a browser experiment that numerically traces light around a black hole and renders the gravitational-lensing effect in WebGL. It remains his most popular public GitHub repository. Years later, the metaphor returned as enterprise infrastructure: information was present, yet functionally beyond reach.
“We thought, where’s the search index that’s built on top of cloud storage?”Cliff Crosland, describing Scanner’s origin
The operating scar
Scanner came from that gap. Crosland and Wu did not need to be convinced that object storage was economical, or that a traditional log platform could be fast. They wanted both properties in the same system. Their question was architectural and commercial at once: could an index designed specifically for S3 return the speed of a security information and event management system without recreating its expensive storage layer?
The distinction mattered because security teams face an awkward choice. Keep a short, searchable window in an expensive system, or retain years of evidence in inexpensive storage that is too slow for an active investigation. A newly published malicious IP address does not politely limit itself to the last 30 days. Investigators may need to look back six months, a year, or longer. Cold data is cheap until the moment someone urgently needs it.
Scanner leaves the logs in object storage and builds index files alongside them. When a query arrives, serverless compute fans out across the relevant index ranges, narrows the search space, scans the useful slices, and then scales down. Crosland has explained the machinery in unusual detail on engineering podcasts: ECS Fargate for indexing, Rust for the data plane, Lambda functions for parallel search, and a metadata layer that knows which index files intersect the requested time range.
The useful abstraction
in customer S3
narrows the hunt
returns answers
This is technical infrastructure, but its product effect is behavioral. A query that takes a day encourages one cautious question. A query that takes seconds supports a conversation with the evidence. An investigator can follow a lead, hit a dead end, revise the premise, and try again. Crosland’s preferred word is speed, but the thing speed buys is curiosity.
An apprenticeship in messy data
The company looks less like a sharp turn when set against Crosland’s earlier work. He studied computer science at Stanford from 2006 to 2012 and served as a section leader. His listed campus activities ranged from the Stanford Harmonics a cappella group to KaeMe, an organization supporting children in Ghana. A former CS106A student later wrote that Crosland held extra office hours, taught patiently, and made computer science engaging for someone who did not consider it a natural strength.
His early résumé moved through an Amazon internship, software engineering at Addepar, and founder roles at RedeemPlus and Seed Equity Ventures. At Accompany, the work became a sustained lesson in unruly information. The product crawled news and public data, connected entities, and prepared executives for the people and companies on their calendars. That required a stack spanning higher-level application code and lower-level systems work.
One crawler episode became part of Crosland’s case for Rust. Accompany’s C++ system called into libcurl and eventually encountered memory-safety crashes. The bug was fixed upstream, but the experience sharpened his appreciation for a language that makes ownership explicit. Scanner is built largely in Rust. The company’s standard biography describes his relationship with the language as love-hate, “but it’s mostly love these days.”
“We’re kind of obsessed with speed at Scanner.”Crosland on the Smashing Security podcast
Cisco acquired Accompany in 2018. Crosland became a principal engineer and led backend infrastructure for the Webex People Graph, continuing the same broad pursuit: recover useful context from huge, uneven bodies of data. When he and Wu started Scanner in late 2021, they carried both the systems apprenticeship and the log-bill scar with them.
The agent needs a memory
Scanner first aimed broadly at application and observability logs. Customer conversations pulled it toward security. Application developers often needed a week or two of history. Security teams wanted months or years, because patient threats and forensic questions ignore retention policies. The larger data requirement made the economics more painful and the search problem more urgent.
Then AI changed who, or what, would issue the queries. Scanner released a Model Context Protocol server in December 2025, giving agents a standard path into security data. According to Sequoia’s investment note, nearly a third of Scanner customers used MCP in production within weeks of release, and agents came to account for 80 percent of queries on the platform. At Notion, an internal security agent called Scruff uses Scanner among its data sources to collect context before handing preliminary analysis to human investigators.
Crosland’s “headless” thesis follows from those numbers. Routine investigations can begin in an agent and end in Slack, a ticket, or another shared system. The search console becomes optional for some workflows. He does not argue that visual products disappear. In his public writing, he has made the opposite distinction: solo agent work can happen through code, while collaboration still needs a polished visual language people can share.
His version of automation also leaves judgment with people. Agents can gather context, generate hypotheses, tune noisy rules, and perform repeated searches. Humans review code, supply business context, and decide what deserves action. The ambition is not a magic analyst in a box. It is a tighter division of labor, with machines handling the repetitive traversal and people spending more time on the questions that require taste and responsibility.
A round, and a longer horizon
In March 2026, Scanner announced a $22 million Series A led by Sequoia Capital, with CRV and Mantis VC participating. The customer list in the announcement included Notion, Ramp, BeyondTrust, Lemonade, Benchling, Postman, and EliseAI. Sequoia’s Bogomil Balkansky wrote that he first heard about Scanner from a security practitioner at Temporal who called it “crazy fast.” The compliment fits a founder who has spent years treating latency as something closer to a moral offense than a dashboard metric.
Funding converts the old constraint into a new one. Scanner now has to carry its speed across customers approaching 100 terabytes of logs a day, and toward Crosland’s stated sightline of a petabyte a day. It also has to make agent access efficient. He has warned that a careless tool can dump enormous results into a model’s context and turn a nominally cheap investigation into a costly one. His proposed remedy sounds like the rest of his career: summarize first, cache the full result, and let the user pull only the relevant slice.
There is a pleasing consistency in the details Crosland leaves online. The personal website that calls him “Hacker, Red Head.” The archived Accompany bio that adds Utah native, downhill skier, and karaoke star. The ray tracer written in Clojure. The black hole in WebGL. The teacher who stayed for extra office hours. The engineer who will happily explain skip lists on a podcast. None are proof that a company succeeds. Together they describe the temperament behind the bet: playful with the surface, exacting with the system underneath.
Scanner’s wager is that security data should remain where it is cheapest to keep, stay searchable for as long as it matters, and become available to both people and agents without forcing either to wait. The idea began as an objection to a million-dollar bill. Its larger claim is about institutional memory. Keeping the record is only the first half of remembering. The second is finding the right piece while there is still time to act.