Right: Alexey Milovidov, Co-Founder & CTO
Security is the largest and fastest growing data workload in the enterprise, and today, ClickHouse, a leader in real-time analytics, data warehousing, observability, and AI/ML, today announced that it has acquired RunReveal, the unified platform that handles the entire security lifecycle—from data ingestion through investigation and remediation. In recent years, Runreveal built a security data platform on ClickHouse, and now that expertise is coming in-house to make ClickHouse better for everyone in the space.
Security is a data problem
What makes security data hard isn’t just volume, but the shape of the workload: cloud audit logs, identity events, endpoint telemetry, network flows. Security data pushes a database harder than almost anything else: continuous high-throughput ingest, retention measured in years, and queries that have to return while an analyst is still looking at the screen.
The power and efficiency of the database underneath decides how much data a team can afford to keep and how quickly an analyst gets an answer. That is why cyber companies increasingly build their anti-fraud, real-time detection engines, data-loss prevention, and threat intelligence engines on ClickHouse. RunReveal chose ClickHouse for the same reasons: storage efficiency, query speed at scale, and a flexible data platform across security signals and workflows.
For companies already building security products on ClickHouse. ClickHouse remains a neutral foundation. We succeed when the companies building security products on us succeed. Bringing security expertise in-house will make us better at supporting customers: sharper reference architectures, better guidance on schema and retention design, and a clearer line from customer requirements into the database roadmap.
For security teams evaluating ClickHouse. RunReveal remains available, via its bring-your-own-database model, where security data lives in a ClickHouse cluster you control.
For RunReveal customers. This is an acceleration, not a disruption. The platform continues to be supported and contract terms remain the same.
As AI agents begin operating across enterprise systems, security data becomes the record of what those agents did and the substrate for defending against machine-speed threats. The work the RunReveal team has done on agentic investigation, including agents that hunt across sources, propose and tune detections, and carry an investigation toward a conclusion, is some of the most interesting built on ClickHouse. Investigations that took analysts hours need to happen in seconds. ClickHouse expects that experience to inform how the company supports agentic analytics across the platform, for its own products and for the companies building theirs on top of ClickHouse.
For more information, visit clickhouse.com.
