Datadog

• Microsoft, CrowdStrike, and Wiz can bundle cloud security, SIEM, or workload protection into tenants and endpoints they already occupy, pressuring Datadog's security suite on price where it must win on merit.
• Datadog discloses no security-line revenue and publishes no named security references, so standalone traction rests mainly on a vendor-stated, press-reported Fortune 500 security adoption claim rather than audited revenue or named customers.
• A buyer seeking a best-of-breed tool in one security category may prefer a specialist over a platform suite whose advantage is correlation across products it has not yet bought.
• Cloud providers ship native security primitives for posture, workload, and application defense, which could erode the third-party security layer Datadog occupies for cloud-native buyers.
• The security products are model-agnostic and configuration-driven detection and protection software, so a well-funded rival could rebuild the capabilities without the platform correlation that differentiates them.
• The suite score treats the six lines as one, but Cloud Security and Cloud SIEM carry more independent recognition than Code Security, Workload Protection, and Sensitive Data Scanner, so a buyer evaluating a single weaker line may find less proof than the suite-level read implies.

Datadog's security suite sells to the SOC analyst and the DevOps engineer who already run Datadog for observability and need to secure the same cloud, applications, and data. The products name concrete pains: misconfigurations and vulnerabilities in cloud infrastructure, runtime attacks on apps and APIs, threats in host and container workloads, vulnerable code, and sensitive data leaking through logs.

The problem set is established rather than invented. Cloud Security tracks conformance to CIS, PCI DSS, and SOC 2 benchmarks, Cloud SIEM detects and investigates threats across cloud-scale environments using integrations and detection rules, and the 2025 results describe Datadog as an observability and security platform. These are recognized security budget concerns, so the buyer pain is corroborated by the categories the products map to.

The security buyer and the observability buyer overlap by design. Datadog reaches the security team through the engineering relationship it already owns, which lowers the cost of reaching the segment but also means the security products meet a buyer who arrived for monitoring rather than a dedicated security evaluation. [s1, s2, s7, s11]

The suite spans posture, runtime, detection, and data protection. Datadog Cloud Security uses agentless scanning to find vulnerabilities, misconfigurations, and identity risks and benchmarks compliance against CIS, PCI DSS, and SOC 2. Workload Protection performs in-kernel analysis of host and container activity with out-of-the-box threat detection.

The products enforce as well as observe. App and API Protection blocks malicious requests, users, or IPs in real time at the edge or in-app, a runtime control rather than an after-the-fact flag. Cloud SIEM surfaces threats with out-of-the-box integrations and detection rules, automates triage with agentic AI, and prioritizes with entity analytics, while Code Security combines static and runtime analysis and ranks findings with the Datadog Severity Score that factors CVSS and real-time threat activity.

The differentiating capability is correlation, not any single detector. Because the security telemetry shares a platform with APM traces, host metrics, and user sessions, an analyst can tie a threat to the service and user around it, which a standalone security tool cannot do without rebuilding the rest of the stack. [s1, s2, s3, s4, s5]

Datadog positions the security suite as part of one platform rather than a set of point tools. The pitch is that buyers secure cloud, applications, and data on the same platform they already use for observability, so the security products inherit the platform's reach and correlate with its telemetry.

That correlation is the entry point against specialists. Wiz contests cloud posture and workload coverage, CrowdStrike contests endpoint and SIEM, Snyk contests code security, and Microsoft can bundle Defender and Sentinel into Azure tenants. Against each, Datadog argues that a security signal correlated with full-stack observability beats a deeper but isolated tool.

The position is defended on breadth and contested on depth. A buyer consolidating tools onto one platform finds the suite compelling, while a buyer seeking the strongest tool in a single category may prefer a specialist whose product does one security job more deeply than a platform suite does. [s1, s3, s2]

Datadog can cross-sell the security suite into its existing platform relationships, a plausible motion rather than evidenced security-line selling. The cited pages show an integrated monitoring and security platform but not that security products are primarily bought as contract add-ons.

The clearest security-line signal is a vendor claim that the press carried. Datadog's chief product officer said one in four Fortune 500 companies rely on Datadog Security to detect, prioritize, and remediate threats, vulnerabilities, and misconfigurations. The company still discloses no security-segment revenue and names no individual security reference customers, so the figure is vendor-stated though independently reported, set against company-wide figures of 603 customers spending $1 million+ ARR and 28% revenue growth in fiscal 2025.

The shipping record corroborates the investment. Datadog ships six security product lines spanning posture, runtime, detection, code, and data, brought the Cloud SIEM Bits AI Security Analyst to general availability, and runs Datadog Security Labs, which publishes original security research, while Datadog separately researches, develops, and packages out-of-the-box threat detection. [s9, s5, s8]

Datadog is a public company on Nasdaq, and its 2025 results report 28% revenue growth and describe Datadog as an observability and security platform. Public-company disclosure puts its finances under scrutiny a private vendor avoids.

The security-specific credibility signal is twofold. Datadog Security Labs publishes original security research, including a library of intentionally vulnerable AWS environments for testing. Separately, Datadog researches, develops, and packages out-of-the-box threat detection in Workload Protection. Both are sustained, inspectable outputs stronger than leadership titles alone.

The center of gravity is platform engineering applied to security, not a standalone security-research pedigree. The credibility behind the suite is the demonstrated ability to operationalize new telemetry types at scale and extend the platform into security categories, rather than a heritage in adversarial security alone. [s7, s8, s5, s10, s12]

The strongest cited readiness signal is security-specific. Datadog's product chief told the press that one in four Fortune 500 companies rely on Datadog Security, which evidences security-line adoption directly. Delivering the suite as SaaS on a platform enterprises already run likely lowers the procurement hurdle, though that cross-sell read is an inference.

The products carry concrete compliance and data-handling claims. Cloud Security benchmarks against CIS, PCI DSS, and SOC 2, and Sensitive Data Scanner discovers, classifies, and redacts sensitive data across logs and traces to support GDPR, HIPAA, and CCPA, which addresses the data-exposure risk that makes teams cautious about centralizing telemetry.

The readiness story is strongest for consolidation buyers. A team standardizing security and observability on one platform gets correlated visibility and a single vendor to vet, while a team that wants the deepest tool in a single security category must weigh the suite's breadth against a specialist's depth. [s9, s1, s6, s13]

Add analyzed competitors to compare them side by side with Datadog.

Datadog targets the SOC analyst and the DevOps engineer at organizations securing cloud, applications, and data, many of whom already run Datadog for observability. The suite can extend an existing platform relationship, an inference about cross-sell rather than evidenced security-segment acquisition cost.

The segment evidence is security-specific. Datadog's product chief told the press that one in four Fortune 500 companies rely on Datadog Security across threats, vulnerabilities, and misconfigurations, which shows the suite reaches large enterprises in its own right rather than only as a platform add-on.

The security team is not always the primary persona. Cloud Security and Code Security speak to DevOps and engineering as much as to a dedicated security team, while Cloud SIEM and App and API Protection court the SOC directly, so the suite serves a blended buyer rather than one specialist role.

The suite covers posture, runtime, detection, and data protection. Cloud Security scans agentlessly for vulnerabilities, misconfigurations, and identity risks, Workload Protection runs in-kernel analysis of host and container activity, Cloud SIEM detects threats at log ingestion with out-of-the-box rules, Code Security combines static and runtime analysis, and Sensitive Data Scanner classifies and redacts sensitive data in real time.

The AI advantage is most visible in the SIEM. Cloud SIEM automates triage with agentic AI and prioritizes with entity analytics, and the press reports the Bits AI Security Analyst reached general availability to investigate Cloud SIEM signals autonomously, drawing on the same platform telemetry. Independent market coverage separately confirms that general availability, noting the agent autonomously investigates and triages security alerts across diverse data sources.

The differentiating advantage is correlation, not any single detector. Because the platform integrates security with application performance monitoring, log management, and user experience monitoring, an analyst on Datadog can see a threat beside the service and user context around it. That view comes with the platform for teams already using Datadog observability, reducing integration work relative to deploying a separate tool, and the size of that advantage depends on what telemetry the alternative already ingests.

Datadog can sell the security suite into its existing platform relationships, a plausible cross-sell rather than evidenced security-line acquisition. The cited pages support an integrated monitoring and security platform but not that security products are primarily bought as contract add-ons.

The clearest security-line proof is a vendor claim the press carried. Datadog's chief product officer said one in four Fortune 500 companies rely on Datadog Security, a security-specific adoption figure rather than a platform-only proxy, though Datadog discloses no security-segment revenue and names no individual security reference customers.

The shipping cadence shows sustained investment. Datadog ships six security product lines spanning posture, runtime, detection, code, and data, and brought the Cloud SIEM Bits AI Security Analyst to general availability, evidence the company funds the suite beyond a single launch.

Each cited product page links to pricing separately, and this snapshot does not evidence a single security bundle. The product pages for Cloud Security, Cloud SIEM, and Sensitive Data Scanner each carry their own pricing link. The product surfaces are consistent with usage-based pricing, though the cited pages do not state the billing meters. Cloud Security scans the infrastructure, Cloud SIEM analyzes log volume, and Sensitive Data Scanner processes data, so the natural unit each product would meter tracks the scope of what the buyer secures.

The product pages position each line inside the broader Datadog platform, which suggests an add-on path for existing customers. The cited pages do not prove the packaging or the procurement motion, so the cross-sell read is an inference rather than evidenced security-line selling.

Datadog delivers the security suite as SaaS on the Datadog platform, and the cited setup paths suggest less new infrastructure to deploy than a separate platform, especially for existing Datadog customers. Cloud Security offers agentless setup that scans the cloud in minutes, and Workload Protection reuses the existing Datadog Agent. An independent vulnerability advisory for the Datadog Linux Host Agent corroborates that this Agent is real, host-installed software that collects and forwards host telemetry.

Onboarding is engineered for low friction. Cloud SIEM ships out-of-the-box integrations and detection rules so teams activate packaged content rather than building their own, and App and API Protection offers both in-app and edge deployment options.

The operational model lets a team start small and add coverage. The agentless and existing-Agent setup paths and the out-of-the-box content mean a team can stand up one security product quickly and extend to others on the same platform.

The strongest cited trust signal is security-specific. Datadog's product chief told the press that one in four Fortune 500 companies rely on Datadog Security, which evidences security-line adoption directly rather than borrowing the observability platform's reputation. Adding a security product to an existing Datadog deployment likely extends a trust boundary, though that cross-sell read is an inference.

The products carry concrete compliance and data-handling claims. Cloud Security benchmarks against CIS, PCI DSS, and SOC 2, and Sensitive Data Scanner discovers, classifies, and redacts sensitive data across logs and traces to support GDPR, HIPAA, and CCPA, addressing the data-exposure risk that makes teams cautious about centralizing telemetry.

The trust story is strongest for consolidation buyers. A team standardizing security and observability on one platform gets correlated visibility and a single vendor to vet, while a buyer who needs the deepest tool in one security category must weigh the suite's breadth against a specialist's depth.

The security suite is the platform play in its categories. Its value rests on integrating security telemetry with the rest of the Datadog platform, correlating threats with backend services, infrastructure metrics, and user sessions, so each security line strengthens the platform and the platform strengthens the line.

The ecosystem reach is broad on the input side. Cloud SIEM ships out-of-the-box integrations and detection rules across cloud services, identity systems, and endpoints, and Code Security and App and API Protection instrument the application layer, which positions Datadog across the surfaces a SOC monitors.

That same breadth gives the suite a latent, not-yet-realized data position. Detecting threats across many customers' cloud, application, and identity telemetry lets the products observe attack patterns and misconfiguration trends at cross-customer scale, a corpus that could in principle tune detections or benchmark posture, though no shipping feature evidences Datadog mining cross-customer security telemetry that way today.

Datadog is a public company on Nasdaq, and its 2025 results report 28 percent revenue growth and describe Datadog as an observability and security platform. Public-company disclosure puts its finances under scrutiny a private vendor avoids. Its SEC annual filing independently states the same, describing Datadog as an observability and security platform whose SaaS suite spans cloud security.

The security-specific credibility signal is Datadog Security Labs. The team publishes original security research, including a library of intentionally vulnerable AWS environments for testing, a sustained and inspectable output stronger than leadership titles alone.

The center of gravity is platform engineering applied to security. The credibility behind the suite is the demonstrated ability to operationalize new telemetry types at scale and extend the platform into security categories, rather than a heritage in adversarial security alone.