Datadog Cloud Security
Cloud Security is Datadog’s security suite ON the observability platform — Cloud SIEM (threat detection), CSPM (cloud misconfig), ASM (app/API protection) & code security — correlated with your observability (finding → trace → infra → code, one click). Security + ops, united (DevSecOps).
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Datadog platform family
This page covers Cloud Security — SIEM, CSPM & app security. The rest of the Datadog platform:
Quick facts
30-second orientation- Product
- Cloud Security — SIEM · CSPM · ASM
- Vendor
- Datadog (founded 2010 · NASDAQ: DDOG)
- The category
- Cloud security on the observability platform
- The idea
- Security + observability, ONE platform (DevSecOps)
- Cloud SIEM
- Threat detection across your logs & cloud activity
- CSPM
- Find cloud misconfigurations (the #1 breach cause)
- ASM
- Detect/block attacks on your apps & APIs
- The edge
- Security finding → trace → infra → code, one click
- Vs
- Wiz (CSPM), Splunk/Sentinel (SIEM), Prisma, Snyk
- In India via
- TechBag — scoping, cost mgmt, GST (Datadog bills USD)
Understand cloud security & DevSecOps before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is Datadog Cloud Security?
Datadog’s security suite on the observability platform — Cloud SIEM (threat detection), CSPM (cloud misconfig), ASM (app/API protection) & code security — correlated with your observability (DevSecOps).
Siloed security vs unified Datadog Cloud Security — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Unprotected / signature email | Cloud Security (Datadog) |
|---|---|---|
| Security vs ops | Separate tools & teams | One platform (DevSecOps) |
| Security data | Duplicated into a SIEM | Detect on data you already have |
| Findings | No operational context | Finding → trace → infra → code, 1 click |
| Cloud posture | Point-in-time audits | Continuous CSPM (misconfigs) |
| Identities | Over-permissioned | CIEM — right-sized |
| App security | Separate tools | Code → runtime (ASM), unified |
| Collaboration | Silos | Sec + ops, one platform |
| Cost | (varies) | Per-GB analysed — manage it |
Datadog Cloud Security puts SIEM, CSPM & app security ON your observability platform — findings correlated with traces, infra & code (DevSecOps). Honest: it's a security addition to observability — security-led orgs may want a specialist (Wiz/Splunk/Snyk) for deepest depth. It adds to the Datadog bill. TechBag advises & manages cost + GST.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Cloud SIEM
Detects threats and suspicious behaviour across the logs and cloud activity you already collect, giving security monitoring (SIEM) without a separate, heavy SIEM.
CSPM & CIEM
Cloud Security Management checks your AWS, Azure and GCP configuration against best practice and compliance, and extends to CIEM (risky entitlements) and CWPP.
App & API Protection (ASM)
Application Security Management detects and helps block attacks on your apps and APIs in real time, using the APM instrumentation you may already have.
Code & Supply-Chain Security
Code Security (SAST/SCA) finds vulnerabilities in your code and dependencies, plus IaC and secret scanning, so issues are caught before production.
One Platform — the edge
On the Datadog platform, a security finding is one click from the trace, the affected infrastructure and the code, and security and ops share one view.
Every signal and data store in one view, so questions are answered in place, not pieced together from silos.
Twelve capabilities. Detect, posture, protect.
Datadog puts security on your observability platform — threat detection, cloud posture, app protection — correlated with full context — part of the Datadog portfolio.
Cloud SIEM — Threat Detection
Detects threats across your logs and cloud activity with out-of-the-box rules and behavioural analytics, without a separate SIEM.
Behavioural & Anomaly Detection
Flags unusual access, lateral movement and data exfiltration signals, so attacks that evade simple rules are still caught.
Fast, Contextual Investigation
Each detection is one click from the related logs, traces and infrastructure, so you understand and respond to threats fast.
Cloud Posture (CSPM)
Scans AWS, Azure and GCP config for misconfigurations — open buckets, over-permissive access, unencrypted data — the #1 breach cause.
Cloud Identity (CIEM)
Analyses cloud identities and entitlements for risky, excessive or unused permissions, so you can right-size access.
Workload Protection (CWPP)
Detects threats and suspicious activity on running hosts and containers, adding runtime defence to posture checks.
Compliance Reporting
Continuously assesses and reports compliance against CIS, PCI, SOC 2, HIPAA and more, rather than point-in-time audits.
App & API Protection (ASM)
Detects and helps block attacks on apps and APIs in real time, showing which vulnerable code is targeted, via APM instrumentation.
Code Security (SAST/SCA)
Finds vulnerabilities in your own code (SAST) and open-source dependencies (SCA) before production, on the same platform.
IaC & Secret Scanning
Scans infrastructure-as-code and detects leaked keys and credentials, so misconfigurations and secrets are caught before a breach.
Vulnerability Management
Prioritises vulnerabilities by real risk — exposed, exploited, on a critical asset — using platform context, so you fix what matters.
Security + Observability, United
Security on the SAME platform as observability: a finding is one click from the trace, infrastructure and code, for DevSecOps teams.
Watch Datadog Cloud Security in action
The overview, getting started, and the core workflows.
Datadog Cloud SIEM Demo
Threat detection in your data.
Datadog Cloud Security Management (CSPM) Demo
Find cloud misconfigurations.
Datadog Cloud Security: Unified Security & Observability
Security on one platform.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Data is everywhere. Answers, in one place.
Here’s what genuinely sets Datadog Cloud Security apart (and where specialists fit).
Security and observability on ONE platform — the DevSecOps advantage
The telemetry that shows how systems perform — logs, cloud activity, app traffic — also reveals attacks. Datadog Cloud Security runs detection on that same data, so a finding is one click from the trace, host and code, and security and DevOps teams work on one platform (DevSecOps).
Cloud SIEM — threat detection on the data you already collect
Cloud SIEM applies out-of-the-box rules and behavioural analytics to the logs and cloud activity you already collect in Datadog, with no separate SIEM to deploy and feed. Detections link to related logs and traces. Security-led SOCs may still want the depth of Splunk ES or Microsoft Sentinel.
Cloud posture (CSPM) — fix the misconfigurations that cause breaches
Misconfigurations — public buckets, over-permissive IAM, unencrypted data — are the #1 cause of cloud breaches. Datadog CSPM continuously checks AWS, Azure and GCP against frameworks such as CIS and PCI, prioritises the riskiest, and extends to CIEM and workload protection. Wiz goes deeper on posture.
From code to runtime — protect apps and catch vulnerabilities early
Datadog Cloud Security covers apps from code to runtime: SAST and SCA, IaC and secret scanning before production, and ASM to detect and help block live attacks on apps and APIs, using APM instrumentation to see which vulnerable code is targeted. Snyk goes deeper on code security.
From the observability leader — honest on where specialists fit, and cost
Datadog (NASDAQ: DDOG) is adding security to its observability platform, and unification is its edge. For security-led teams, specialists go deeper: Wiz for CSPM, Splunk ES or Microsoft Sentinel for SIEM, Snyk for code. Cloud SIEM is per-GB analysed on top of log costs. TechBag advises on the mix; GST billing.
The honest scope
Datadog Cloud Security adds Cloud SIEM, CSPM with CIEM, ASM, Code Security and vulnerability management to the observability platform, with findings linked to trace, infra and code. Security-led teams may prefer Wiz, Splunk ES, Prisma Cloud or Snyk, and Cloud SIEM’s per-GB pricing adds to the bill.
The numbers behind the platform
What your Datadog Cloud Security journey looks like
Security scoping
Your cloud estate, unified or best-of-breed orientation, which capabilities (SIEM, CSPM, ASM, code) and cost. TechBag scopes it.
Posture & detection
Turn on CSPM to find cloud misconfigurations and Cloud SIEM to detect threats on the data you already collect.
App & code security
Add ASM (protect running apps and APIs via APM), Code Security (SAST/SCA) and IaC and secret scanning, from code to runtime.
Investigate & manage cost
Use finding → trace → infra → code correlation to investigate, and manage per-GB cost. TechBag advises (GST; Datadog bills USD).
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“A threat in our logs is one click from the trace, the affected infrastructure and the code, and security and DevOps share one platform.”
“Cloud SIEM detects threats on the logs and cloud activity we already collect in Datadog, with no separate SIEM to deploy and feed.”
“CSPM keeps finding our cloud misconfigurations — the #1 breach cause — and CIEM flags over-permissioned identities.”
“ASM uses our existing APM instrumentation to see attacks on our apps and APIs from inside, and shows which vulnerable code is targeted.”
“TechBag was honest: we use Datadog for unified security and ops, but kept Wiz for the deepest CSPM, where a specialist still fits.”
“Cloud SIEM is per-GB analysed on top of our logs, so cost compounds. TechBag scoped what to analyse and managed the spend.”
“Code Security (SAST/SCA) plus IaC and secret scanning catch vulnerabilities before production, on the same platform as runtime.”
“For our cloud-first DevSecOps org, security united with observability was the model we wanted. TechBag handled scoping, cost and GST.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the cloud security (SIEM/CSPM/CNAPP) market — tap any vendor to see why it sits where it does.
TechBag Cloud Security Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Security ON the observability platform (unified). This page's product.
Security Depth × Observability Unification
The grid nobody publishes — security depth vs unification with observability.
Unified, broad (addition to obs).
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Datadog Cloud Security vs the security field
Wiz (CSPM), Splunk/Sentinel (SIEM), Prisma Cloud, Snyk (code) and cloud-native — honest lanes; the edge is security UNIFIED with observability (context + DevSecOps). Security-led, deepest single area? A specialist may go deeper — we say so.
| Dimension | Datadog Cloud Security | Wiz (CSPM/CNAPP) | Splunk ES / Sentinel (SIEM) | Prisma Cloud | Snyk (code) | Cloud-native security |
|---|---|---|---|---|---|---|
| Position | Security ON the observability platform (unified) | Cloud-security posture/CNAPP leader | Enterprise SIEM leaders | Broad dedicated CNAPP (Palo Alto) | Developer/code security leader | Cloud-native security (per cloud) |
| Unified with observability (correlation) | Yes — the distinctive edge | Security-focused | Some (Splunk Observability) | Security-focused | Code-focused | Some (per cloud) |
| Cloud SIEM / threat detection | Yes (on your data) | Some (posture-led) | Deepest enterprise SIEM | Some | No | Basic (GuardDuty etc.) |
| CSPM (cloud misconfiguration) | Strong | The deepest (leader) | Some | Strong (broad CNAPP) | No (code-focused) | Native tools |
| App/API runtime protection (ASM) | Yes (leverages APM) | Some | No | Yes (WAAP) | No | Cloud WAF |
| Code security (SAST/SCA) | Yes | Some | No | Yes | The leader (developer-first) | No |
| Best for security-led (deepest single area) | Unified, broad (addition to obs) | Deepest cloud posture | Deepest SIEM | Broad dedicated CNAPP | Deepest code security | Per-cloud |
| Cost / model | Adds to Datadog bill (per-GB analysed) | Enterprise-priced | Often costly (volume) | Enterprise-priced | Developer-based | Per-cloud |
| Best fit | Unified security + observability (DevSecOps; Datadog users) | Deepest cloud-security posture (security-led) | Deepest enterprise SIEM/SOC | Broad dedicated CNAPP | Deepest developer/code security | Single-cloud native security |
Which data, analytics & observability approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Datadog Cloud Security if…
- You want security UNIFIED with observability — shared data, full context (finding → trace → infra → code), DevSecOps
- You want Cloud SIEM on data you already collect, plus CSPM (cloud misconfig), ASM (app protection) and code security
- You already use Datadog for observability — the correlation and shared platform are the payoff
- You want security-and-ops on one platform — with TechBag advising where specialists fit and managing cost
Wiz if…
- You're security-led and want the deepest cloud-security posture / CNAPP
Splunk ES / Microsoft Sentinel if…
- You want the deepest, dedicated enterprise SIEM for a security-led SOC
Prisma Cloud if…
- You want a broad, dedicated CNAPP (Palo Alto ecosystem)
Snyk if…
- You want the deepest developer-first code/dependency security
Datadog Cloud Security is one of 36 SIEM & log management products TechBag carries. The SIEM & Log Management guide narrows them to a shortlist and shows the reasoning. →
What could this save you?
Drag the sliders (count cloud resources/hosts; security-hour cost as loaded rate). Estimates contrast siloed security (separate SIEM, context-poor findings, misconfigurations missed) vs Datadog Cloud Security (SIEM + CSPM on your data, findings in full context) — the biggest win is preventing breaches (esp. via CSPM fixing misconfigurations, the #1 cause). NB: it adds to the Datadog bill — TechBag manages it. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Datadog Cloud Security is priced per-unit (public) by component (Cloud SIEM per-GB analysed, CSPM/ASM per host…) — but ADDS to Datadog's compounding bill. Datadog bills in USD. TechBag scopes the components, advises unified-vs-specialist (vs Wiz/Splunk/Snyk), manages cost, and handles GST.
Cloud Security (SIEM + CSPM + ASM)
Best for unified security + observability
- Per-unit pricing by component — but ADDS to the Datadog bill
- Cloud SIEM, CSPM (+CIEM/CWPP), ASM, code security
- Correlated: finding → trace → infra → code (DevSecOps)
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
+ Honest advice & managed cost
Best with TechBag
- Unified (Datadog) vs specialist (Wiz/Splunk/Snyk) — advised honestly
- TechBag scopes components + manages the added cost
- Datadog bills USD; TechBag handles cost mgmt + GST
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Do you want security united with observability (DevSecOps), with shared data and findings in full context?
Are cloud misconfigurations (the #1 breach cause) checked continuously, with risky identities flagged by CIEM?
Do you need security monitoring without a separate SIEM, on the logs and cloud activity you already collect?
Are your apps protected code-to-runtime? ASM protects running apps/APIs (leveraging APM); Code Security catches vulnerabilities early.
Security-led with deep single-area needs? Weigh Wiz for CSPM, Splunk or Sentinel for SIEM, Snyk for code. TechBag advises.
Already use Datadog for observability? The security correlation and shared platform are the payoff — unified security-and-ops.
Cloud Security adds to Datadog's bill (Cloud SIEM per-GB analysed, on top of logs) — manage it. TechBag scopes and governs cost.
Datadog bills in USD — TechBag scopes, manages cost, advises unified-vs-specialist, and handles GST.
Questions buyers ask
Ready to unite security with your observability?
Scope Datadog Cloud Security (SIEM, CSPM, app security — correlated with your observability, DevSecOps) — and let a TechBag advisor honestly assess whether Datadog's unified approach fits or a specialist (Wiz/Splunk/Snyk) is warranted, manage the cost, and handle GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.