---
title: "Intelligent security at ClickHouse speed: How Cogent Security built an AI-native vulnerability management platform"
description: "Enterprise security defenders face shrinking exploitation windows alongside massive volumes of vulnerability findings across disconnected tools. To overcome query bottlenecks from traditional relational databases, Cogent Security designed a lakehouse serving architecture using Apache Iceberg and per-customer ClickHouse instances. The architecture relies on query-driven denormalized tables, custom compression codecs, and pre-computed projections to serve hundreds of millions of rows with sub-second latency. On top of this data layer, Cogent implemented an agentic text-to-SQL system that iteratively queries live data, references an in-house Ontology Service for semantic context, and applies majority-voted evaluations. This combination improved text-to-SQL accuracy from 40% to 94% while providing sub-three-second response times across 98.7% of queries at 100 million rows."
---

# Intelligent security at ClickHouse speed: How Cogent Security built an AI-native vulnerability management platform

[Clickhouse](https://yomu.fyi/company/clickhouse) · ClickHouse · Mar 24, 2026

**Type:** Problem & solution

## Summary

Enterprise security defenders face shrinking exploitation windows alongside massive volumes of vulnerability findings across disconnected tools. To overcome query bottlenecks from traditional relational databases, Cogent Security designed a lakehouse serving architecture using Apache Iceberg and per-customer ClickHouse instances. The architecture relies on query-driven denormalized tables, custom compression codecs, and pre-computed projections to serve hundreds of millions of rows with sub-second latency. On top of this data layer, Cogent implemented an agentic text-to-SQL system that iteratively queries live data, references an in-house Ontology Service for semantic context, and applies majority-voted evaluations. This combination improved text-to-SQL accuracy from 40% to 94% while providing sub-three-second response times across 98.7% of queries at 100 million rows.

## Context

Enterprise vulnerability remediation struggles to keep pace with AI-assisted exploits, as mean time-to-exploit dropped from 2.3 years in 2018 to 1.6 days in 2026. Security teams face hundreds of millions of findings across siloed sources, while existing Postgres setups suffered from high query latencies, such as p99 response times of 25 seconds, crippling real-time analysis and agent workflows.

## Approach / What changed

Cogent Security migrated its serving layer to isolated, per-tenant ClickHouse databases loaded from Apache Iceberg tables via dbt and Spark. The data model uses query-driven denormalization, projections, and data-specific compression codecs. On top of ClickHouse, Cogent deployed an agentic text-to-SQL Chart Agent equipped with live execution tools, interleaved reasoning, a golden query bank, tenant memory, and a custom Ontology Service that aligns physical schemas with business semantics.

## Takeaways

- Switching from Postgres to query-driven ClickHouse tables with projections reduced query latency from a 25-second p99 to 2.5 seconds at 100 million rows without caching.
- Moving from a single-shot LLM approach to an agentic loop with live SQL execution, memory banks, and pre-computed ClickHouse projections increased text-to-SQL accuracy from 40% to 94%.
- An in-house Ontology Service prevents agent confusion during schema migrations and accommodates customer-specific custom fields by co-locating semantic definitions with physical schemas.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Data Pipelines](https://yomu.fyi/topic/data-pipelines), [LLMs](https://yomu.fyi/topic/llm), [Performance](https://yomu.fyi/topic/performance), [Scalability](https://yomu.fyi/topic/scalability)

- Source: [Clickhouse](https://clickhouse.com/blog/cogent-security)
- Source URL: https://clickhouse.com/blog/cogent-security
- Ingested by Yomu: 2026-08-28T01:23:04.618Z

[Read original post](https://clickhouse.com/blog/cogent-security)