From three siloed tools to one unified platform: Riskified migrates to groundcover

In a nutshell:

• Unified observability stack: From three separate tools to a single platform.
• Massive cost savings: Hundreds of thousands of dollars saved while ingesting 2x logs.
• Faster incident response: Consolidated context drives a significant reduction in MTTR.
• No blind spots: All environments & microservices are monitored, no sampling or caps.
• Eliminated data security risks: All telemetry data is kept inside Riskified’s own VPC.
• High developer adoption: Over 80 people in R&D use groundcover daily.

Riskified, a global fintech leader, found itself juggling a fragmented observability stack. For logs, they had long relied on Coralogix; for metrics, an internal Prometheus; and for traces/APM, New Relic. This patchwork meant multiple UIs and disjointed data silos. Correlating issues across systems was painfully difficult, requiring engineers to hop between tools and manually piece together clues. On top of that, costs were spiraling. With a contract renewal on the horizon, Riskified’s engineering leadership sought a better path - one tool to consolidate logs, metrics, and traces without breaking the bank or sacrificing visibility.

“All vendors charge on data ingest, some even on users, which doesn’t fit a growing company. One of the first things that we liked about groundcover is the fact that pricing is based on nodes, not data volumes, not number of users. That seemed like a perfect fit for our rapid growth”

- Elihai Blomberg, DevOps Team Lead, Riskified

They considered the usual suspects (Datadog, etc.), but knew those came with hefty price tags. What they wanted was full-stack observability with economics that make sense, stronger security controls, and a smoother developer experience. groundcover, with its eBPF sensor and Bring-Your-Own-Cloud (BYOC) architecture, had previously piqued their interest. They had been following groundcover’s progress for some time, and by late 2024 they felt ready to evaluate. They decided to start a proof-of-concept (POC) before renewing any existing contracts.

The challenge: Too many tools, too little insight

Managing three different observability tools wasn’t just expensive - it was inhibiting the team’s ability to troubleshoot. Issues would “fall between the cracks” of their monitoring pillars, with logs, metrics, and traces living in separate systems. Developers often lacked visibility into what was happening in real time across microservices. For example, a failure in a complex request flow might require checking a New Relic trace, cross-referencing Prometheus metrics, and digging through Coralogix logs - a slow, tedious process. As the scale of services (and volume of data) grew, this model became unsustainable. Moreover, the traditional SaaS model meant shipping sensitive data out to third-party clouds, which raised security flags and incurred hefty data transfer fees. Riskified’s leadership mandated a push to reduce costs all around, and observability spend was a prime target for optimization.

groundcover’s approach directly addressed these pain points: its eBPF-based agent promised to capture logs, metrics, and traces without manual instrumentation, and its BYOC architecture would let Riskified keep data within their own cloud while still using groundcover’s managed backend. This meant heightened security and data control (no more endless data egress) and a predictable cost model not tied to raw log volume or seat licenses. It was the appealing prospect of 10x more data visibility at a fraction of the cost, all in one place - exactly what Riskified was looking for.

Why groundcover? 

Discovery and evaluation

Riskified’s engineers engaged groundcover’s team to explore this new solution. groundcover had reached out before, but now timing was perfect - the pain of the current stack was acute, and the technology had evolved. The concept of using eBPF, with its kernel-level visibility, to automatically gather telemetry excited the team. It promised zero code changes yet deeper insights, such as surfacing database queries, network calls, and infrastructure events that were never logged explicitly. They kicked off a POC to validate these claims, aiming to see if groundcover could truly replace their incumbent tools.

“It was clear to me early on that groundcover could be the full solution we were looking for - security, cost, and user experience, all in one. During the POC it was like fire in a field of thorns. I started with five people involved, and by the end of the POC, I had 60 developers using groundcover on a daily basis. People just got visibility they never had.”

- Elihai Blomberg, DevOps Team Lead, Riskified

The Riskified team set up groundcover alongside the existing tools and gave a small group of developers access. Almost immediately, the excitement began to spread like wildfire. In fact, within the first 6 weeks, usage exploded far beyond the initial group, and engineers were organically inviting their teammates to try it out, impressed by the ease of exploring data.

What fueled this viral adoption was the immediate value developers experienced. With groundcover, they could suddenly see into parts of the system that were opaque before. The data team, for example, leveraged groundcover’s eBPF-powered insights to observe all database queries and internal service calls without adding any custom logs. Another team correlating logs with groundcover’s auto-captured metrics quickly uncovered issues like poorly optimized queries and misconfigured API calls that had been flying under the radar. Problems that previously required jumping through hoops and involving a “middleman” team were now surfaced instantly in one interface. This not only accelerated debugging (lower MTTR), but also helped catch inefficiencies in code and infrastructure that they didn’t even know existed.

Throughout the POC, feedback poured in daily. Developers at all levels were sending enthusiastic reports up the chain. groundcover wasn’t just passing the technical tests; it was winning hearts and minds.

“The team would go to their manager, ‘Wow, listen, this tool is amazing. It reached our VP, then came back down to me… truly insane hype. In my entire career I’ve never seen anything like it - my manager and his manager were astonished by the excitement and the value.”

- Elihai Blomberg, DevOps Team Lead, Riskified

During the POC, the volume of logs they imported from production to groundcover was twice more than what they were ingesting with Coralogix across all environments. They saw the system handle it with ease, and when the CFO realized the projected savings, it became clear to everyone, including upper management, that it was the way forward.

Rollout and migration

Rollout was approached methodically. Logs and metrics were moved first, which proved straightforward. With groundcover’s agent deployed across their environments, logs and metrics started streaming into the new platform, and engineers seamlessly shifted their debugging workflows to the unified interface. Riskified’s engineers were thrilled to drop the previous “log budgeting” exercises - they no longer had to meticulously filter or sample logs to stay under quota. Now they could send everything and trust groundcover to handle it efficiently.

Migrating alerts and dashboards from the old systems required a bit more effort, as the team had accumulated many custom alerts in the prior tools, and re-creating those in groundcover’s monitoring was a necessary step. However, groundcover’s support engineers worked side by side with Riskified’s team to quickly iron out issues and accelerate the transition. In the end, all critical alerts were re-established in groundcover, ensuring continuity of monitoring.

Today, roughly 140 developers at Riskified have access to groundcover, with 60-70 using it daily as part of their workflow. 

“People open groundcover first-thing in the morning and debug live. That’s how they work here now.”

The impact: Massive savings and deepened visibility

Riskified’s move to groundcover delivered a transformational impact on both cost and engineering productivity. By consolidating three tools into one and leveraging groundcover’s BYOC deployment, they slashed their observability costs dramatically - on the order of hundreds of thousands of dollars per year saved, directly answering the management’s call to reduce spend without sacrificing capabilities. In fact, groundcover’s efficiency avoided an imminent cost doubling that the previous vendor had proposed at renewal time. And these savings were achieved while increasing data retention and coverage.

Equally important, all observability data stays in Riskified’s cloud, satisfying the security team’s concerns. Sensitive log data and customer info no longer get sent off to third-party servers; groundcover’s BYOC architecture keeps it on their own infrastructure with full control. This also eliminated a significant chunk of data transfer costs that were incurred when exporting logs to an external SaaS.

From a developer’s perspective, the day-to-day experience improved greatly. Engineers now have a single source of truth for all their observability needs. Instead of juggling multiple tools, they can focus on solving problems. The impact on Mean Time to Resolve (MTTR) has been significant, and issues that used to take hours of cross-tool sleuthing can now be pinpointed in minutes, thanks to groundcover’s rich context.

Perhaps most telling is the grassroots enthusiasm groundcover generated. During the rollout, engineers were so impressed that they literally begged to keep the tool. When the initial POC period was ending, people thought groundcover might be taken away until a contract was in place. “I got complaints… ‘Why are you shutting it down?’ They assumed it was here to stay,” Elihai laughed, recalling how eager the team was to make groundcover permanent. Now that it is, that excitement has translated into a culture of proactive problem-solving. With far deeper insight into their systems, teams at Riskified are identifying issues before they escalate, and even spotting optimization opportunities, like redundant calls or slow queries, that make the product and infrastructure more efficient.

In summary, Riskified’s observability overhaul with groundcover has been a resounding success. They went from a fractured, costly monitoring setup to a unified, eBPF-powered platform that developers love. By embracing groundcover’s novel approach - kernel-level data capture, BYOC deployment, and a dev-friendly interface - Riskified achieved the holy grail of engineering: better performance and visibility at lower cost. And perhaps the biggest win is qualitative: a happier, more empowered engineering team that can spend less time fighting tooling and more time building value.