Observability has long been viewed as a safety net that catches outages after they happen. For years, IT teams relied on monitoring tools to detect anomalies and then trace problems through application code. Groundcover, an observability vendor rooted in Linux kernel technology, sees that era closing. The company raised $100 million in Series C funding at a time when its customers are moving from conventional monitoring toward something more ambitious: understanding AI agents that write and deploy code autonomously.

CEO and co-founder Shahar Azulay described the transformation as one of the most fascinating changes ever to hit the observability sector. Founded in 2021, Groundcover built its platform on eBPF (extended Berkeley Packet Filter) and OpenTelemetry. The company previously collected $35 million in a Series B round in April 2025. With the new round led by One Peak, total funding has reached $160 million. Other investors include Morgan Stanley Expansion Capital, Zeev Ventures, Angular Ventures, Heavybit, and Jibe. Headquarters remain in Tel Aviv, Israel.

The observability shift from monitoring to AI infrastructure

Observability spent most of the past decade as a post-production discipline. Engineering teams used logs, metrics, and distributed traces to diagnose why an application failed, or to cut the time spent searching for the root cause of an incident. That model assumed that software is built by humans and then operated by humans. The arrival of agentic AI systems changes that assumption. AI agents are increasingly involved in writing code, running tests, deploying services, and handling production incidents. As these agents become more autonomous, the lines between development, testing, and operations blur.

Groundcover is not alone in noticing this shift. Across the industry, observability vendors are adding AI features to their products, from log analysis to automated root-cause recommendations. What sets Groundcover apart, Azulay believes, is the underlying infrastructure. Because Groundcover is built on eBPF, it can observe activity inside the Linux kernel without modifying application code or forcing developers to add SDKs. This gives teams a layer of visibility that is independent of their instrumentation choices. In a world where AI agents may spin up new services or call unplanned APIs, such visibility becomes critical.

The new funding will help Groundcover expand its platform to address the unique telemetry requirements of AI workloads. Azulay said that companies now want to know not only whether a system is up and performing, but also which models are being used, how many tokens each request consumes, and whether an AI agent is hallucinating or following an unexpected code path. Traditional application performance monitoring, or APM, was not designed to answer those questions. AI observability, as Azulay calls it, is a different product category.

What eBPF does and why it matters more now

eBPF is a Linux kernel technology that allows programs to run safely inside the kernel without requiring a custom kernel module. It was originally developed for network packet filtering, but it has evolved into a general-purpose mechanism for observing and controlling the operating system. Network monitoring tools used eBPF for years to capture traffic and trace connections. Groundcover uses the same technology to watch application and infrastructure activity across servers, containers, and pods.

The advantage of eBPF is that it works below the application layer. Developers do not need to instrument every service by hand or rely on a distributed tracing library that might not exist for a particular language or framework. As Azulay explained, eBPF provides a kind of universal visibility net. Even if an organization fails to instrument a workload, Groundcover can still see the workload running in production. That capability mattered when infrastructure was relatively static. It matters much more now that AI agents can generate code and workflows dynamically.

Azulay compared the current visibility gap to the problems that engineering teams faced a decade ago. Before observability tooling matured, it was difficult to know exactly what was running in a production environment. Teams often discovered dependencies only after an outage. The same thing is happening again with AI. Developers are adopting new agentic tools faster than they can document them. They may not know which model is being called or which vendor is processing a prompt. eBPF acts as a security net, capturing those details even when nothing was instrumented.

The eBPF approach also reduces the friction that has traditionally slowed observability adoption. Many commercial observability products require developers to add a library, configure the library, and redeploy the service. That is a nonstarter for teams that are experimenting with AI agents or using third-party workflows. Groundcover's eBPF-based collector can run alongside existing workloads and immediately begin to report what is happening across the stack.

How agentic workflows are breaking distributed tracing

Distributed tracing is one of the pillars of modern observability. A trace follows a request as it moves from a client to a load balancer to a service, then to a database and back. In conventional distributed systems, an engineer can predict the path: a web server calls an authentication service, which calls a user database, then a cache. There are a finite number of hops and the relationships are stable. Tracing tools can assemble a flame graph or a waterfall diagram that shows the exact amount of time spent in each component. This works well when the number of hops is small and the interactions are deterministic.

Agentic workflows break that model. A single agent session can generate dozens or even hundreds of calls to external tools, internal APIs, language models, and memory systems. There is no fixed pattern because the agent chooses its path based on the prompt and the context. As Azulay said, relying on distributed tracing to understand an agent's behavior becomes very complicated. Each step may depend on the output of a previous call to a large language model, making it difficult for a human to reconstruct what happened after the fact.

Moreover, the data that needs to be traced is different. In addition to latency, error rate, and throughput, teams are now concerned with token usage, context window utilization, hallucination rates, and the cost of model calls. Traces may include a customer's prompt, which raises privacy questions. The prompt might contain personally identifiable information or proprietary business data. Storing that data in a shared vendor backend could create compliance risks. Groundcover says its platform is designed to retain telemetry inside the customer's own cloud environment, allowing organizations to collect larger and more sensitive datasets without handing them to a third party.

Azulay acknowledged that this makes observability more complex, and that complexity is why it is important to rethink the tooling. AI observability is not just another feature of an APM suite, in his view. It needs its own data model, privacy boundary, and query semantics. He noted that people are expected to save more telemetry, and to save telemetry more privately, as AI systems become more widespread.

Agent Mode and the rise of MCP

Groundcover is not solely focused on the infrastructure needed to monitor AI agents. The company is also embedding AI into its own product to improve how engineers work. Agent Mode is an AI assistant that sits inside Groundcover. It allows users to ask questions about their systems using natural language, build dashboards, and troubleshoot logs and traces without having to write complex query language by hand. Agent Mode is designed to reduce the learning curve for observability and to help junior engineers quickly investigate incidents.

Groundcover has also built an integration with the Model Context Protocol, or MCP, an open standard that lets AI systems communicate with tools and data sources. The integration connects Agent Mode to coding agents and workflow tools such as Linear. When an incident occurs, an engineer can ask Agent Mode to investigate, then pass the resulting context to a coding agent in Linear so that a fix can be drafted. The two systems exchange information back and forth, making the observability platform part of an automated software development pipeline.

Azulay said that adoption of the MCP integration has been faster than expected. Customers use it in different ways, he explained. Some teams simply ask questions about a system through MCP, rather than opening the Groundcover dashboard. They might ask, 'Why did latency spike at noon?' and receive an answer in a chat interface. Other teams are more aggressive, using Agent Mode to analyze a trace and then asking an AI coding tool to write a fix. That fix can be reviewed by a human, tested, and deployed. In both cases, the observability platform becomes an active participant in the development lifecycle, not just a passive monitoring tool.

This trend extends beyond Groundcover and its customers. Azulay described it as the beginning of autonomous software development. Companies are building what he calls their own autonomous development structures, in which AI agents can propose changes, validate them against production telemetry, and roll them out with oversight. Observability is the backbone of that structure because it gives the agents feedback on whether a change is working. Without accurate telemetry, an AI system cannot know whether its fix solved the problem or introduced a new one.

Groundcover's architecture and funding history

Groundcover's architecture is intended to balance two competing requirements: deep visibility and tight privacy. The platform collects data using eBPF and OpenTelemetry, then stores that data in the customer's cloud environment. According to the company, this approach ensures that sensitive logs and traces are not shipped to a multi-tenant backend where they could be exposed to other customers. It also gives organizations a way to meet regulatory requirements around data residency and privacy.

The company has grown since its founding in 2021. In April 2025 it announced a $35 million Series B round, and just over a year later it closed a $100 million Series C round. The latest investment positions Groundcover for a market opportunity that is expanding quickly as global enterprises deploy more AI agents. The company is headquartered in Tel Aviv, Israel, and serves customers that rely on cloud-native infrastructure and modern DevOps practices.

Groundcover competes with established observability vendors that have added AI features to their existing products. But the startup's eBPF-first approach and its focus on privacy may give it an edge in the emerging AI observability category. Observability teams that need to monitor agentic workflows cannot simply bolt on a new dashboard; they need to see the full path that an agent takes through models, APIs, and data stores. Groundcover's ability to automatically capture unstructured interactions makes it well suited for that task.

Groundcover at a glance

• Founded: 2021
• Total funding: $160 million
• Latest round: $100 million Series C, led by One Peak
• Other investors: Morgan Stanley Expansion Capital, Zeev Ventures, Angular Ventures, Heavybit, Jibe
• Headquarters: Tel Aviv, Israel
• CEO: Shahar Azulay
• What they do: Observability technology built on eBPF and OpenTelemetry

As organizations continue to push AI agents into production, the need for intelligent observability will only intensify. Groundcover's latest funding round signals that investors see the transition from monitoring to AI infrastructure as one of the defining technology trends of the decade. Whether that trend is called AI observability or something else, the underlying demand is clear: engineers need to understand what their AI systems are doing, with whom they are communicating, and whether that behavior is safe and reliable.

Source: Network World News