Nine minutes into this conversation Alan Braithwaite said the sentence that, two years later, reads like a prophecy with the sign flipped.
“And so we’re taking a very product-first approach to this problem. And we’re not building the database, which gives us a huge advantage. We can really just focus on what security teams and detection and response engineers need in order to give them the value that they’re looking for out of a tool like this.”
Alan Braithwaite, co-founder and chief technology officer of RunReveal, at 8:36
The database he was not building is ClickHouse. On September 1, 2026, ClickHouse bought RunReveal (RunReveal, ClickHouse). Eleven weeks earlier Databricks had agreed to buy Panther, the other security data platform built by engineers who got tired of their SIEM (Reuters, via Yahoo Finance). Alan’s bet in 2024 was that a security company should sit on top of somebody else’s database. The market’s answer in 2026 was that the databases wanted the security companies.
This page is what I wish I had known before we hit record, plus everything that has happened since. Alan and I met at Cloudflare through a mutual friend, and the show notes for this episode were 32 words long, which is not what a conversation like this deserves. Below: the consolidation he was asked about and what the deals were actually worth, the stack of tools he says every buyer ends up with, the honeypot company that became a security data platform when its founders squinted at their own pipeline, why a man who scaled Cloudflare’s event pipeline from 1.5 million to 10 million events a second chose not to build a database, what RunReveal shipped in the two years after this tape, and how the whole category got bought by the data layer. There are four things to try along the way: a quiz on the episode, a scorecard for your own logs, a calculator for what your alerts cost, and a timeline you can filter.
The month the SIEM market ate itself
We recorded a few weeks after May 15, 2024, which was the strangest day the security information and event management market had seen in a decade. In the morning Palo Alto Networks said it would buy IBM’s QRadar software-as-a-service business, and that afternoon Exabeam and LogRhythm announced they would merge (BankInfoSecurity on QRadar, BankInfoSecurity on the merger). Two months before that, on March 18, Cisco had closed the largest acquisition in its history, Splunk, for $28 billion in cash at $157 a share (SiliconANGLE). So I asked Alan what was going on.
“That’s right, yeah. Even they… the running joke is that Cisco couldn’t afford a Splunk license, so they bought Splunk outright. It was cheaper.”
Alan Braithwaite at 19:07
The joke has a serious version, and Alan gave it right afterward: Splunk is hard to disrupt because there is a massive deployment of it in the world and a generation of analysts trained on its query language, “and that’s not to be ignored, I think.” Two years later Futuriom’s Scott Raynovich put a number on the installed base in Forbes: Splunk contributes about $4 billion a year in revenue to Cisco, its growth has slowed, and customers describe volume-based licensing as “unpalatable for high-volume applications” (Forbes). That is the whole SIEM story in one sentence: the product is sticky, the bill scales with the data, and the data only goes up.
The other two deals closed around the episode. Exabeam and LogRhythm completed their merger on July 17, 2024, two days before this episode went out, keeping the Exabeam name and putting Christopher O’Malley in charge (Exabeam). Palo Alto closed the QRadar purchase in September for about $500 million, and the plan was never to run QRadar: IBM promised its SaaS customers a “seamless and cost-free migration” to Palo Alto’s Cortex XSIAM, which is to say the acquirer paid half a billion dollars for a customer list (The Register). Frank Wang, then a security investor and now a RunReveal customer, wrote a post two weeks after the double announcement titled “Is this the end of SIEM?” and answered, more or less, that it had been dead for a while, because cloud software ships with its own detection and most organizations need at most one of these things (Frankly Speaking). Alan’s answer on the tape was different. It was not that the category was dying. It was that the category had been assembled from five purchases that all do the same job.
Five purchases, one goal
Here is the sequence Alan described, and I have never heard a buyer disagree with it.
“They’re all pretty much usage-based in terms of their charging. So people are like, wow, this is pretty expensive. How can we reduce the cost? So they pick up a tool like Cribl. And they realize, oh, we need user entity behavioral analytics in order to be a more effective form of detection. So they pick up something like an Exabeam, or something along those lines. So they pay another vendor for that. And now you’ve got tons of alerts coming out of your SIEMs. You pick up a product to consolidate those alerts. And now you need a product for automation on top of that. So you pick up a SOAR.”
Alan Braithwaite at 19:17
The line that follows is the one I would put on the wall of any security team’s war room: “Like, they’re all products which are means to the same end, which is effective detection and response.” The mergers, in his reading, were the vendors admitting that. Exabeam was the behavioral analytics add-on and LogRhythm was the SIEM, and the merger was the two patches becoming one patch. Palo Alto already had the automation and the response layer in Cortex, and bought QRadar’s customers to feed it. “So I think a lot of this consolidation is driven by that, where they need all of the different features from the other companies that they haven’t built.”
What makes this more than a market-structure observation is where he lands: “the product is not the data itself, but the value it provides in the form of building effective detection and response.” That one sentence explains the whole company. If the value is the detection, then the ingestion, the normalization, the connectors and the storage are costs you should drive toward zero rather than features you should charge for. And it explains the pricing instinct underneath everything RunReveal did later: “When security is seen as a cost center, like, you don’t win by charging more than companies like Splunk.”
I said on the tape that the alphabet soup of mergers sounded like a nightmare for a small, ambitious company that has to stay on top of its security posture for compliance reasons and does not have time to twiddle with a whole collection of tools. I would say it more plainly now. We had Kabir Mathur of Leen on episode 63 on how buying more security tools can make things worse, and the detection stack is the clearest case. Four of the five purchases above exist because the first one was priced by the gigabyte.
Build for everybody, including the people who build their own
I asked Alan who the competition was and expected a list of vendors. He gave me one, then dismissed it.
“And there’s lots of ways that you can, like, kind of hand-wavy do a SIEM, but it doesn’t really get you everything you need that you want out of the product. So there’s a lot of options out there. A lot of people are starting to build their own, which is what we would consider kind of our biggest competitor, really, is people without a SIEM and people building their own SIEMs.”
Alan Braithwaite at 11:46
That is a founder who has done the customer calls. The teams that build their own are not hobbyists. They are the security engineers at companies big enough to feel the ingest bill and small enough to have no budget line for a second vendor, and they go through the vendor analysis, find nothing with “the right number of features, the right features themselves,” at “a price that is digestible,” and start writing Go. Panther’s founder, Jack Naglieri, started that way too, with the StreamAlert project inside Airbnb, before it became the company Databricks bought (ICONIQ on X). RunReveal’s response was to aim the product at exactly those teams: “we want to build something that even the smallest teams without a large budget can be able to deploy.” The philosophy, he said, came from Cloudflare and Segment, both companies that sold a free tier to a developer on a Tuesday and an enterprise contract to that developer’s company two years later. In October 2024 RunReveal made the first move in that direction concrete, letting any company detect threats in its Okta logs for free (RunReveal), which is a direct answer to the “people without a SIEM” half of the competition.
The second half, the people with no SIEM at all, is most of the founders reading this. My honest view, as someone whose company sits inside startups as their security team, is that the first useful detection program has nothing to do with a product. It is a decision about which three log sources you will keep and who gets paged when one of them says something strange. Alan’s own day-one answer, in a talk a year after this episode, was identity and authentication events first: the logins, the token creations, the admin changes (WorkOS, Enterprise Ready Conference 2025). That is the same list he gave me on the tape when he described what the product pulls out of the stream, “things like logins and API token creation.” If you only centralize one thing this quarter, centralize that. The scorecard further down starts there.
If you squint, a honeypot pipeline is a security log pipeline
RunReveal did not start as a SIEM. It started as a canary company.
“We started by building honeypots and canaries, similar to Thinkst Canaries. Maybe some of your listeners might be familiar with them. Famously bootstrapped, didn’t take on any VC money. Great product by founder Haroon Meer. And after some time, after some time building, we realized that a lot of folks in the industry don’t really know how to fit it into their budget.”
Alan Braithwaite at 12:51
The budget problem with canaries is real and it is worth understanding, because it is the same problem every security founder hits. A canary is a fake server or a fake document that nobody legitimate should ever touch, so a touch is a near-certain alarm. It is one of the highest-signal controls that exists. It also does not map to a line item. There is no compliance framework that says “deploy honeypots,” no questionnaire row for it, and a buyer with an established, bootstrapped incumbent to compare you to has no reason to take a chance on a new one. “We still believe that canaries and honeypots are a great and underutilized tool,” Alan said, and then the pivot:
“And so it was about that time we had started to build a data pipeline for collecting the events from those honeypots. And as we were building it, we started to realize: if you squint, this kind of looks like a security log pipeline. And we started to run some numbers and realized, hey, we can actually build a better SIEM.”
Alan Braithwaite at 13:54
The thing I love about this story is that the pivot was not a change of mission. The mission, in Alan’s words, was “kind of the singular goal, of helping people detect breaches more easily,” and the canary was one instrument for it. What changed was the instrument, once they noticed that the unglamorous plumbing underneath it was the part the market could not buy anywhere at a sane price. The public record lines up with the tape. The company introduced itself on April 10, 2023 as “the simple security data platform,” with a cheetah mascot named SeeSee and a plan to replace the SIEM for a small group of customers by the third quarter (RunReveal). Open beta came on July 11 (RunReveal). Then, on August 3, Alan published the pipeline itself as open source: Kawa, “an event processor so simple and easy to use that even grug brained developers like us can grok it,” written in Go, built around sources, destinations and handlers, with a stated target of thousands of events per second per core and at-least-once delivery (RunReveal, GitHub). That is the honeypot pipeline, squinted at, and given away.
Hacker News, as is its way, spent most of the Kawa thread on the name.
"Kawa is the name of a well-regarded scheme implementation in Java."
SeanLuke, on Hacker News, August 5, 2023
"The configuration examples are not valid JSON, due to trailing commas."
fl0ki, on Hacker News, August 5, 2023
Evan Johnson, Alan’s co-founder, replied to the second one that the config loader accepts both on purpose, because Go developers end lines with commas (Hacker News). Two months later the company announced impossible-travel detection for every customer, and that thread was a better preview of the product’s real problem: half the commenters were people whose laptop is on a corporate VPN while their phone is on home Wi-Fi, “flitting” across the country in the access logs, asking how any detection avoids the false positive (Hacker News). The answer RunReveal gave in its May 2024 fundraise post was correlated alerting: an unusual-hour login only fires if it also comes from an unknown device, and minor deviations roll into a daily summary (SiliconANGLE). That is the “pulling out those important signals” sentence from the tape, turned into a feature that a two-person security team can live with.
The database he did not have to build
Alan is, by his own description, a software engineer who spent a career thinking “about how to do log processing and scalable event processing.” His LinkedIn puts numbers on it: at Cloudflare from 2014 to 2017 he built and operated the event processing and analytics pipeline in Go, Kafka and Mesos and scaled it from 1.5 million events a second to more than 10 million, and at Segment from 2017 to 2022 he built the core pipeline and a product analytics platform on ClickHouse that ingested millions of events a second at peak and ended up in use across Twilio (LinkedIn). So when he says “scale is one problem we won’t have here at RunReveal, which is something I can say very confidently,” it is not bravado. It is a resume.
Which makes the decision not to build the database more interesting, not less. I asked him why ClickHouse.
“ClickHouse has been a great partner for us so far. We have a lot of experience with it from Cloudflare and Segment. Cloudflare was a very early adopter of it, pretty much as soon as it got open-sourced back in 2016. And I was honestly initially a skeptic. I was a bit dogmatic about how I viewed databases and what was necessary, and the fact that it didn’t have transactions out of the box made me very skeptical that it could actually provide value, so to speak. And I was very quickly proven wrong.”
Alan Braithwaite at 30:22
The Cloudflare story checks out in the company’s own engineering blog. In March 2018 Cloudflare described replacing a Postgres and Citus analytics stack with 36 ClickHouse nodes handling an average of 6 million HTTP requests a second, with peaks of 8 million, about 11 million rows a second inserted across all pipelines, and the old database retired as a single point of failure (Cloudflare). Alan says he was “a fly on the wall” on that project. At Segment he was the one pushing: a Hack Week project to show customers how their data flowed through the product, including how many properties were being dropped from events for privacy reasons, became a full product because “there was no database out there that could handle the high-cardinality data sets that ClickHouse can handle.” He wrote up the full case in November 2023, a post that opens with reading about ClickHouse in 2016, credits the 1991 log-structured merge tree for the speed, and admits to a few accidental Athena queries that cost thousands of dollars each (RunReveal). ClickHouse noticed. That month its own blog quoted him saying he had become convinced it would be “the de-facto standard database for OLAP applications” (ClickHouse on X).
"The more I learned about ClickHouse, the more I became convinced it will become the de-facto standard database for OLAP applications." Read how @RunReveal is using ClickHouse to build the fastest platform for security teams at all maturity levels to detect, respond, and investigate incidents.
ClickHouse (@ClickHouseDB) · November 8, 2023
Not building the database also meant living inside somebody else’s bugs, and RunReveal handled that the way a product security team would. In December 2023 the company reported a role-based access control bypass in ClickHouse’s query cache: results were cached by username rather than by role, so a user switching roles could read what another role’s row policy should have hidden. It became CVE-2024-22412, disclosed on March 18, 2024, and Evan’s write-up is a small classic of the genre: “All the code was working properly but two features, when used together, had unintended security-compromising consequences” (RunReveal).
.@RunReveal found a bug in the ClickHouse query cache and worked with the ClickHouse team to patch it. The CVE is CVE-2024-22412 and I think it's a great story of how all the code is correct, but two features don't play nicely with one another.
evan j (@ejcx_) · March 26, 2024
There is a second thing the ClickHouse decision bought, and Alan named it on the tape: breathing room to build the parts that are actually about security. The clearest example is the query language. Security analysts, he said, “don’t often love using SQL to do their investigations and write their detections,” and every incumbent had answered that with a proprietary language, Splunk’s SPL, Sumo’s, Microsoft’s Kusto, each of which is also a lock-in. So in February 2024 RunReveal released pql, an open source pipelined query language that compiles to SQL on any backend, under the Apache 2.0 license, with the explicit argument that “the major security vendors use proprietary languages as a source of vendor lock-in” and that there were no open source alternatives (RunReveal, GitHub). A team that leaves RunReveal takes its queries with it. That is a feature you can only afford to build when you are not also building the storage engine.
The bet behind the bet paid off too. ClickHouse the company spun out of Yandex in 2021 and raised a Series B at a $2 billion valuation that October. In May 2025, ten months after this episode, Khosla Ventures led a $350 million Series C at $6.35 billion (Bloomberg). In January 2026 Dragoneer led $400 million at $15 billion (Bloomberg). By then Alan was a fixture at its events: in May 2026 RunReveal announced he would speak at ClickHouse’s Open House conference on “a decade of real schema decisions” from operating the database across Cloudflare, Segment and a security platform handling petabyte-scale logs (RunReveal on X), and the talk is on YouTube.
One caveat that matters if you take Alan’s advice and run ClickHouse yourself. On October 30, 2026, the day before this page was written, ClickHouse published CVE-2026-116366, an integer overflow in ClickHouse Server that “under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code,” scored 9.5 under CVSS 4.0, with fixes in 26.10.3.7, 26.9.27.3, 26.8.36.3 and 26.3.62.3 and no workaround other than upgrading and restricting access to ports 8123 and 9000 (ClickHouse security changelog, Brandefense). ClickHouse Cloud and its bring-your-own-cloud deployments were patched before disclosure. A cluster you run in your own VPC is yours to patch, which is the trade you make when you own the data layer, and the next section is about why so many security teams make it anyway.
Bring your own database
When I asked Alan about his hardest day, he gave me the most useful answer a founder can give, which is a pattern rather than a story.
“There is a big learning that we’ve had on this journey, is that there’s no two security organizations that look alike. It is incredible the amount of diversity that organizations have in how they build and operate their security team and their security motion. And it’s, I guess, not that surprising when you consider that security is seen as mostly a cost center and not a value add to the business.”
Alan Braithwaite at 26:58
Every lost proof of concept “stings a little,” he said, and the reason it stings is that security buyers are “really critical buyers,” rightly, and the missing feature is different every time. The one feature that kept deals alive, in his telling, was the one most cloud SIEMs could not offer: “I think the fact that we’re not a cloud-only SIEM, we allow customers to bring their own database. Data residency is a big front-of-mind problem for us, especially in the security space.” RunReveal had shipped that in September 2023, as bring-your-own-database: your security data lives in a ClickHouse cluster you control, in your data center or your cloud account, and RunReveal runs the product on top (RunReveal). The alternative, he pointed out, was that companies look at cloud-only SIEMs, find them impossible to justify, “and build their own SIEMs, because the other on-prem options just cost way too much.”
Three years of product releases since say the market agreed. In March 2024 came Destinations, which streams your normalized data to wherever else you want it (RunReveal). In April 2026 RunReveal shipped a Kubernetes deployment for in-VPC and on-premise installs (RunReveal), in May it added search across raw logs sitting in S3-compatible object storage without ingesting them (RunReveal), and in August it added pipelines that mask card numbers and personal details before a log is ever stored (RunReveal). Every one of those is the same idea Alan described on the tape: the customer owns the data, the vendor owns the detections.
The best public picture of what that looks like in production is RunReveal’s case study with Harvey, the legal AI company, published in April 2026. Harvey’s detection and response team, which started with a single hire in April 2024, had about 8 terabytes a day of Azure network flow logs, between 100,000 and 210,000 unique IP addresses, and up to 3 to 5 billion rows in play. Before, the logs were something you went back to after an incident, and complex queries timed out or ran out of memory. “At this volume, doing any sort of aggregate statistics and proactive detection becomes nearly impossible,” Mike Parowski of Harvey said. After, with primary indexes on source, destination and port and materialized views for the aggregations, the 8 terabytes compressed to about 350 gigabytes a day, queries came back in seconds, and detection logic for traffic spikes, unusual ports and new external destinations ran continuously (RunReveal). The compression ratio is the quiet hero of that story. Columnar storage is why a terabyte of logs is not a terabyte of bill.
What RunReveal shipped after the tape stopped
Alan’s answer to what success looks like was two-layered. Short term, detect suspicious activity faster. Long term:
“There’s just so many security tools out there that are doing so many things, but they all have one commonality: they all depend on good data. So long term, we want to build security tools that require those data-intensive applications and could benefit from an open and extensible data platform. We learned very early on that selling to overworked security teams, just having the platform is not sufficient.”
Alan Braithwaite at 33:34
The release notes for the next two years read like a checklist against that paragraph. Detection as code arrived a month before the episode (RunReveal). Enrichments, which add context to every log, came in August 2024, and Sigmalite, an open source evaluator for the Sigma detection rule format, in September (RunReveal on enrichments, RunReveal on Sigmalite). Then the AI layer: a Model Context Protocol server in March 2025, so an assistant could query your security logs directly (RunReveal), an AI chat for investigations across terabytes of logs in June (RunReveal), and on July 29, 2025 a $7 million seed led again by Costanoa with Runtime Ventures, Modern Technical Fund and Okta Ventures, naming Cloudflare, Harvey, ClickHouse and Flexport as customers and claiming more than 40 integrations (RunReveal). The company that told me in 2024 it was raising “just enough runway to get us off the ground” raised its second round at nearly three times the first.
In February 2026 the AI layer became an agent. Turn on auto-triage in a detection rule and, when the alert fires, an agent opens a case, investigates, and attaches its queries, tool calls and reasoning to the case for a human to read and continue (RunReveal). Tier 1 detections, managed out of the box and fed straight to the agent, followed in May (RunReveal). And then Evan did something I wish every vendor selling an “AI SOC” would do: he published what it costs.
Across more than 50,000 agent investigations, the figure was about $2 per alert with a Sonnet-class model, a range of $1 to $3 per investigation, larger models costing more and not obviously investigating better, 100 complex alerts for roughly $200 and an hour of wall-clock time against days of human work, and one GuardDuty Kubernetes alert investigated end to end in about 90 seconds (RunReveal). The number that stuck with me came from RunReveal’s first user conference, RUNWAY, in San Francisco on September 29, 2026, where Max Baumgarten of Flexport told the room: “Tune your alerts. Your alerts cost money now.” (RunReveal). That is a genuinely new constraint. For twenty years a noisy detection cost you an analyst’s attention, which is expensive but invisible. Now it costs two dollars every time it fires, on an invoice. I wrote about the other side of that bill, an agent that cost $50,000 an hour to operate, and the calculator further down lets you run both numbers for your own alert volume.
One of Harvey's sign-in rules collected so many exceptions that it turned into a travel diary for their team.
RunReveal · Company post · October 2026
At RUNWAY, Mike Parowski (Security Engineer, Detection & Response at Harvey) used it as an example of how his team rebuilt detections with agents.
In January, they had 75 rules and about 70,000 alerts a week. Today they run around 1,300 detections with roughly 100x fewer alerts.
His point was that none of this is new. It's the detection engineering we've always done, just written in English.
Then the databases bought the SIEMs
Here is the paragraph I did not expect to write when I started this page. On June 16, 2026, Databricks agreed to buy Panther, the detection-as-code platform last valued at $1.4 billion, with chief executive Ali Ghodsi explaining that attackers now use agents and “You have to fight fire with fire.” Older alert management, he said, was “dead” (Reuters, via Yahoo Finance). Omdia’s note on the deal opened with the sentence that Alan had been saying on podcasts for three years: “Security is a data management problem” (Omdia).
Cloud, data, and AI have reshaped how modern companies build. Security teams now face the other side of that transformation: more data, wider attack surfaces, faster-moving threats, and rising expectations for response time. Today, @databricks announced its intent to acquire Panther, a leading AI SOC platform, to advance its security lakehouse vision. Since partnering with @runpanther in their Series B in 2021, we have watched @jack_naglieri and the team reimagine what security infrastructure looks like when it is built for scale, context, and action. We first met Jack when he was leading the StreamAlert open source project at Airbnb, building internal tooling to solve what legacy SIEM products could not: the scale, cost, and complexity of cloud-native environments.
ICONIQ (@ICONIQCapital) · June 16, 2026
Then, on September 1, Alan and Evan published a one-minute post titled “RunReveal is joining ClickHouse.” Their argument was the one from the tape, compressed: security is a data problem, the SIEM industry spent twenty years selling add-ons for its top risks, and fixing it has to start at the data layer. For customers, “an acceleration, not a disruption,” with contracts unchanged, and for security teams evaluating ClickHouse, RunReveal stays available through the bring-your-own-database model, with the data in a cluster the customer controls (RunReveal). ClickHouse’s side of the announcement called security data “the largest and fastest growing data workload in the enterprise,” promised to stay “a neutral foundation” for the other security companies that build on it, and said the thing it wanted most was RunReveal’s work on agentic investigation, where investigations that took analysts hours should take seconds (ClickHouse). Terms were not disclosed (Dealroom).
@ClickHouseDB just acquired @RunReveal. It might be a blueprint for the future of cybersecurity. 🧵 1️⃣ The Operational Tax: In a traditional SIEM (or heavy platforms like Panther), every question requires writing complex SQL or Python scripts and waiting on analysts. With RunReveal on ClickHouse, plain-English questions turn into instant answers in minutes. 2️⃣ Security is a Data Problem: Security telemetry is the most demanding data workload in tech. Traditional SIEMs charging by the gigabyte are dead walking. 3️⃣ 1 + 1 = 3: To scale independently, a modern SIEM startup would have to spend millions building its own analytical database. By merging with @ClickHouseDB, RunReveal gets raw columnar speed at native cost, while ClickHouse gains an AI-driven security application layer. 4️⃣ The Platform Wars: Databricks bought Panther. ClickHouse bought RunReveal. The battle to displace Splunk is being fought at the data infrastructure layer, not by legacy security vendors. The clock is ticking on what Snowflake does next.
Frank Wang (@ffwang2) · September 3, 2026
Frank’s longer post calls it “a textbook example of a 1 + 1 = 3 acquisition” and makes the point that Alan’s structure forced: a modern SIEM startup that wanted to scale on its own would have had to spend millions building the analytical database, so the one that never tried was the one worth buying (Frankly Speaking). Casey Ellis, the founder of Bugcrowd, which is the platform RunReveal used to report the ClickHouse bug two years earlier, sent his congratulations (Casey Ellis on X). And the valuation math that drove all of it is public. Windsor Drake’s first-quarter 2026 report puts AI-native security platforms at 12 to 20 times revenue or more and legacy SIEM vendors in transition at 1.7 to 5 times, with Rapid7 at 1.7 times on about one percent growth, and reads Palo Alto’s $500 million for QRadar as “signaling the sunset of legacy SIEM” (Windsor Drake). The two 2026 deals are the data companies buying their way into the high-multiple column.
So was Alan right? On the thesis, completely: the product was the detection, the data layer was a commodity he should rent, and the people who rented it best got acquired by their landlord at a premium. On the prediction, partly. He expected consolidation to produce “kind of this unified product experience” from the incumbents, and instead the unification came from below, from the databases. The thing I would add, having watched our own clients go through this, is that the acquisition changes nothing about what a founder should do. You still need the three log sources, the one owner, and a bill that does not scale with your success. Which brings us to the tools.
The founder notes
Everything above is the business. The rest of the tape is the person, and it is worth the time.
He got into Cloudflare by being persistent. Alan applied through Y Combinator’s Who’s Hiring thread, heard nothing for two months while Cloudflare kept posting, and kept emailing until “they’re like, who’s this guy who keeps sending us emails?” The interview panel included Nick Sullivan, who had just built Universal SSL, which Cloudflare launched for free on September 29, 2014 (Cloudflare). The interview question was how to authenticate an API request over plain HTTP, which forces you into sorting query parameters and hashing them, “but it’s all predicated on the fact that TLS or SSL is not present.” A decade later that problem has mostly dissolved, which Alan hesitated to say out loud and then said anyway. Nick was on this show too, on episode 38, and I worked with him on Apple’s DRM team before either of us knew Alan.
He does not call himself a security person, and then does. “I’ve always been a software engineer, which is why I haven’t really considered myself a security person, per se.” The counterevidence he offered: proxies to play RuneScape on library computers, domain admin in high school so he could put Quake III Arena on a network share, unencrypted campus Wi-Fi in college that made it “trivial to do very nefarious things on public networks” and drove his interest in cryptography. The honest answer to “do you think of yourself as a security guy” for most engineers is Alan’s: you were, you just had not accepted it. He has told the longer version of that story on Hackers to Founders (Transistor).
The first raise was sized on purpose. “We just announced our first raise, right before BSides and RSA,” he said, meaning the $2.5 million from Costanoa on May 1, 2024, whose partner John Cowgill said existing SIEMs were “too expensive, too difficult to implement and too hard to use” (SiliconANGLE). Alan’s framing: “Just enough runway to get us off the ground, and trying to avoid some of the challenges of raising too much.” I have written about staffing security with that same discipline, and I would add that a founder who can say “we’re just being very intentional about fundraising” on a podcast, with the investor listening, usually means it.
The best day is tomorrow, and also the onboarding call. “I think tomorrow is always the best day,” and then the real answer: getting on a call with a new customer, starting the onboarding on the call, and finishing it on the call, “seeing people’s faces when they realize it was that simple to connect something else.” Somewhere in there I looked at the RunReveal trust center, found SOC 2 Type 2 and hearts, and gave him a high five on tape. “We think security should be fun, too.” If your trust center does not have a SOC 2 Type 2 yet, this is the difference between Type 1 and Type 2, and it is work we do.
The worst day is every lost proof of concept. Not one day, a recurring sting, and his response to it was to stop being opinionated about features and let customers lead. That is a harder discipline than it sounds for a founder with a resume like his.
The book is Slaughterhouse-Five. “It’s kind of a classic anti-war novel, but it also explores themes of free will and the nature of time and space,” and, he said, almost unintentionally, Buddhist themes of being present. He is not a Buddhist. He practices mindfulness, and he thinks Western culture under-teaches “being content with what you have and not desiring too much out of the world.”
The parting words were two. I asked for final wisdom, he said I had put him on the spot, and then: “Hakuna matata, I guess.” The Lion King was his favorite children’s movie. “Yeah, you just gotta kind of roll with things and take things as they come.” Twenty-six months later he rolled with being acquired.
Did you catch it? A six-question quiz
Interactive · six questions
Did you catch it?
Six questions on what Alan actually said, with the timestamp for each answer. The answers are under each question for anyone reading without JavaScript.
-
Who did Alan name as RunReveal's biggest competitor?
- Splunk
- People without a SIEM, and people building their own
- The other security data platforms
b. "A lot of people are starting to build their own, which is what we would consider kind of our biggest competitor, really, is people without a SIEM and people building their own SIEMs." Transcript, 11:46.
-
What did RunReveal build first, before the security data platform?
- A query language
- A vulnerability scanner
- Honeypots and canaries
c. "We started by building honeypots and canaries, similar to Thinkst Canaries." The pipeline they built to collect honeypot events became the product. Transcript, 12:51.
-
Why was Alan initially skeptical of ClickHouse?
- It did not have transactions out of the box
- It was too expensive to run
- It only supported a proprietary query language
a. "The fact that it didn't have transactions out of the box made me very skeptical that it could actually provide value, so to speak. And I was very quickly proven wrong." Transcript, 30:22.
-
In Alan's account of the buying sequence, what does a team buy right after it sees the SIEM bill?
- A SOAR
- Behavioral analytics
- A pipeline tool like Cribl, to cut the ingest cost
c. "So people are like, wow, this is pretty expensive. How can we reduce the cost? So they pick up a tool like Cribl." Behavioral analytics, alert consolidation and the SOAR come after. Transcript, 19:17.
-
Which feature did Alan say kept deals alive with buyers who worry about data residency?
- A free tier
- Bring your own database
- A mobile app
b. "I think the fact that we're not a cloud-only SIEM, we allow customers to bring their own database. Data residency is a big front-of-mind problem for us, especially in the security space." Transcript, 26:58.
-
What were Alan's final words of wisdom?
- "Hakuna matata, I guess."
- "Ship it."
- "Log everything."
a. The Lion King was his favorite children's movie. "Yeah, you just gotta kind of roll with things and take things as they come." Transcript, 37:44.
Would your logs survive an incident?
Most of what RunReveal does is out of reach for a company with no security engineer this quarter. The questions underneath it are not. This scorecard asks eight of them about your own setup, each tied to a point on the tape, and tells you which gap an investigator would hit first.
Scorecard · eight questions
Would your logs survive an incident?
Answer for the company as it is, not the plan. Weighted toward the questions an incident responder asks in the first hour.
-
Are your identity events (sign-ins, admin changes, API token creation from Okta, Google Workspace, Microsoft Entra, GitHub) collected somewhere other than the product that generated them?
- No, they live in each product's own console
- Some sources, not all
- Yes, all of them, in one place we control
Alan's day-one signals are "logins and API token creation." An attacker's first move is a login, and a product's own console usually keeps 30 to 90 days.
-
If you had to say everything one employee's account did across your cloud and SaaS last Tuesday, how long would it take?
- Days, with help from each vendor
- A day, by hand
- Under an hour, from one place
This is the question every incident starts with. Harvey's team went from queries that timed out to answers in seconds. The tool matters less than having the data in one queryable place.
-
How far back can you actually search your security logs?
- Less than 30 days
- About 90 days
- Twelve months or more, searchable
Evan Johnson's rule of thumb: incidents need fast search across roughly a year of data, and compliance wants it kept for a year or more. Cheap retention and fast search pull in opposite directions, which is why the architecture matters.
-
Do you know what you pay per gigabyte ingested, and what happens to the bill when an engineer turns on a noisy new source?
- No idea, it is one line on an invoice
- Roughly, after the fact
- Yes, and noisy sources are routed to cheap storage on purpose
"They're all pretty much usage-based in terms of their charging." Every purchase in Alan's five-step stack exists because of this question. Route before you pay.
-
Does every alert that can page a person have a named owner and a written first step?
- No, alerts go to a channel and whoever notices
- The important ones do
- Every one, and unowned alerts get deleted
"Tune your alerts. Your alerts cost money now." An unowned alert is noise with a price tag. Monitoring and response is how we staff the owner.
-
Are your detections written down as code, versioned and reviewed, or clicked together in a console?
- Clicked together, nobody remembers why
- Some are in a repository
- All of them, with tests and a reviewer
Detection as code shipped a month before this episode. A detection you cannot diff is a detection you cannot trust after the person who wrote it leaves.
-
Could you move your security data and your detection queries to another tool without rewriting them?
- No, everything is in the vendor's language
- The data, yes. The queries, no.
- Yes, the data is in a store we own and the queries are SQL or an open language
Alan's reason for building pql: proprietary query languages are "a source of vendor lock-in." Ask the lock-in question before you sign, not at renewal.
-
If an AI agent investigates alerts for you, can you see every query it ran, every tool it called, and what each investigation cost?
- We have an agent and no idea what it does
- We can see the summary, not the steps
- Every step and the cost, attached to the case
RunReveal attaches the agent's query history, tool usage and reasoning to the case. The human in the loop is going away, so the audit trail has to replace it.
The first hour of an incident would be spent asking vendors for exports. Fix the top two questions first: get identity events out of their consoles and into one place you control, and make sure you can answer "what did this account do" from that place. Then give the three alerts that matter an owner.
You have the data and you would find the answer eventually. Retention, cost and ownership are where you lose days. Decide what a year of searchable logs should cost, route the noisy sources to cheap storage, and put the detections in a repository so the next person can read them.
Centralized identity events, fast answers, a year of history, owned alerts, detections as code. What is left is the portability question and the agent audit trail, which are exactly what your enterprise buyers will ask next.
The alert tax
Alan’s five-step stack exists because detection is priced by the gigabyte. The 2026 version of the problem is that triage is priced by the alert, whether a person does it or an agent does. Put your own numbers in.
Calculator
The alert tax
Hours a year your team spends looking at alerts, what that costs, and what an agent at RunReveal's published price would cost and give back. Rough by design. Change the numbers to yours.
At these numbers your team spends hours a year on alert triage. The cheaper move is still to delete the alerts nobody owns.
The $2 default is RunReveal's May 2026 estimate for a Sonnet-class model across more than 50,000 investigations, which its author calls non-scientific. Human minutes per alert and the share an agent can close are yours to set, and the net saving is floored at zero. Not counted: the alerts a person never gets to, which is usually the real cost.
Ten years on one line
Everything on this page sits on one timeline, from the open-source release of the database to the week this page was written. Filter it by thread to see how a 2016 engineering decision at Cloudflare became a 2026 acquisition.
Timeline · 2014 to 2026
Ten years on one line
Filter by thread. Dates are from the public record except where marked as Alan's own account on the tape.
- Universal SSL, and a persistent applicant
Cloudflare turns on free SSL for every customer (Cloudflare). Alan joins the same year, after emailing until the recruiters asked who he was, and interviews with Nick Sullivan about authenticating APIs without TLS.
- ClickHouse goes open source
Yandex releases the columnar database. Cloudflare adopts it almost immediately, and Alan, "a bit dogmatic about how I viewed databases," is quickly proven wrong.
- Segment, and a Hack Week project
Alan moves to Segment, builds the core pipeline, and turns a Hack Week product-observability tool on ClickHouse into a platform later used across Twilio (LinkedIn).
- Six million requests a second
Cloudflare describes its HTTP analytics pipeline on 36 ClickHouse nodes, averaging 6 million requests a second with peaks of 8 million (Cloudflare).
- A $2 billion database company
ClickHouse Inc., spun out of Yandex weeks earlier, raises a Series B at a $2 billion valuation.
- "Introducing RunReveal"
Evan Johnson and Alan announce "the simple security data platform," with a cheetah mascot and a plan to replace the SIEM for a small group of customers (RunReveal).
- Kawa
The event processor "for the grug brained developer" is open-sourced, and Hacker News debates the name (Hacker News).
- Bring your own database
Customers can keep their security data in a ClickHouse cluster they control (RunReveal).
- Cisco agrees to buy Splunk
$28 billion in cash, at $157 a share (SiliconANGLE).
- The ClickHouse meetup talk
Alan presents the "ridiculously fast threat detection pipeline" at the ClickHouse meetup in San Francisco (YouTube).
- pql
An open source pipelined query language that compiles to SQL, built as an answer to proprietary query languages (RunReveal).
- The Splunk deal closes
The largest acquisition in Cisco's history completes (SiliconANGLE).
- CVE-2024-22412
RunReveal's write-up of the ClickHouse query-cache bug it reported in December (RunReveal).
- $2.5 million
A seed round led by Costanoa Ventures, "just enough runway to get us off the ground" (RunReveal).
- Two deals in one day
Palo Alto Networks agrees to buy IBM's QRadar SaaS business, and Exabeam and LogRhythm agree to merge (BankInfoSecurity).
- "Is this the end of SIEM?"
Frank Wang's post on the consolidation: most organizations need at most one SIEM, and the category has been dead for a while (Frankly Speaking).
- Exabeam and LogRhythm close
The combined company keeps the Exabeam name (Exabeam).
- Episode 50
This conversation. "The product is not the data itself, but the value it provides in the form of building effective detection and response."
- QRadar SaaS closes
About $500 million, with customers promised a free migration to Cortex XSIAM (The Register).
- Okta logs, free
RunReveal lets any company detect threats in its Okta logs at no cost (RunReveal).
- An MCP server for your logs
Assistants can query security data directly (RunReveal).
- $6.35 billion
Khosla Ventures leads a $350 million Series C in ClickHouse (Bloomberg).
- $7 million
A second seed led by Costanoa, with Cloudflare, Harvey, ClickHouse and Flexport named as customers (RunReveal).
- Enterprise Ready Conference
Alan on identity-first logging and where agents help investigations (YouTube).
- $15 billion
Dragoneer leads $400 million in ClickHouse, more than doubling the valuation in under a year (Bloomberg).
- The autonomous agent
Alerts open a case and an agent investigates, with its queries and reasoning attached (RunReveal).
- Harvey, 8 terabytes a day
The case study behind the scale figures on this page (RunReveal).
- "About $2 per alert"
Evan publishes what agent investigations cost across more than 50,000 of them (RunReveal).
- Open House
Alan's session on ten years of ClickHouse schema decisions at the database company's conference (YouTube).
- Databricks agrees to buy Panther
"You have to fight fire with fire." Terms undisclosed, Panther last valued at $1.4 billion (Reuters).
- ClickHouse buys RunReveal
"An acceleration, not a disruption." Contracts unchanged, bring-your-own-database stays (RunReveal).
- RUNWAY
RunReveal's first user conference, in San Francisco. "Tune your alerts. Your alerts cost money now." (RunReveal).
- CVE-2026-116366
ClickHouse patches an unauthenticated remote code execution bug in ClickHouse Server, CVSS 9.5 (ClickHouse).
What to do this week
Four things, in the order an incident responder would need them.
- Centralize identity first. Get sign-ins, admin changes and token creation from your identity provider, your cloud and your source control into one place you control, with twelve months of retention. Alan’s day-one list is “logins and API token creation,” and RunReveal’s Okta tier is free if you want to see what a detection on those events looks like before you buy anything.
- Write the first three detections as code. New admin, new API token from a new location, a login from a country you have no employees in. Put them in a repository with a reviewer. If you cannot diff a detection, you cannot trust it after the author leaves.
- Give every alert an owner or delete it. “Tune your alerts. Your alerts cost money now.” That was true before agents and it is on the invoice now. The calculator above will tell you what the unowned ones cost.
- Ask the two exit questions before you sign. Where does the data live, and can I take my queries with me? Bring-your-own-database and an open query language were Alan’s answers in 2024. Any vendor you talk to in 2026 should have one. Once they’re in covers what the logs are for after the answer is yes.