According to a recent LinkedIn post from ClickHouse, cybersecurity provider Huntress is described as protecting 4 million endpoints and generating $175M in ARR as of 2025. The post discusses how, at that scale, a reported $70,000 per month database bill for its SIEM use case became a material cost pressure.
Claim 30% Off TipRanks
- Unlock hedge fund-level data and powerful investing tools for smarter, sharper decisions
- Discover top-performing stock ideas and upgrade to a portfolio of market leaders with Smart Investor Picks
The company’s LinkedIn post highlights that Huntress allegedly replaced Elasticsearch with ClickHouse for its SIEM workload and suggests this cut the database bill to about $5,000 per month. The post emphasizes that this was achieved while maintaining the same data volume and query patterns, implying a significant unit-cost reduction for large-scale security data processing.
As shared in the post, the technical discussion centers on handling approximately 200,000 records per second, along with lessons on sorting keys, data skipping indexes, and misconceptions around partitioning. For investors, this narrative points to ClickHouse positioning itself as a cost-efficient alternative for security analytics and other high-ingest data workloads.
If such case studies generalize, the post suggests potential for ClickHouse to gain share in log management and SIEM-type deployments where infrastructure costs are a key buying criterion. Greater adoption in these data-intensive security use cases could support longer-term ARR growth and reinforce ClickHouse’s competitive stance versus established search and analytics databases.