# Nikhil Mungel
> Head of AI Research & Development, Cribl

## Bio
Nikhil is based in San Francisco and specializes in distributed systems and AI, with experience across SaaS and consumer tech. His background spans AI, observability platforms, developer ecosystems, and high-scale consumer social products, with leadership roles at Substack, Splunk, ThoughtWorks, and most recently, Cribl where he currently serves as the Head of AI R&D. At Cribl, he works on setting technical direction and leading teams researching and building LLM-powered systems for IT and security data transformation and analysis. Earlier in his career, he helped grow Splunk’s platform adoption as Head of the Developer Ecosystem, spanning developer experience, APIs, integrations, and partner-facing tooling. He later led engineering at Substack across distributed systems, mobile apps, and mission-critical email deliverability. His current focus is making complex systems more intuitive with AI, while building the platform foundations that make AI in SaaS dependable and repeatable.

## Short Bio
Nikhil is based in San Francisco and specializes in distributed systems and AI, with experience across SaaS and consumer tech. His background spans AI, observability platforms, developer ecosystems, and high-scale consumer social products, with leadership roles at Substack, Splunk, ThoughtWorks, and most recently, Cribl where he currently serves as the Head of AI R&D.

## Socials
- [@nikhilmungel](https://linkedin.com/in/nikhilmungel)
- [@nmungel](https://x.com/nmungel)
- [Google Scholar](https://scholar.google.com/citations?hl=en&user=4NmYEi4AAAAJ)
- [GitHub](https://github.com/hyfather)
- [Substack](https://engmanager.substack.com)
- [ChatGPT](https://chatgpt.com/?prompt=who%20is%20nikhil%20mungel)
- [Planes](/planes)
- [Media Kit](/media)

## Selected Bylines
- **The company of the future is built on tokens**
  Guest Author | Token consumption is moving into the same planning cycle as headcount and cloud spend, and pay will increasingly track how well someone turns token spend into useful outcomes
  Link: https://www.sdxcentral.com/opinions/the-company-of-the-future-is-built-on-tokens/

- **Where the True Value of SaaS Lies in the Agentic Coding Era**
  Guest Author | How buying software transfers risk and preserves focus
  Link: https://techstrong.it/contributed-content/from-vibes-to-verification-where-the-true-value-of-saas-lies-in-the-agentic-coding-era/

- **Why the CIO is uniquely positioned to lead the digital workforce**
  Guest Author | Now that frontier AI has reached a reliability threshold for high-value, here is how CIOs can expand their role
  Link: https://www.cio.com/article/4160987/why-the-cio-is-uniquely-positioned-to-lead-the-digital-workforce.html

- **OCSF explained: The shared data language security teams have been missing**
  Guest Author |  The Open Cybersecurity Schema Framework is an open standard for security data that helps normalize logs and telemetry so security teams can move fast and keep up with agentic threats.
  Link: https://venturebeat.com/security/ocsf-explained-the-shared-data-language-security-teams-have-been-missing

- **The Davos reality check on AI ROI: Why tools don’t pay off until work changes**
  Guest Author |  CIOs and CISOs can raise the odds of payoff by treating AI as an operating-model change with hard metrics, stage gates and security controls.
  Link: https://www.cio.com/article/4145044/the-davos-reality-check-on-ai-roi-why-tools-dont-pay-off-until-work-changes.html

- **The Next Evolution of Observability: Why Your Telemetry Needs to be AI-First**
  Guest Author | Schema-on-read and schema-on-write platforms were never built for AI-driven workloads. Here I lay out an agentic telemetry framework built on three pillars: AI-first architecture, contextual data fusion, and vendor-agnostic flexibility.
  Link: https://itopstimes.com/observability/the-next-evolution-of-observability-why-your-telemetry-needs-to-be-ai-first/

- **Why 90% AI reliability isn’t even close to good enough**
  Opinion | Breaking down Andrej Karpathy's March of Nines
  Link: https://venturebeat.com/technology/karpathys-march-of-nines-shows-why-90-ai-reliability-isnt-even-close-to

- **FinOps for AI Agents**
  Guest Author | Loop limits, tool-call caps and the new unit economics of agentic SaaS
  Link: https://www.infoworld.com/article/4138748/finops-for-agents-loop-limits-tool-call-caps-and-the-new-unit-economics-of-agentic-saas.html

- **Why Should IT Leaders Be Thinking About Model Context Protocol?**
  Bylined article in Unite.AI on the significance of MCP for enterprise IT.
  Link: https://www.unite.ai/why-should-it-leaders-be-thinking-about-model-context-protocol/

## Selected Podcasts
- **The Data Engine for AI** (2026)
  Guest with Cribl co-founder and CTO Ledion Bitincka on DataCamp's DataFramed podcast (Episode 378), hosted by Richie Cotton, on AI agent cost shocks, what software telemetry is actually for, pointing agents at telemetry to find insight, and the shift from knowledge work to judgment work.
  Link: https://www.datacamp.com/podcast/the-data-engine-for-ai

- **AI is Making Us More Productive, But Who's Paying?**
  Guest on Season 4, Episode 24, on who ends up carrying the cost of AI-driven productivity gains.
  Link: https://podcasts.apple.com/us/podcast/s4-e24-ai-is-making-us-more-productive-but-whos-paying/id1653254295?i=1000787852453

- **You Need AI Sysadmins Can Trust** (2026)
  Guest on the Platform Engineering Podcast (Episode 48) hosted by Cory O'Daniel, on harness engineering and the guardrails that turn probabilistic models into repeatable, verifiable outcomes in production.
  Link: https://www.youtube.com/watch?v=gPHJlMQWJn0

- **Why AI Agents Are Blowing Up Your Telemetry Bill**
  RedMonk Conversation with analyst Kate Holterhoff on the logs, traces, and tool-call chains agents leave behind, and why that volume is becoming observability's cost and noise problem.
  Link: https://redmonk.com/videos/nikhil-mungel/

- **Landing a Real Job in the Age of LLMs**
  Guest on the Adventures in DevOps podcast (Episode 283), discussing engineering hiring and career growth now that LLMs are part of the day-to-day work.
  Link: https://adventuresindevops.com/episodes/283-landing-a-real-job-in-the-age-of-llms/

- **Exploring Cribl Copilot!** (2024)
  Guest appearance on 'Cribl: The Stream Life' Podcast (Episode 105) hosted by Bradley Chambers
  Link: https://podcasts.apple.com/us/podcast/exploring-cribl-copilot/id1536018735?i=1000658685210

## Expert Commentary
- **Cribl targets SIEM data costs with new Detect tool** (2026)
  Quoted expert commentary in TechTarget on how Cribl StreamAI's model router prices inference — free when the router picks the model, provider token rates with no markup when a request names one, and cost logged on every call so customers can verify the savings.
  Link: https://www.techtarget.com/it-infrastructure/news/366651477/Cribl-targets-SIEM-data-costs-with-new-Detect-tool

- **Cribl Launches AI Gateway to Route Prompts, Control Costs and Enforce Governance** (2026)
  Quoted expert commentary in Techstrong.ai on StreamAI as a single control point for enterprise AI traffic, with automatic fallback between models and policy enforcement that keeps AI budgets in check.
  Link: https://techstrong.ai/features/cribl-launches-ai-gateway-to-route-prompts-control-costs-and-enforce-governance/

- **How to upskill IT for agentic AI: 7 pathways to success** (2026)
  Quoted expert commentary in CIO.com on why upskilling for an AI-agent workforce requires behavior change, as IT shifts from maintaining systems to validating, governing, and directing AI-generated work.
  Link: https://www.cio.com/article/4218846/how-to-upskill-it-for-agentic-ai-7-pathways-to-success.html

- **5 Essential Questions for CIOs on Planning IT Careers in the AI Era** (2026)
  Quoted expert commentary in StarCIO on why CIOs should prioritize upskilling their teams in AI governance, compliance, and operational control, and why engineers who can govern, monitor, and deploy AI systems safely at scale stay resilient as roles evolve.
  Link: https://drive.starcio.com/2026/06/cios-planning-it-careers-ai-era/

- **7 sources of AI debt and how to avoid them** (2026)
  Quoted expert commentary in CIO.com on AI-generated code debt, and why off-the-shelf code generation drifts from a company's own standards unless teams set the guardrails first.
  Link: https://www.cio.com/article/4178324/7-sources-of-ai-debt-and-how-to-avoid-them.html

- **The New Reality of Tech Careers: High Mobility, Low Confidence**
  Expert commentary on how AI is affecting the tech hiring market
  Link: https://www.dice.com/career-advice/the-new-reality-of-tech-careers-high-mobility-low-confidence

- **What enterprise devops teams should learn from SaaS** (2026)
  Quoted expert commentary in InfoWorld on why test automation pays for itself in fewer incidents and lower operational overhead, and how SaaS teams de-risk deployments with staged rollouts and observability before a broad release.
  Link: https://www.infoworld.com/article/4150869/what-enterprise-devops-teams-should-learn-from-saas.html

- **10 essential release criteria for launching AI agents** (2026)
  Expert commentary on how to secure and harden agentic software
  Link: https://www.infoworld.com/article/4105884/10-essential-release-criteria-for-launching-ai-agents.html

- **4 New Year’s resolutions for devops success** (2025)
  Featured commentary in InfoWorld on AI skills for DevOps success in 2026.
  Link: https://www.infoworld.com/article/4108953/4-new-years-resolutions-for-devops-success.html

- **50+ Expert Predictions: Agentic AI, Data Governance, & Security** (2025)
  Featured in StarCIO's 2026 predictions roundup alongside industry leaders.
  Link: https://drive.starcio.com/2025/12/predictions-agentic-ai-data-governance-security-2026/

- **Is AI the end of IT as we know it?** (2025)
  Quoted expert commentary in CIO.com on the shift to managing virtual agents.
  Link: https://www.cio.com/article/4033097/is-ai-the-end-of-it-as-we-know-it.html

- **Generative AI in IT: Transforming Roles, Not Replacing Them**
  Featured commentary in Centizen blog.
  Link: https://www.centizen.com/generative-ai-in-it-transforming-roles-not-replacing-them/

- **Cribl Amazing Data Stories: Your Guide to the Data Engine of Tomorrow** (2024)
  Contributor to Chapter 10: 'Cribl, AI, and You' in this published book.
  Link: https://assets.ctfassets.net/xnqwd8kotbaj/i327ZKu2iLeP0X4lzx3s7/2df2dbad5f2ce1966326adc27842d893/Cribl_Book_IT_VDigital.pdf

- **The One Where Meet Cribl Copilot** (2025)
  An introduction to Cribl Copilot hosted by Ed Bailey
  Link: https://www.brighttalk.com/webcast/19128/658073?q=ai-copilot

## Speaking
- **Using Ruby to Craft and Test Beautiful Command Line Applications** (2012)
  Invited speaker at RubyConf 2012.
  Link: https://2012.rubyconfindia.org/talks.html

- **Splunk Cloud: Under The Hood** (2016)
  Invited speaker at Splunk’s user conference, presenting how a commercial observability cloud platform is operated at scale
  Link: https://conf.splunk.com/files/2016/slides/splunk-cloud-a-peek-under-the-hood.pdf

- **Splunk Project Nova** (2017)
  Invited speaker for Splunk's user conference, discussing how to analyze logs from microservices
  Link: https://conf.splunk.com/files/2017/slides/analyzing-logs-from-microservices.pdf

- **Career Progression for New Grads with Zero Experience** (2021)
  Workshop at CodeDay Labs mentoring early-career engineers.
  Link: https://www.youtube.com/watch?v=SjVT4CXkJjw

- **Transforming Data Management with AI and Cribl Copilot** (2025)
  Featured speaker at CriblCon 2025, discussing schema transformations and human-in-the-loop AI.
  Link: https://www.youtube.com/watch?v=WZrGyB5ObGs

- **How to Incorporate AI and Cribl Copilot Into Your Workflows** (2025)
  BrightTALK Webinar co-presentation on onboarding data and generating queries with Copilot.
  Link: https://www.brighttalk.com/webcast/19128/659168?q=ai-powered-governance

- **How to Disrupt SaaS with AI** (2026)
  Invited speaker at AI Camp 2026 in San Francisco, discussing how to use AI to disrupt SaaS.
  Link: https://www.aicamp.ai/event/eventdetails/W2026011417

## Research & Inventions
- **Distributed Systems, Obervability, and AI**
  My work in the field of Distributed Systems, Observability, and AI has been cited in 879 publications by researchers and practitioners across the industry, including Palantir, Intel, Raytheon, SAP, IBM, Salesforce, Uber, Thoughtspot, Microsoft, Elasticsearch, Dell, Visa, JPMorgan Chase, Bank of America, Verizon, Snowflake, Oracle, Twitter, Amazon, and Cloudflare.
  Link: https://scholar.google.com/citations?hl=en&user=4NmYEi4AAAAJ

- **SecIT Bench** (2026)
  A frontier benchmark from the Cribl AI Research Lab, where I serve as Head of AI R&D, that scores AI models on real IT and security investigations instead of exam-style questions. Every model gets the same evidence and the same investigation window across several agent environments, and is measured on investigation accuracy, root cause analysis, reasoning, tool use, how it copes with incomplete telemetry, and token consumption. The opening run of 20 models across 30 investigations found only a 17% spread in diagnostic accuracy against a 20x range in cost, which is why the most expensive model is rarely the right default.
  Link: https://cribl.io/ai-research-lab/secitbench/

- **OnTrack: Real-Time Monitoring and Intervention in LLM Agent Trajectories** (2026)
  A preprint I co-authored with Babak Barazandeh, Connor Swanson, and Chinmay Kulkarni that watches an AI agent while it works instead of grading it after the fact. OnTrack models a run as a dependency graph of steps and aligns the growing graph against recorded successful runs using streaming structure-aware optimal transport, emitting per-step verdicts such as EXPLORING, LOOP, STALLED, or OFF_TRACK so a run can be flagged or stopped mid-flight. It degrades gracefully across three levels of data access, from full reference trajectories down to no prior knowledge at all, where loop and stall detection still work. Across 2,288 SWE-agent trajectories it ranks failing runs above succeeding ones earlier than content-similarity baselines, and an illustrative abort policy recovers roughly 18% of the compute otherwise spent on runs that were never going to succeed, at about 0.85 ms of monitoring overhead per event.
  Link: https://arxiv.org/abs/2610.12375

- **Proxying HTTP requests for microservices** (2020)
  A gateway service for Distributed Systems that routes incoming HTTP requests to the right microservice based on the request method and headers, then creates and sends the corresponding outgoing request so the microservice can perform the requested action without being directly exposed. Developed before microservices were widely adopted, it helped shape how the industry routes and secures requests at scale in a microservices-based architecture.
  Link: https://scholar.google.com/citations?view_op=view_citation&hl=en&user=4NmYEi4AAAAJ&citation_for_view=4NmYEi4AAAAJ:u5HHmVD_uO8C

- **Recommending query templates during query formation** (2021)
  A system that suggests structured data-retrieval queries (like SQL) as you type by recognizing key fields in your query, matching them to saved query patterns, using AI to recommend missing values, and showing the completed query for you to use.
  Link: https://scholar.google.com/citations?view_op=view_citation&hl=en&user=4NmYEi4AAAAJ&citation_for_view=4NmYEi4AAAAJ:u-x6o8ySG0sC

- **Recommending query parameters based on results of automatically generated queries** (2022)
  A system that analyzes a partial structured data query (like SQL) as you type, runs related helper queries to learn about the available data, and then uses AI to recommend specific parameters you can add to complete and refine your query.
  Link: https://scholar.google.com/citations?view_op=view_citation&hl=en&user=4NmYEi4AAAAJ&citation_for_view=4NmYEi4AAAAJ:d1gkVwhDpl0C

- **Recommending query parameters based on tenant information** (2022)
  A system that suggests structured query parameters as you type by recognizing your partial query and using your organization’s past query usage to recommend relevant commands, functions, or field values to add.
  Link: https://scholar.google.com/citations?view_op=view_citation&hl=en&user=4NmYEi4AAAAJ&citation_for_view=4NmYEi4AAAAJ:2osOgNQ5qMEC

- **Recommending query parameters based on tenant information (continuation)** (2024)
  The granted continuation of the tenant-information patent (US 12,093,318), extending the original claims for suggesting structured query parameters from an organization’s own query history to further query-formation flows.
  Link: https://scholar.google.com/citations?view_op=view_citation&hl=en&user=4NmYEi4AAAAJ&citation_for_view=4NmYEi4AAAAJ:qjMakFHDy7sC

- **Executing one query based on results of another query** (2025)
  A browser-based interface that uses AI to recommend and run multiple structured data queries side by side, showing each query and its results in separate areas and enabling you to execute one query based on the results of another.
  Link: https://scholar.google.com/citations?view_op=view_citation&hl=en&user=4NmYEi4AAAAJ&citation_for_view=4NmYEi4AAAAJ:zYLM7Y9cAGgC

## Cribl Blog
- **GPT 6 Astra vs. GLM 5.3: Why performance scores aren’t the whole story** (Sep 11, 2026)
  Co-authored with Jonathan Vengosh. Two models landed within a point of each other on the same investigation benchmark, and then went about the work completely differently: Astra fewer tokens and faster, GLM 5.3 exhaustive. A matching score says very little about how a model will behave in your pipeline.
  Link: https://cribl.io/blog/gpt-6-astra-vs-glm-5-3-why-performance-scores-arent-the-whole-story/

- **Cribl Privacy 2.1: More telemetry scanned per unit of compute** (Aug 14, 2026)
  Co-authored with Connor Swanson. A purpose-built model has to find sensitive data and still fit inside a production pipeline. Privacy 2.1 raised throughput by 64% to 163% on the same CPU allocation while average memory use fell 13% to 24%.
  Link: https://cribl.io/blog/cribl-privacy-2-1-more-telemetry-scanned-per-unit-of-compute/

- **What is agentic telemetry?** (Jul 28, 2026)
  Defining agentic telemetry: telemetry managed for people and AI agents at once, fusing human, machine, and AI context so any authorized agent, person, or system can ask questions of any data, in place and at full fidelity.
  Link: https://cribl.io/blog/what-is-agentic-telemetry/

- **Cribl Guard’s latest model: Cribl-Privacy 1.5 with higher recall at the same footprint** (Jun 5, 2026)
  Co-authored with Connor Swanson. The detection model behind Cribl Guard reaches 84.1% recall and an 85.5% F1 score on sensitive data in telemetry, without asking for any more compute than the version it replaces.
  Link: https://cribl.io/blog/cribl-guards-latest-model-cribl-privacy-1-5-with-higher-recall-at-the-same-footprint/

- **OpenAI’s Privacy Filter is a strong step, but telemetry still needs a different kind of model** (Apr 24, 2026)
  OpenAI’s Privacy Filter gives builders an open model they can run in their own environment for sensitive workflows. Here I explain why privacy filtering in a telemetry pipeline is a different problem from filtering documents or business text, and why detection has to work inside the telemetry itself.
  Link: https://cribl.io/blog/open-ai-privacy-filter-is-a-strong-step-but-telemetry-still-needs-a-different-kind-of-model/

- **When your telemetry meets AI. (It usually fails.)** (Apr 16, 2026)
  Telemetry built for human operators breaks down once AI systems read it continuously. Here I lay out what has to change first — parsing and normalizing at ingest, carrying operational context alongside the data, and decoupling storage from processing — before intelligent automation can work at scale.
  Link: https://cribl.io/blog/when-your-telemetry-meets-ai-it-usually-fails/

- **The Investigations Bottleneck: Why AI Can’t Fix What Telemetry Breaks** (Feb 3, 2026)
  AI promises to automate security investigations, but teams keep hitting a wall. In this post I argue the constraint is the data, not the model: AI can’t accelerate a workflow when telemetry is unstructured and scattered across disconnected tools.
  Link: https://cribl.io/blog/the-investigations-bottleneck-why-ai-cant-fix-what-telemetry-breaks/

- **How to Monitor NVIDIA GPU Metrics with Cribl Edge & Stream** (Aug 13, 2025)
  Technical tutorial on collecting real-time GPU telemetry for AI/ML workloads.
  Link: https://cribl.io/blog/how-to-monitor-nvidia-gpu-metrics-with-cribl-edge-and-stream-complete/

- **MCP and the New Power Struggle in the SaaS Stack** (Aug 7, 2025)
  Co-authored with Nick Heudecker. Analyzes the Model Context Protocol (MCP) as an existential threat and opportunity for SaaS vendors.
  Link: https://cribl.io/blog/mcp-and-the-new-power-struggle-in-the-saas-stack/

- **Enterprise AI Is Not a Magic Trick, It’s a System Design Problem** (Jul 10, 2025)
  In this post I argue that getting enterprise AI into production is an architecture problem, then share a practical decision guide for when prompting is enough, when fine-tuning earns its keep, and when training from scratch is worth the overhead.
  Link: https://cribl.io/blog/enterprise-ai-is-not-a-magic-trick-its-a-system-design-problem/

- **The Cribl Copilot Difference: Explainable and Steerable AI** (Jun 5, 2025)
  I conceived Cribl Copilot and guided my team to build it, and in this post I share how we made it explainable and steerable so humans stay in control.
  Link: https://cribl.io/blog/the-cribl-copilot-difference-explainabl-and-steerabl-ai-built-for-humans/

## Substack Newsletter
- **What is Engagement** (Aug 14, 2021)
  Dives into what is team engagement and explores ways to track it.
  Link: https://engmanager.substack.com/p/what-is-engagement

- **Engagement Across Multiple Teams** (Aug 22, 2021)
  Exploring how to assess engagement across teams of teams.
  Link: https://engmanager.substack.com/p/engagement-across-multiple-teams

- **What Affects Engagement (1/2)** (Aug 28, 2021)
  A look at the factors that impact team engagement.
  Link: https://engmanager.substack.com/p/what-affects-engagement

- **What Affects Engagement (2/2)** (Sep 4, 2021)
  Deeper dive into the factors that impact team engagement.
  Link: https://engmanager.substack.com/p/what-affects-engagement-22

- **Purposeful One-on-ones (Part I)** (Sep 26, 2021)
  Guidance on conducting intentional one-on-one meetings.
  Link: https://engmanager.substack.com/p/purposeful-one-on-ones-part-i

- **Purposeful One-on-ones for Engineering Managers (Part II)** (Oct 28, 2021)
  The importance of lateral one-on-one meetings with peers and adjacent organizations.
  Link: https://engmanager.substack.com/p/purposeful-one-on-ones-for-engineering

- **What Makes Engineering Organizations Successful** (Nov 10, 2021)
  In this post I share a practical way to judge whether an engineering org is successful by looking at the balance between outcomes and engagement, then unpack how vision, value-creating results, and engagement signals fit together.
  Link: https://engmanager.substack.com/p/what-makes-engineering-organizations

- **Attention Is All You Have** (Sep 16, 2023)
  Explore the central role of attention in our conscious thought and its impact on mental processes.
  Link: https://engmanager.substack.com/p/attention-is-all-you-have

## Technical Writing
- **SSH uses four TCP segments for each character you type** (2013)
  Front page of Hacker News at #2 in May 2013.
  Link: https://blog.hyfather.com/blog/2013/04/18/ssh-uses-four-tcp-segments-for-each-character/

- **Manual for ifconfig** (2013)
  Widely used technical resource with thousands of page hits per month.
  Link: https://blog.hyfather.com/blog/2013/03/04/ifconfig/

## Hobby Projects
- **HTTP Colon**
  The best tool to understand and learn about HTTP headers, used for debugging and optimizing HTTP requests and responses.
  Link: https://httpcolon.dev/

- **paperairplanes.js**
  Tiny library for interactive paper-plane SVGs
  Link: https://mungel.com/planes