ClickHouse buys RunReveal to boost security analytics

ClickHouse has acquired security platform RunReveal, bringing a company built on its technology into the database group.

RunReveal provides a security platform for data ingestion, investigation and remediation. The acquisition adds in-house expertise in security workloads, which ClickHouse describes as one of the largest and fastest-growing uses of enterprise data systems.

The move reflects the growing strain security data places on databases. Cloud audit logs, identity events, endpoint telemetry and network flows generate constant streams of information that must be stored for long periods and queried quickly while analysts respond to incidents.

ClickHouse says those demands have led cybersecurity companies to build products such as fraud detection systems, data loss prevention tools and threat intelligence services on its database. RunReveal had already built its security data platform on ClickHouse before the acquisition.

Security focus

ClickHouse said it would continue to serve as a neutral base for other companies building security products on its technology. Bringing RunReveal's experience into the business should improve support for customers through reference architectures, guidance on schema design and retention policies, and a closer link between customer needs and product development.

RunReveal will also remain available under a bring-your-own-database model, allowing customers to keep security data in a ClickHouse cluster they control. Existing RunReveal customer contracts and support arrangements will remain unchanged.

The deal reflects a broader shift in enterprise computing as companies manage larger security data sets and prepare for the impact of AI systems operating across business software. ClickHouse says security records are becoming more important for tracking what AI agents do inside corporate systems and for defending against automated threats that move at machine speed.

AI investigations

ClickHouse also highlighted RunReveal's work on agent-led investigations, including tools that can search across data sources, suggest and refine detections, and move an investigation towards a conclusion.

That work is expected to shape how ClickHouse supports agentic analytics across its wider platform, both for its own products and for software companies building on the database. The company argues that investigations that once took hours increasingly need to be completed in seconds.

ClickHouse is known for its open-source columnar database, used for real-time analytics and large-scale data processing. It serves customers across sectors including automotive, healthcare, retail and artificial intelligence, and has positioned itself in markets such as observability, analytics and data warehousing.

The acquisition underlines how database providers are moving closer to end-use applications in areas where data volumes are rising fastest. Security, in particular, has become a test of whether a database can handle continuous ingestion, retain years of records economically and still return results quickly enough for front-line use.

For ClickHouse, bringing in a specialist already built on its software provides direct experience in a demanding customer segment while helping reassure existing partners that the underlying platform will remain open to them.

RunReveal remains available through its existing deployment model, with customer data continuing to sit in ClickHouse infrastructure controlled by users.