RunReveal is a security data platform and SIEM for security teams that want their logs, detections and investigations in one place. Its aim is to make SIEM simpler to run and easier to pay for, so smaller teams can keep full coverage without a large data bill.
The platform can be used as a hosted service, deployed inside a customer’s own cloud account, or run on top of a database the customer already controls.
At A Glance
| Vendor | RunReveal |
|---|---|
| Category | Security operations, SIEM and security data platform |
| Deployment | SaaS, customer VPC or AWS GovCloud, or a customer-controlled database |
| Agentic AI | AI investigations, AI agent for detection rules, MCP server and native AI chat |
| Customers | Cursor, ClickHouse, Sentry, Temporal, AngelList |
| Certifications | SOC 2 Type 2 |
| Market classification | Security Operations |
What RunReveal Does
Many security teams end up stitching together separate log shippers, storage and a SIEM, and then paying for every gigabyte that passes through. RunReveal unifies that log tooling, puts AI at the centre of the workflow and simplifies the SIEM itself. Its billing follows the same idea: customers pay for the logs they store and query, not for what they ingest.
Detection is treated as engineering work, with rules kept in code and tested like software, and AI is used where analysts lose most time, in drafting rules and working through investigations. The same platform can serve as a SIEM, as the base for an AI SOC or as a way to get security data ready for analysis elsewhere.
Products
Security Data Lake
The Security Data Lake is where logs end up. It stores and queries terabytes of security data, and query performance scales linearly as volume grows, so teams can keep long histories online for hunting instead of archiving them out of reach. Dashboards and analytics report on what is being collected and detected.
Pipelines And Data Preprocessing
Pipelines handle the messy part of getting data in. Built-in pipelines transform, route, enrich and normalise logs from cloud, identity and SaaS sources before they are stored, which means detections and searches work on consistent fields rather than raw vendor formats.
Detections
Detection engineers write rules as code, test them and deploy them across all stored data in real time, with full rule-as-code support. An AI agent can draft production-ready SQL rules, which helps smaller teams build coverage without writing every query by hand.
AI Investigations
AI Investigations helps analysts work an incident faster. AI agents assist with the investigation and analysis. Analysts can work through the native AI chat, or connect external tools such as Cursor to RunReveal data through its Model Context Protocol server, and choose Claude, ChatGPT, Gemini or another model, so teams are not tied to a single provider.
How It Works
| Component | What it does |
|---|---|
| SaaS | The standard option is fully cloud hosted and run by RunReveal. |
| Bring your own cloud | Customers can deploy RunReveal inside their own VPC or in AWS GovCloud, keeping data in an account they control for security and compliance reasons. |
| Bring your own database | The hosted platform can also run on top of a database that the customer’s team controls. |
| Data flow | Logs arrive through the pipelines, are transformed and normalised, and land in the data lake. Detections and AI investigations then query the data where it sits. |
Integrations
| Area | Integrations |
|---|---|
| Cloud and storage | AWS, AWS S3, AWS Redshift, Azure, Azure Blob Storage, Cloudflare |
| Identity and access | 1Password, Auth0, Authentik, Bitwarden, Cloudentity |
| Security and DevOps sources | Abnormal AI, Atlassian, CircleCI |
Company Background
| Founded | 2024 |
|---|---|
| Founders | Evan Johnson, CEO and co-founder; Alan Braithwaite, CTO and co-founder |
| Funding | A $2.5 million seed round led by Costanoa Ventures; Runtime Ventures and mtf.vc are also investors |
Note: This overview is compiled from RunReveal’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.