RunReveal

• ClickHouse could fold RunReveal's capabilities into its own platform and stop selling the security product separately, ending the standalone offering the acquisition announcements describe.
• Security vendors that build on ClickHouse could move off it, or stop recommending RunReveal, now that the engine vendor sells a security application of its own.
• Incumbent SIEM vendors could match storage-based pricing in their own offerings, and RunReveal's own comparison posts place Panther in the same modern-SIEM contest, so the differentiation that leads RunReveal's pitch could compress to price.
• A wide gap sits between the $200 self-serve plan and the five-figure floor of the paid deployments, so buyers whose needs fall in between could find no plan that fits and pick a competitor.
• Regulated enterprises could keep buying incumbent SIEMs for procurement and certification reasons, capping RunReveal at the cloud-native segment its customer stories show.
• Bring-your-own-database leaves a customer's log history in a cluster the customer controls, so retention depends on continued price and product advantage rather than on data custody.

RunReveal defines its problem as legacy SIEM economics that punish complete log collection. Its own pitch is that a customer pays for what it keeps rather than what it sends, and the Cursor case study shows the shape of the pain, where turning on logging for one additional account produced a bill spike large enough to open an internal incident.

Independent coverage corroborates the problem beyond vendor marketing. SiliconANGLE reports that erroneous alerts can reach hundreds per day at some companies and positions RunReveal as a simpler alternative to established SIEM products. The buyer persona is specific, security and detection engineers at cloud-native companies, and the customer stories quantify the pain in dollars, such as Sentry's $36,000 in annual savings after switching.

The acquisition restates the same problem from the other end of the stack. ClickHouse describes security as a workload that pushes a database harder than almost anything else, with continuous ingest, retention measured in years, and queries analysts run under time pressure, and says that is why security companies build on its engine. [s7, s3, s16, s6, s19, s1]

The platform covers the whole SIEM workflow in one product. Documentation enumerates more than 100 log source integrations across cloud providers, SaaS applications, and infrastructure, pipelines that filter and route events before storage, Sigma and SQL detections, dashboards, and case-management investigations. ClickHouse provides the storage engine, which RunReveal operates as a hosted service, in the customer's own cloud account, or on any Kubernetes cluster.

The AI layer reaches further than a chat box. RunReveal ships an autonomous security operations agent that investigates alerts, responds to infrastructure changes, and attaches its full query history, tool usage, and reasoning to the case. The native AI chat and MCP server work with the customer's own model choice, including Anthropic, OpenAI, AWS Bedrock, and Google AI.

Open-source code lets outsiders check the capability claims. RunReveal publishes pql, its pipelined query language, kawa, the library powering its event-processing daemon, and a public repository named sigmalite, so anyone can inspect the code. [s10, s2, s3, s9, s11, s14, s19]

RunReveal positions head-on against incumbent SIEMs and attacks their pricing unit. Its CEO describes legacy platforms such as Splunk as too complicated, too expensive, and too noisy for even sophisticated teams, and the company publishes direct comparison posts against Splunk, Elastic, and Panther.

The modern-SIEM field is the closer contest. RunReveal's own comparison post sets its native pipelines and built-in AI against what it calls Panther's AI SOC platform, and data platforms with security tiers compete for the same log budgets. RunReveal differentiates through storage-based pricing with no ingest fees, pipelines built into the platform so buyers skip a separate data-engineering tool, and AI investigation built into the platform.

Ownership now cuts across that positioning. RunReveal argued that closed-source databases are what let SIEM vendors hold customer data hostage, and it has been bought by the vendor of the open database it named as the alternative. ClickHouse says it stays a neutral base for other companies building security products on its engine, which is the assurance a rival building on ClickHouse would want and the claim to watch. [s17, s8, s3, s21, s20]

The named-customer roster spans well-known engineering brands. Cursor, Sentry, Temporal, ClickHouse, AngelList, and Lumos appear with fetchable case studies linked from the homepage, the blog carries a Harvey story on network threat detection, and the displayed customer wall adds Linear, DigitalOcean, C1, Baseten, Together AI, CyberUp, Weights & Biases, Serval, Surge AI, Endor Labs, and THG as logos without stories. ClickHouse stands out because its security team replaced a self-built ingestion architecture with RunReveal, and because it has since bought the company.

The pricing page shows where the paid motion now sits. The hosted service is quoted at $10k-$150k depending on stored data volume and the customer-cloud deployment at $75k+, with the free Community edition and a $200 Teams plan kept below them as the self-serve entry. The pricing FAQ still advertises free 30-day trials for "Pro and Enterprise", labels that no longer match any plan name on the current pricing page.

Distribution beyond direct selling is still thin in the public record. No reseller program or MSSP channel appears in the reviewed materials, so buyers reach RunReveal through its content, comparison posts, and reputation. The acquisition adds a distribution question rather than an answer. ClickHouse points prospects at their account team for the combined experience, and both announcements otherwise describe continuity of contracts and support without setting out a joint sales motion. [s1, s6, s7, s5, s18, s22, s23, s3, s8, s19, s20]

The founding pair brings operating history that matches the product exactly. Evan Johnson led security at Cloudflare and Segment, and Alan Braithwaite built and maintained the core data pipelines at those same two companies, so the team combines the security and data-engineering disciplines a log platform requires.

Public records support the pedigree. Seed press identifies the founders' background, the company publishes working open-source tools, and Costanoa Ventures led both announced rounds, with Runtime Ventures, Modern Technical Fund, and Okta Ventures joining the $7 million round.

The founders announced the sale themselves and framed it as continuity, saying support for new and existing customers continues and that more about the roadmap follows. Neither announcement states terms, and neither describes what happens to the team's reporting line inside ClickHouse. [s4, s17, s14, s12, s25, s15, s26]

RunReveal publishes the attestations a log platform needs to clear security review. The trust page states SOC 2 Type 2 certification along with GDPR and CCPA compliance, and customers can bring their own model provider so the AI features stay inside the buyer's existing governance.

RunReveal extends the trust story through deployment flexibility. The customer-cloud and Kubernetes options keep log data in the customer's own environment, the self-hosted path advertises air-gapped and GovCloud deployment, and bring-your-own-database puts the log history in a ClickHouse cluster the customer runs.

The acquisition puts a new party inside that story. A security-data platform's trust case rests partly on who the vendor is, and the vendor is now a database company rather than an independent startup, with the announcements committing to unchanged contract terms and continued support but not to a separate attestation scope. [s13, s3, s11, s21, s19, s20]

Add analyzed competitors to compare them side by side with RunReveal.

RunReveal targets security teams at cloud-native technology companies, and its customer stories describe small teams carrying broad responsibility. Sentry's detection program ran through a senior engineer who also handled bug bounty triage, and Cursor's security lead describes turning on organization-wide logging as one of his first tasks. The named customers, including Cursor, Sentry, Temporal, ClickHouse, AngelList, and Lumos, fit one profile: technology companies with engineering-led security teams, and the blog puts one of them, Harvey, at roughly 8 TB of network data a day.

The persona is a detection engineer who writes SQL and treats detections as code. Customer stories emphasize code-first detection engineering and onboarding measured in hours, and the docs assume the buyer can route logs through object storage and webhooks without hand-holding.

The segment boundary is visible in what the record lacks, and the price list now marks it. No named customer is a bank, hospital, or government agency, while the published plans run from a free edition through a $200 team plan to hosted deployments quoted at $10k-$150k and a customer-cloud deployment at $75k+. That spread tracks company size inside the technology segment, with air-gapped and GovCloud deployment offered as groundwork for regulated buyers rather than presence among them.

The platform spans the whole security-data workflow that buyers otherwise assemble from separate tools. Documentation covers a catalogue of more than 100 log sources, pipelines that filter, transform, and enrich events before storage, a ClickHouse-backed data lake, Sigma and SQL detections, dashboards, investigations with case management, and notifications. Temporal's detection lead credits the pipelines with cutting irrelevant log volume, which is the job buyers otherwise hire a dedicated pipeline product to do.

The AI capabilities are concrete rather than decorative. An autonomous security operations agent investigates alerts, responds to infrastructure changes in real time, and attaches its full query history, tool usage, and reasoning to the case, so analysts can audit what it did. The chat and MCP server accept the customer's own model provider, including Anthropic, OpenAI, AWS Bedrock, and Google AI, so the AI features run inside the buyer's existing model relationships.

Open-source releases let outsiders inspect the company's code. The pql pipelined query language, the kawa library powering the event-processing daemon, and a repository named sigmalite are all public on GitHub. SiliconANGLE adds that correlated alerting weighs multiple data points before raising an alert, the company's stated answer to false-positive volume.

RunReveal sells through self-serve adoption backed by founder-led publicity. The free Community edition and the $200 team plan are the published entry points, paid plans carry free 30-day trials, and the founders front the company's public arguments against legacy SIEM pricing in funding announcements and blog posts. For a company at this stage, founders carrying the selling is the appropriate motion rather than a gap.

RunReveal generates demand through customer stories and comparison content. Recognizable engineering brands vouch for the product with named practitioners and concrete outcomes, and posts written against Splunk, Elastic, and Panther target buyers already searching for an exit from their current tool.

Distribution beyond direct self-serve stays thin in public materials, and the acquisition raises the question rather than answering it. No reseller program or MSSP channel appears in the reviewed pages. ClickHouse says the combined experience is something a prospect should ask an account team about, which is an early hint of a shared motion, while both announcements describe existing contracts and support as unchanged and neither describes a joint sales plan.

The pricing unit is the strategy. RunReveal charges for data stored rather than data ingested, with no ingest fees and no query limits, which removes the exact penalty that made Cursor's one-account logging change a billing incident on its prior SIEM. Buyers who measure their pain in ingestion overage read the unit choice as the fix.

The published tiers now sit well above the self-serve entry. The hosted service carries a $10k-$150k range depending on stored data volume, the customer-cloud deployment starts at $75k+, and the Kubernetes deployment is custom-quoted, with the free Community edition at 20 GB and the $200 team plan at 100 GB kept below them as the self-serve on-ramp. Storage allowance and retention are separate dials: Enterprise advertises 550-day retention by default, which the FAQ defends as what compliance and investigation actually need.

The open margin question is whether cheap storage stays cheap for RunReveal itself. Customers such as Harvey push roughly 8 TB of network data per day, and queries are unlimited rather than metered, so the model depends on query and storage economics staying favorable as volumes grow. Ownership by the database vendor changes where that cost sits without the announcements saying how.

RunReveal delivers the same platform across three deployment shapes, a hosted service, a deployment into the customer's own AWS, GCP, or Azure account, and a Kubernetes install for on-premises or air-gapped environments, with ClickHouse as the storage engine in each. The bring-your-own-database path goes further and writes into a ClickHouse cluster the customer already runs, which keeps log custody with the buyer and answers the data-residency objection a hosted SIEM otherwise faces.

Operational simplicity is the recurring customer claim. Sentry made RunReveal its primary logging source for all security data, and Cursor's lead describes delivering logs to object storage as the entire integration effort. The blog shows a steady cadence of platform change, including the Kubernetes deployment and pipeline-level masking of sensitive fields before storage.

The cost of this flexibility is operational surface, and the vendor's own write-up is candid about it. Supporting hosted, customer-cloud, on-premises, and customer-owned-database operation is a heavy commitment, and the bring-your-own-database post enumerates what the team took on: sizing the customer's cluster, staging writes when it goes down, batching inserts, and running schema migrations against infrastructure it does not control.

RunReveal documents the trust posture a security-data vendor needs. The trust page states SOC 2 Type 2 certification along with GDPR and CCPA compliance, which are the attestations that support procurement review for a vendor handling broad security telemetry.

RunReveal builds trust into the architecture as well as the paperwork. The AI chat runs on provider keys the customer adds and the docs say no data leaves the workspace, the customer-cloud and Kubernetes options keep the logs in the customer's own environment, and the agent attaches its complete reasoning to every case so analysts can audit its conclusions. Sentry's engineer calls RunReveal the most transparent vendor he has worked with, praise from exactly the skeptical practitioner the company targets.

A new party now sits inside that posture. The vendor a buyer is trusting with its security telemetry is a database company rather than an independent startup, and the announcements commit to continued support and unchanged contract terms without addressing whether the attestation scope, subprocessor list, or data-handling terms move with the ownership.

RunReveal positions itself as the data layer beneath security operations rather than one tool among many. The platform does the jobs of a log pipeline, a SIEM, and an investigation console, and the MCP server exposes the stored data to whatever AI assistant the customer already uses, which makes RunReveal the substrate other tools query.

RunReveal grows its ecosystem inbound through integrations and outbound through open source. The catalogue of more than 100 sources connects the customer's existing vendors to RunReveal, and engineers can adopt pql and kawa before becoming customers. No partner marketplace or technology-alliance program appears in public materials, so the ecosystem is still code-led rather than business-development-led.

The risk running underneath this platform has now resolved, and not by competition. The engine RunReveal builds on is open source and available to any competitor, ClickHouse included, and rather than shipping a rival security product ClickHouse bought this one. The acquirer now tells other security vendors building on the same engine that it remains a neutral base for them, which is the assurance those vendors need and the claim worth watching.

The founding team matches the problem with unusual precision. CEO Evan Johnson previously led security at Cloudflare and Segment, and CTO Alan Braithwaite built and maintained the core data pipelines at those same companies, so the pair has operated both the security function that buys SIEMs and the data infrastructure that makes one work. The about page frames the company as a response to tooling they lived with in those roles.

Execution evidence supports the pedigree. On two announced seed rounds the team shipped a platform spanning ingestion to investigation, an autonomous investigation agent, and a steady release cadence, and Costanoa Ventures led both rounds with Runtime Ventures, Modern Technical Fund, and Okta Ventures joining the later one. Costanoa leading twice is a sign of conviction from the investor with the deepest view of the company.

The founders announced the sale in their own names and framed it as continuity, promising continued support and more about the roadmap at a user conference later in September. Public materials still leave team scale undisclosed, and neither announcement says how the team is organized inside ClickHouse, so the depth behind the founders remains the main execution unknown.