RunReveal
RunReveal is an AI-native security data platform built on ClickHouse that unifies log ingestion, threat detection, AI-powered investigation, and incident response for security teams ranging from startups to enterprises.
- Company typePrivate
- Founded2023
- HeadquartersAustin, United States
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What RunReveal does
RunReveal is an AI-native security data platform that consolidates log ingestion, threat detection, investigation, and incident response into a single product, positioned as a modern alternative to legacy SIEM systems. Founded in 2023 by Evan Johnson (CEO, former Head of Security at Cloudflare and Segment) and Alan Braithwaite (CTO, former engineering at Cloudflare and Segment), the company is headquartered in Austin, Texas with a San Francisco office and operates as a venture-backed private corporation. The platform is built on ClickHouse for sub-second queries across terabytes of security data, and integrates pipelines for log routing and enrichment, detection-as-code with Sigma and SQL rules, AI Chat for natural-language investigation, a Remote MCP Server for AI-agent integration, and an Autonomous Security Operations Agent for automated alert triage.
The product surface is monetized through subscription-based, volume-priced SaaS (data ingestion and deployment option — SaaS, BYOC, or BYOD), with a freemium tier (20 GB/month, full platform access) for self-serve onboarding and consultative enterprise sales for larger accounts. Distribution combines product-led growth, AWS Marketplace (plus Red Sift and Sony Semiconductors listings), and developer-relations channels (GitHub, Discord, podcasts, conferences). Customers span startups to enterprises across software development, AI infrastructure, cloud infrastructure, and investment verticals, including Harvey, Cursor, Sentry, Linear, Temporal, DigitalOcean, AngelList, Lumos, Together AI, ClickHouse, Weights & Biases, and CyberUp. The company is SOC 2 Type 2, GDPR, and CCPA compliant, has raised approximately $9.5M in total funding (seed in May 2024 led by Costanoa Ventures, followed by a $7M round in July 2025), and reports presence across 35+ countries.
RunReveal firmographics
Firmographics- Name
- RunReveal
- Legal name
- RunReveal, Inc.
- Website
- https://runreveal.com
- Company type
- Private
- Founded year
- 2023
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- RunReveal is an AI-native security data platform built on ClickHouse that unifies log ingestion, threat detection, AI-powered investigation, and incident response for security teams ranging from startups to enterprises.
- Ownership category
- akta.pro rank
RunReveal industry classification
Industry- Product category
- Cloud-native Security Information and Event Management (SIEM)
- NAICS
- Computer Systems Design and Related Services (54151), Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (51821)
- SIC
- Services-Prepackaged Software (7372), Services-Computer Programming, Data Processing, Etc. (7370)
- akta.pro primary industry
- Endpoint Security Managed Services (EDR/XDR) (BPAEADAH)
- akta.pro secondary industries
- Serverless & PaaS Security (Function/App Service Runtime) (HDADADAL), Webhooks, Eventing & Message Streaming (BPAMAOAE)
Keywords
Where RunReveal is headquartered
LocationHeadquarters
- HQ city
- Austin
- HQ country
- United States
- HQ region
- North America
Offices2 records
Markets served
RunReveal business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Infrastructure, Marketing or Sales, Operations
Revenue model
- SaaS Subscription: Subscription-based pricing model based on data volume ingestion and deployment option. Transparent, predictable pricing eliminating complex licensing fees and per-user costs common in traditional SIEM solutions.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Monthly | Free tier with 20GB monthly ingestion and basic features |
| Subscription | Monthly | Paid subscription tiers based on data volume and deployment |
Go-to-market motion3 records
Distribution channels4 records
Marketing channels9 records
RunReveal product offering
Product offeringCore offering
RunReveal is a unified AI-native security data platform that ingests, stores, detects, investigates, and responds to security threats across an organization's log data. Built on ClickHouse, the platform consolidates log management, threat detection (SQL and Sigma rules), AI-powered investigations, autonomous security operations agents, and dashboards into a single subscription offering with SaaS, Bring-Your-Own-Cloud, and Bring-Your-Own-Database deployment options. Pricing is transparent and volume-based on data ingestion.
Product overview
RunReveal is an AI-native security data platform that unifies log management, threat detection, investigation, and response into a single product. The platform is built on ClickHouse and consists of several integrated modules: the Security Data Lake for scalable log storage, Pipelines for data preprocessing and routing, Detections for threat detection (SQL and Sigma), AI Chat for natural language investigation, MCP Server for AI tool integration, Agents for automated security operations, Investigations for incident response workspaces, and Dashboards for analytics. The platform supports multiple deployment options (SaaS, BYOC, BYOD) and offers detection-as-code workflows via CLI and GitHub integration. Pricing is volume-based (storage and ingestion) with transparent, predictable costs.
Differentiator
Problem solved
Functional benefit
Products and services
- RunReveal Security Data Platform Unified AI-native security data platform that ingests, stores, detects, investigates, and responds to threats across an organization's log data. Built on ClickHouse for sub-second queries at terabyte scale, the platform includes a security data lake, preprocessing pipelines, SQL and Sigma detection rules, AI-powered investigations, an MCP server for LLM integration, autonomous security operations agents, investigations workspace, and SQL-powered dashboards. Offered as SaaS, Bring-Your-Own-Cloud, or Bring-Your-Own-Database with transparent volume-based subscription pricing.
Quantifiable outcome
- 60% reduction in investigation time (from 3 hours to 1.2 hours)
- +4 more outcomes
Companies that use RunReveal
Customer profileNamed customers12 records
Segments3 records
Ideal customer profiles3 records
RunReveal technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration17 records
AI capability6 records
Feature10 records
RunReveal partnerships and signals
Strategic signalPartnerships
Six partnerships are on record, tiered core and minor.
- HarveycoreHarvey built an agentic SOC integrated with RunReveal for agent-accessible security tooling. Harvey processes ~8 TB of network data daily and expanded detection coverage from 75 to 400+ detections while reducing weekly alerts by 95%.
- ClickHousecoreRunReveal is built on ClickHouse for sub-second queries. ClickHouse case study details how their security team uses ClickHouse Cloud + RunReveal. Customer and technology partner.
- AWS MarketplacecoreRunReveal available on AWS Marketplace allowing customers to use pre-committed AWS spend. Strategic distribution partnership for cloud-native security customers.
- Red SiftminorListed on Red Sift marketplace as part of marketplace distribution expansion.
- Sony SemiconductorsminorListed on Sony Semiconductors marketplace as part of marketplace distribution expansion.
- GitHubcoreRunReveal detection-sync-action available in GitHub Actions marketplace. Enables CI/CD workflows for detection-as-code deployment. Community presence on GitHub.
Scale indicators4 records
Recent moves6 records
Expansion highlights7 records
RunReveal competitors and assessment
Company assessmentDirect peers
- Cribl: Cribl is a data routing and observability pipeline vendor. RunReveal's Pipelines product competes directly with Cribl Stream for security log routing and preprocessing, and Cribl has expanded into adjacent SIEM-adjacent capabilities.
- Panther Labs: Panther is a cloud-native SIEM built for security teams at modern companies, using detection-as-code and a data lake architecture. RunReveal and Panther both target the legacy SIEM displacement use case with similar detection-as-code and AI features.
- Hunters: Hunters is an AI-driven SIEM replacement that ingests security telemetry and applies automated correlation and detection. RunReveal and Hunters directly compete for the modern SIEM buyer with overlapping AI-investigation and detection-engineering value propositions.
- Tenzir: Tenzir is an open-source security data pipeline and analytics platform for SOC teams. It competes with RunReveal's Pipelines and detection layers and is similarly positioned as a modern, data-lake-first SIEM alternative.
Broad incumbents
- Devo Technology: Devo is a cloud-native SIEM and analytics platform for security operations. RunReveal competes with Devo in the enterprise SIEM displacement market, though Devo has a more established enterprise footprint and broader feature set.
- Splunk: Splunk is the dominant legacy SIEM and log analytics platform. RunReveal explicitly positions against Splunk's cost, complexity, and query performance, and Splunk's pivot to a cloud/SaaS model under Cisco is the most relevant incumbent threat.
- Elastic Security: Elastic Security combines SIEM, endpoint, and cloud security on the Elasticsearch platform. It is a broadly comparable search-based security analytics offering and a direct competitor in the modern, open-architecture SIEM category.
- Datadog Cloud SIEM: Datadog Cloud SIEM is part of Datadog's broader observability and security platform. It overlaps with RunReveal in log management and threat detection, but Datadog benefits from bundling into a much larger monitoring stack.
- Sumo Logic: Sumo Logic is a cloud-native log management and security analytics platform. RunReveal competes with Sumo Logic in log management, threat detection, and compliance use cases for cloud-first security teams.
- Exabeam: Exabeam is an AI-driven security operations and SIEM platform. RunReveal and Exabeam both target security operations modernization with AI-driven detection and investigation, though Exabeam has a broader product portfolio and larger enterprise install base.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks6 records
Key highlights6 records
Customer concentration
RunReveal social profiles
Digital presenceRunReveal compliance and trust
Trust signalCompliance3 records
RunReveal financial estimates
Financial estimateRevenue estimate
Valuation estimate
RunReveal leadership team
Management profileNumber of profiles
Profiles2 records
RunReveal funding detail
Funding detailFunding overview
Funding rounds2 records
Investors4 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
RunReveal M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about RunReveal
What does RunReveal do?
RunReveal is a unified AI-native security data platform that ingests, stores, detects, investigates, and responds to security threats across an organization's log data. Built on ClickHouse, the platform consolidates log management, threat detection (SQL and Sigma rules), AI-powered investigations, autonomous security operations agents, and dashboards into a single subscription offering with SaaS, Bring-Your-Own-Cloud, and Bring-Your-Own-Database deployment options. Pricing is transparent and volume-based on data ingestion.
Is RunReveal a public or private company?
RunReveal is a private company. It is classified as venture growth investor backed and is currently operating.
When was RunReveal founded?
RunReveal was founded in 2023. It employs 11 to 50 people.
Where is RunReveal based?
RunReveal is headquartered in Austin, United States, in the North America region.
How does RunReveal make money?
One revenue line is on record: saaS Subscription.
Who are RunReveal's main competitors?
Direct peers on record are Cribl, Panther Labs, Hunters and Tenzir. Broad incumbents are Devo Technology, Splunk, Elastic Security, Datadog Cloud SIEM, Sumo Logic and Exabeam.
Does RunReveal have an API?
Yes. RunReveal offers a REST API for programmatic access to the platform. The API uses API token authentication via Basic auth (Authorization: Basic ). The base URL is https://api.runreveal.com. API tokens are generated in the UI and scoped to specific roles (admin, analyst, CIBot). Rate limiting is not specified. Available endpoints include log querying (/logs/query/v3), notification history (/notification-history/list), and detection management. A Python SDK (runrevealpy) is available via pip. The platform also supports a Model Context Protocol (MCP) server for AI integrations. Developer documentation is at docs.runreveal.com/api-reference.
What industry is RunReveal in?
RunReveal's product category is Cloud-native Security Information and Event Management (SIEM). Its primary akta.pro industry code is BPAEADAH, Endpoint Security Managed Services (EDR/XDR), with a secondary code of HDADADAL, Serverless & PaaS Security (Function/App Service Runtime). Its NAICS code is 54151 and its SIC code is 7372.