- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Cloud Security
Secure the front door. Email is where most attacks arrive — Cloud Security is Datadog’s security suite ON the observability platform — Cloud SIEM (threat detection), CSPM (cloud misconfig), ASM (app/API protection) & code security — correlated with your observability (finding → trace → infra → code, one click). Security + ops, united (DevSecOps).
Buy through TechBag
Same software. Better outcome — at no extra cost.
Free, vendor-neutral, 30 minutes
How it’s rated
Full scoreboard ↓Quick answer
The Datadog platform family
This page covers Cloud Security — SIEM, CSPM & app security. The rest of the Datadog platform:
Quick facts
30-second orientation- Product
- Cloud Security — SIEM · CSPM · ASM
- Vendor
- Datadog (founded 2010 · NASDAQ: DDOG)
- The category
- Cloud security on the observability platform
- The idea
- Security + observability, ONE platform (DevSecOps)
- Cloud SIEM
- Threat detection across your logs & cloud activity
- CSPM
- Find cloud misconfigurations (the #1 breach cause)
- ASM
- Detect/block attacks on your apps & APIs
- The edge
- Security finding → trace → infra → code, one click
- Vs
- Wiz (CSPM), Splunk/Sentinel (SIEM), Prisma, Snyk
- In India via
- TechBag — scoping, cost mgmt, GST (Datadog bills USD)
Understand cloud security & DevSecOps before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is Datadog Cloud Security?
Datadog’s security suite on the observability platform — Cloud SIEM (threat detection), CSPM (cloud misconfig), ASM (app/API protection) & code security — correlated with your observability (DevSecOps).
Siloed security vs unified Datadog Cloud Security — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Unprotected / signature email | Cloud Security (Datadog) |
|---|---|---|
| Security vs ops | Separate tools & teams | One platform (DevSecOps) |
| Security data | Duplicated into a SIEM | Detect on data you already have |
| Findings | No operational context | Finding → trace → infra → code, 1 click |
| Cloud posture | Point-in-time audits | Continuous CSPM (misconfigs) |
| Identities | Over-permissioned | CIEM — right-sized |
| App security | Separate tools | Code → runtime (ASM), unified |
| Collaboration | Silos | Sec + ops, one platform |
| Cost | (varies) | Per-GB analysed — manage it |
Datadog Cloud Security puts SIEM, CSPM & app security ON your observability platform — findings correlated with traces, infra & code (DevSecOps). Honest: it's a security addition to observability — security-led orgs may want a specialist (Wiz/Splunk/Snyk) for deepest depth. It adds to the Datadog bill. TechBag advises & manages cost + GST.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Cloud SIEM
Detect threats, attacks and suspicious behaviour across your logs and cloud activity — the same data you're already collecting — so you get security monitoring (SIEM) without deploying a separate, heavy SIEM. Detection on the telemetry you already have. Threats, surfaced from your data.
CSPM & CIEM
Cloud Security Management continuously checks your cloud configuration (AWS/Azure/GCP) against best practices and compliance, finding misconfigurations (the #1 cause of cloud breaches) — extending to CIEM (risky identities/entitlements) and workload protection (CWPP). Fix your cloud posture before attackers exploit it. Secure config, continuously.
App & API Protection (ASM)
Application Security Management detects and helps block attacks against your applications and APIs in real time — and identifies vulnerable code paths under attack — so your running apps are defended (leveraging the APM instrumentation you may already have). Runtime app protection, from inside. Your apps, defended live.
Code & Supply-Chain Security
Code Security (SAST/SCA) finds vulnerabilities in your code and dependencies, plus IaC and secret scanning — so you catch security issues in your code and supply chain BEFORE production. Shift-left security, on the same platform. Fix vulnerabilities early.
One Platform — the edge
Because it's all on the Datadog platform, a security finding is correlated with full observability context — one click from the trace, affected infrastructure and code — so investigation is fast and context-rich, and security and ops teams share one platform (DevSecOps). Security, in operational context.
One agent on every machine, one console over all of them — modules attach without a second operational world.
Twelve capabilities. Detect, posture, protect.
Datadog puts security on your observability platform — threat detection, cloud posture, app protection — correlated with full context — part of portfolio, and paired with the human firewall.
Cloud SIEM — Threat Detection
Detect threats and attacks across your logs and cloud activity — with out-of-the-box detection rules and behavioural analytics — so you spot security signals in the data you already collect, without a separate heavy SIEM. Security monitoring on your existing telemetry. Catch the attack in your data.
Behavioural & Anomaly Detection
Detect suspicious behaviour and anomalies (unusual access, lateral movement, data exfiltration signals) — so attacks that evade simple rules are still caught. Behavioural detection catches the subtle threats. See the abnormal.
Fast, Contextual Investigation
Investigate security findings with full observability context — one click from a detection to the related logs, traces and infrastructure — so you understand and respond to threats fast. Context makes security investigation fast; Datadog's unified platform provides it. Investigate with the full picture.
Cloud Posture (CSPM)
Continuously scan your cloud config (AWS/Azure/GCP) against security best practices and compliance frameworks — finding misconfigurations (open buckets, over-permissive access, unencrypted data) — the #1 cloud-breach cause. Fix your posture before it's exploited. Secure cloud config, continuously checked.
Cloud Identity (CIEM)
Analyse cloud identities and entitlements — finding risky, excessive or unused permissions — so you can right-size access and reduce the attack surface. Over-permissioned identities are a major cloud risk; CIEM addresses them. Least-privilege in the cloud.
Workload Protection (CWPP)
Protect your cloud workloads (hosts, containers) at runtime — detecting threats and suspicious activity on the workloads themselves — so runtime attacks are caught. Workload runtime protection complements posture (config) with runtime defence. Defend the running workload.
Compliance Reporting
Continuously assess and report compliance against standards (CIS, PCI, SOC 2, HIPAA and more) — so you can demonstrate and maintain cloud compliance. Continuous compliance beats point-in-time audits. Stay (and prove you're) compliant.
App & API Protection (ASM)
Detect and help block attacks against your applications and APIs in real time — identifying which vulnerable code is under attack — leveraging the APM instrumentation you may already have. Runtime app protection from inside the application. Defend your apps as they run.
Code Security (SAST/SCA)
Find vulnerabilities in your own code (SAST) and open-source dependencies (SCA) — shift-left, catching security issues before production — on the same platform. Finding vulnerabilities early (in code) is cheaper and safer than in production. Secure code, before it ships.
IaC & Secret Scanning
Scan infrastructure-as-code and detect leaked secrets (keys, credentials in code) — so misconfigurations and exposed secrets are caught before they cause breaches. Securing IaC and finding leaked secrets closes common attack paths. No secrets in your code.
Vulnerability Management
Manage vulnerabilities across your stack — prioritised by real risk (is it exposed, exploited, on a critical asset?) using the platform's context — so you fix what matters. Risk-based prioritisation cuts the vulnerability noise. Fix the vulnerabilities that count.
Security + Observability, United
The edge: security on the SAME platform as observability — so a finding is one click from the trace, infrastructure and code, and security + ops teams share one platform (DevSecOps). Unified security-and-observability speeds detection, investigation and collaboration. Security, in full context.
Watch Datadog Cloud Security in action
The overview, getting started, and protecting M365 email.
Datadog Cloud SIEM Demo
Threat detection in your data.
Datadog Cloud Security Management (CSPM) Demo
Find cloud misconfigurations.
Datadog Cloud Security: Unified Security & Observability
Security on one platform.
Want a live, India-context walkthrough on your own fleet?
Book a guided demo →The endpoint catches what arrives. Email stops it arriving.
Here’s what genuinely sets Datadog Cloud Security apart (and where specialists fit).
Security and observability on ONE platform — the DevSecOps advantage
The defining reason to consider Datadog Cloud Security is that it puts security on the SAME platform as your observability — so security findings come with full operational context, and security and ops teams share one platform, reflecting the modern convergence of security and observability. Security and observability are converging: here's a key modern insight: the SAME telemetry that tells you how your systems are PERFORMING (logs, cloud activity, application traffic, infrastructure signals) also reveals ATTACKS. A suspicious login is in your logs; an attack on your app shows in your traffic; a misconfiguration is in your cloud config. So the data for observability and the data for security overlap heavily. Traditionally, though, security tools and observability tools are completely SEPARATE — different platforms, different data (often duplicated), different teams (security vs DevOps/SRE), different views. This separation is inefficient and slow: security findings lack operational context, security and ops teams work in silos, and you duplicate data and effort. Datadog's unified approach: Datadog Cloud Security puts security on the SAME platform as observability: Shared data — security detection runs on the SAME telemetry (logs, cloud activity) you already collect for observability — no separate data pipeline. Shared platform — security teams and DevOps/SRE teams use ONE platform, one view. Full context — a security finding is CORRELATED with the observability context: an attack detected in your logs is one click from the related trace (which request), the affected infrastructure (which host), and the code — so you instantly see the full picture. DevSecOps — security and ops collaborate on one platform, embedding security into operations (the 'DevSecOps' model). So security isn't a separate silo — it's part of your observability platform, with shared data, full context and shared teams. Why it matters — the advantages: Faster detection and investigation — security findings come with full operational context (traces, infra, code), so you understand and respond faster. Shared platform and data — no duplicating telemetry across separate security and observability tools; one platform, one data set. Team collaboration (DevSecOps) — security and ops teams work together on one platform, breaking silos. Efficiency — one platform to run and pay for (though cost management still matters). For organisations wanting to unite security with operations — the DevSecOps direction the industry is moving — having them on one platform is genuinely valuable. It's Datadog's distinctive angle on security: leveraging its observability platform and data for security too. The value: Datadog Cloud Security puts security on the SAME platform as observability — shared data, full operational context (finding → trace → infra → code), and shared teams (DevSecOps) — so security is faster, contextual and collaborative. For uniting security and ops, this matters. TechBag helps organisations unite security and observability with Datadog. TechBag helps you do security in operational context, on one platform.
Cloud SIEM — threat detection on the data you already collect
A core capability of Datadog Cloud Security is Cloud SIEM — detecting threats and attacks across your logs and cloud activity — which matters because it gives you security monitoring using the telemetry you're ALREADY collecting, without deploying a separate, heavy, expensive SIEM. The SIEM problem: security monitoring traditionally means a SIEM (Security Information and Event Management) — a separate system that collects security-relevant data, applies detection rules, and surfaces threats. SIEMs are valuable but traditionally heavy: a separate platform to deploy and run, requiring you to pipe your logs and data INTO it (duplicating the data you may already collect for observability), often complex and expensive, and needing dedicated expertise. For many organisations — especially those already collecting logs and cloud activity in Datadog for observability — standing up a whole separate SIEM is a lot. What Cloud SIEM provides: Datadog Cloud SIEM detects threats on the data you ALREADY have in Datadog: Detection on existing telemetry — it applies threat detection (out-of-the-box rules, behavioural analytics) to your LOGS and CLOUD ACTIVITY — the same data you're already collecting for observability — so you don't need a separate data pipeline into a separate SIEM. Threat detection — detects attacks, suspicious behaviour, and security signals (unusual access, lateral movement, exfiltration patterns, known-bad indicators). Contextual investigation — a detection is one click from the related logs, traces and infrastructure (the unified-platform edge) — so investigation is fast and context-rich. Less overhead — no separate SIEM to deploy and run; security monitoring is part of your existing platform. So you get security threat detection (SIEM capabilities) using your existing Datadog data and platform — rather than a separate, heavy SIEM. Why it matters: for organisations already using Datadog (or wanting unified security-and-observability), Cloud SIEM is efficient and powerful: Security monitoring without a separate SIEM — detect threats on data you already collect. Contextual — findings come with observability context. Efficient — one platform, one data set. Accessible — easier than deploying a full standalone SIEM. Honest note: for the deepest, most dedicated enterprise SIEM (especially for security-led SOCs with heavy compliance/log/security needs), specialists like Splunk ES or Microsoft Sentinel go deeper — Datadog Cloud SIEM is powerful and unified, ideal when you value the observability integration, but a security-first organisation may weigh a dedicated SIEM. TechBag advises honestly. The value: Datadog Cloud SIEM detects threats across the logs and cloud activity you ALREADY collect — security monitoring without a separate, heavy SIEM, with contextual investigation. For efficient, unified security monitoring, this matters. TechBag helps organisations detect threats with Datadog Cloud SIEM. TechBag helps you do security monitoring on the data you already have.
Cloud posture (CSPM) — fix the misconfigurations that cause breaches
A high-value capability of Datadog Cloud Security is CSPM (Cloud Security Management) — continuously checking your cloud configuration against best practices — which matters because cloud MISCONFIGURATIONS are the #1 cause of cloud breaches, and finding and fixing them is one of the highest-impact security actions. The cloud-misconfiguration problem: the biggest cause of cloud security breaches isn't sophisticated attacks — it's MISCONFIGURATIONS: an S3 bucket left public, over-permissive IAM access, unencrypted data, an exposed database, a security group open to the world. Cloud is complex and constantly changing, and it's easy to misconfigure something insecurely (often accidentally, in a hurry, or by not knowing best practice). These misconfigurations are exactly what attackers look for — they're the low-hanging fruit that causes a huge share of real cloud breaches. So finding and fixing cloud misconfigurations is one of the most impactful things you can do for cloud security. What CSPM provides: Datadog Cloud Security Management (CSPM) continuously checks your cloud posture: Continuous scanning — continuously assess your cloud configuration (AWS, Azure, GCP) against security best practices and compliance frameworks (CIS, PCI, etc.). Find misconfigurations — identify insecure configurations: public buckets, over-permissive access, unencrypted resources, exposed services, and more. Prioritise — surface the riskiest misconfigurations (using context) so you fix what matters most. Compliance — assess and report compliance continuously. And it extends to: CIEM — analysing cloud identities/entitlements for risky, excessive permissions (over-permissioned identities are a major risk). Workload protection (CWPP) — runtime protection for workloads. So you continuously know where your cloud is misconfigured or non-compliant, and can fix it — closing the #1 breach path proactively. Why it matters: because misconfigurations cause most cloud breaches, CSPM is one of the highest-impact security capabilities — finding and fixing them proactively prevents a huge share of potential breaches. Continuous checking (vs point-in-time audits) is essential because cloud changes constantly. For any organisation with significant cloud usage (i.e. most), CSPM is genuinely important — and having it on the same platform as your observability adds context. (For the deepest, dedicated cloud-security posture, a specialist like Wiz is a recognised leader — Datadog CSPM is strong and unified; TechBag advises where each fits.) The value: Datadog CSPM continuously checks your cloud configuration — finding the misconfigurations that cause the #1 share of cloud breaches, plus risky identities (CIEM) and compliance gaps — so you fix them proactively. For cloud security, this is high-impact. TechBag helps organisations fix their cloud posture with Datadog CSPM. TechBag helps you close the misconfigurations attackers exploit.
From code to runtime — protect apps and catch vulnerabilities early
A comprehensive strength of Datadog Cloud Security is that it spans from CODE (finding vulnerabilities before production) to RUNTIME (protecting apps under attack) — so you secure applications across their lifecycle, on one platform. Application security across the lifecycle: securing applications requires addressing multiple stages: In the code (before production) — finding vulnerabilities in your own code and its dependencies, and in infrastructure-as-code and secrets, so you fix them BEFORE they reach production ('shift-left'). At runtime (in production) — detecting and blocking attacks against your running applications and APIs, since not all threats can be prevented pre-production. Traditionally these need separate tools (a SAST/SCA tool for code, a WAF/RASP for runtime), and separate from your observability. Datadog covers the lifecycle, unified: Code Security (SAST/SCA) — find vulnerabilities in your own code (SAST) and open-source dependencies (SCA), catching them early. IaC and secret scanning — catch insecure infrastructure-as-code and leaked secrets before they cause breaches. Application Security Management (ASM / App & API Protection) — at RUNTIME, detect and help block attacks against your live applications and APIs — and, distinctively, leverage the APM instrumentation you may already have to see attacks from INSIDE the application and identify which vulnerable code is being targeted. Vulnerability management — prioritise vulnerabilities by real risk (exposed? exploited? critical asset?) using the platform's context. So you secure applications from code to runtime, on one platform — catching vulnerabilities early AND protecting running apps, with the observability context tying it together. Why it matters: application security is critical (apps are a major attack surface), and covering the full lifecycle (code + runtime) is best practice. Datadog doing this on ONE platform — correlated with observability (a runtime attack is one click from the trace and code) — makes application security more effective and contextual, and unifies it with your operations. The ASM leveraging APM instrumentation is a distinctive advantage (protecting apps from inside, using instrumentation you may have). (For the deepest dedicated code-security/SCA, specialists like Snyk go deep — Datadog's is strong and unified; TechBag advises.) The value: Datadog Cloud Security spans from CODE (SAST/SCA, IaC, secrets — catching vulnerabilities early) to RUNTIME (ASM — protecting apps and APIs live, from inside), on one platform correlated with observability. For lifecycle application security, this matters. TechBag helps organisations secure apps from code to runtime with Datadog. TechBag helps you catch vulnerabilities early and protect apps live.
From the observability leader — honest on where specialists fit, and cost
Datadog Cloud Security comes from Datadog — the observability leader (NASDAQ: DDOG) expanding strongly into security — with the distinctive unified-platform advantage, and honest caveats about where dedicated security specialists fit and about cost. The unified advantage: Datadog's distinctive security value is unification — security on the same platform as observability, with shared data, full context and shared teams (DevSecOps). For organisations that value uniting security and operations (especially existing Datadog users), this is genuinely powerful and increasingly strategic (security and observability are converging). Datadog is investing heavily in security and expanding its capabilities rapidly. The honest framing — addition vs specialist: it's honest to note that Datadog Cloud Security is a security ADDITION to an observability platform — powerful and unified, but for SECURITY-LED organisations (a dedicated SOC, deep compliance, security as the primary concern), best-of-breed security specialists may go deeper in their area: Wiz (a recognised leader in cloud security posture/CNAPP) for the deepest CSPM/cloud security; Splunk ES or Microsoft Sentinel for the deepest enterprise SIEM; Snyk for the deepest developer/code security; Palo Alto Prisma Cloud for a broad dedicated CNAPP. So the choice depends on your orientation: if you want unified security-and-observability (leveraging your Datadog platform, DevSecOps), Datadog Cloud Security is compelling; if you're security-led and want best-of-breed depth in a specific area, a specialist may fit. Many use Datadog for unified security-and-ops AND a specialist where needed — TechBag advises on the mix. The cost caveat: as with all Datadog, Cloud Security adds to the compounding bill (e.g. Cloud SIEM is per-GB analysed, on top of log costs) — so cost management matters. India relevance: for India's cloud-adopting, DevSecOps-embracing organisations, Datadog Cloud Security is relevant. Via TechBag (Bengaluru-based), Indian organisations get it with local scoping, honest specialist-vs-unified advice, cost management, and GST (Datadog bills USD). The value: Datadog Cloud Security — from the observability leader, uniting security with observability (DevSecOps) — is powerful and contextual, with TechBag advising honestly on where specialists fit and managing the cost. TechBag supplies it with honest scoping. TechBag provides unified security-and-observability, with honest advice.
The honest scope
Datadog Cloud Security brings security onto Datadog's observability platform — Cloud SIEM (threat detection across your logs and cloud activity), Cloud Security Management/CSPM (cloud misconfiguration and compliance, extending to CIEM and workload protection), Application Security Management/ASM (runtime app and API protection), Code Security (SAST/SCA), IaC and secret scanning, and vulnerability management — all correlated with your full observability (finding → trace → infra → code, one click). The unifying idea is security + observability on one platform (DevSecOps). From the observability leader (NASDAQ: DDOG). The honest framing — the unified advantage, specialists, and cost: Datadog Cloud Security's distinctive strength is UNIFICATION — security correlated with observability, shared data and teams — most compelling for organisations wanting DevSecOps and that already use Datadog (the correlation is the payoff). But honestly, it's a security ADDITION to an observability platform, and for SECURITY-LED organisations, best-of-breed specialists may go deeper: Wiz (a CNAPP/cloud-security-posture leader) for the deepest CSPM/cloud security; Splunk ES / Microsoft Sentinel for the deepest enterprise SIEM; Palo Alto Prisma Cloud for a broad dedicated CNAPP; Snyk for the deepest code/developer security. So the choice depends on orientation: for unified security-and-observability and DevSecOps (especially Datadog users), Datadog Cloud Security is compelling and increasingly capable (Datadog is investing heavily); for deepest best-of-breed depth in a specific security area (security-led orgs), a specialist may fit — and many combine Datadog (unified) with a specialist where needed. The other honest caveat is COST — it adds to Datadog's compounding bill (Cloud SIEM per-GB analysed, on top of logs), so management matters. It's most compelling for organisations wanting security united with their observability (DevSecOps), with the specialist-vs-unified choice and cost advised by TechBag. TechBag scopes Cloud Security honestly — advising where Datadog's unified approach fits vs specialists (Wiz, Splunk, Snyk), managing cost — and supports it (GST; Datadog bills USD).
The numbers behind the platform
What your Datadog Cloud Security journey looks like
Security scoping
Your cloud estate, your security orientation (DevSecOps/unified vs security-led/best-of-breed), which capabilities you need (SIEM? CSPM? ASM? code?), whether you use Datadog, and cost. TechBag scopes it and advises unified-vs-specialist honestly.
Posture & detection
Turn on CSPM (find cloud misconfigurations) and Cloud SIEM (detect threats on your existing data) — fixing the #1 breach cause and getting security monitoring, unified with observability.
App & code security
Add ASM (protect running apps/APIs, leveraging APM), Code Security (SAST/SCA), and IaC/secret scanning — securing apps from code to runtime, correlated.
Investigate & manage cost
Use the finding → trace → infra → code correlation for fast investigation, and manage the security cost (per-GB analysed). TechBag advises on specialists and manages spend (GST; Datadog bills USD).
Trusted across regulated industries in 100+ countries
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Having security on the SAME platform as our observability is the point — a threat detected in our logs is one click from the trace, the affected infrastructure and the code. Our security and DevOps teams share one platform. That DevSecOps unification is powerful.”
“Cloud SIEM detects threats on the logs and cloud activity we ALREADY collect in Datadog — no separate heavy SIEM to deploy and pipe data into. Security monitoring on our existing data. Efficient and contextual.”
“CSPM continuously finds our cloud misconfigurations — the #1 breach cause — and CIEM flags over-permissioned identities. Fixing posture proactively closed real risks. High-impact security.”
“App security (ASM) protects our running apps and APIs, leveraging our existing APM instrumentation to see attacks from inside — identifying which vulnerable code is targeted. Runtime protection, unified with our observability.”
“Honest guidance from TechBag: for our security-led needs we use Datadog for unified security-and-ops but kept Wiz for deepest CSPM. Datadog Cloud Security is powerful and unified; they advised where a specialist still fits. Balanced.”
“Cloud SIEM is per-GB analysed on top of our logs — the cost compounds. TechBag scoped what to analyse and managed the spend. Unified security with cost controlled.”
“Code Security (SAST/SCA) plus IaC and secret scanning catch vulnerabilities before production, on the same platform — shift-left unified with runtime. Full-lifecycle app security, correlated.”
“For our cloud-first, DevSecOps-embracing org, security united with observability was exactly the model we wanted. TechBag handled scoping, cost and GST (Datadog bills USD).”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the cloud security (SIEM/CSPM/CNAPP) market — tap any vendor to see why it sits where it does.
TechBag Email-Security Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Security ON the observability platform (unified). This page's product.
Detection × Portfolio Integration
The grid nobody publishes — how strong the email detection is vs how integrated with the wider security portfolio.
Unified, broad (addition to obs).
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Datadog Cloud Security vs the security field
Wiz (CSPM), Splunk/Sentinel (SIEM), Prisma Cloud, Snyk (code) and cloud-native — honest lanes; the edge is security UNIFIED with observability (context + DevSecOps). Security-led, deepest single area? A specialist may go deeper — we say so.
| Dimension | Datadog Cloud Security | Wiz (CSPM/CNAPP) | Splunk ES / Sentinel (SIEM) | Prisma Cloud | Snyk (code) | Cloud-native security |
|---|---|---|---|---|---|---|
| Position | Security ON the observability platform (unified) | Cloud-security posture/CNAPP leader | Enterprise SIEM leaders | Broad dedicated CNAPP (Palo Alto) | Developer/code security leader | Cloud-native security (per cloud) |
| Unified with observability (correlation) | Yes — the distinctive edge | Security-focused | Some (Splunk Observability) | Security-focused | Code-focused | Some (per cloud) |
| Cloud SIEM / threat detection | Yes (on your data) | Some (posture-led) | Deepest enterprise SIEM | Some | No | Basic (GuardDuty etc.) |
| CSPM (cloud misconfiguration) | Strong | The deepest (leader) | Some | Strong (broad CNAPP) | No (code-focused) | Native tools |
| App/API runtime protection (ASM) | Yes (leverages APM) | Some | No | Yes (WAAP) | No | Cloud WAF |
| Code security (SAST/SCA) | Yes | Some | No | Yes | The leader (developer-first) | No |
| Best for security-led (deepest single area) | Unified, broad (addition to obs) | Deepest cloud posture | Deepest SIEM | Broad dedicated CNAPP | Deepest code security | Per-cloud |
| Cost / model | Adds to Datadog bill (per-GB analysed) | Enterprise-priced | Often costly (volume) | Enterprise-priced | Developer-based | Per-cloud |
| Best fit | Unified security + observability (DevSecOps; Datadog users) | Deepest cloud-security posture (security-led) | Deepest enterprise SIEM/SOC | Broad dedicated CNAPP | Deepest developer/code security | Single-cloud native security |
Which email-security approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Datadog Cloud Security if…
- ✓You want security UNIFIED with observability — shared data, full context (finding → trace → infra → code), DevSecOps
- ✓You want Cloud SIEM on data you already collect, plus CSPM (cloud misconfig), ASM (app protection) and code security
- ✓You already use Datadog for observability — the correlation and shared platform are the payoff
- ✓You want security-and-ops on one platform — with TechBag advising where specialists fit and managing cost
Wiz if…
- ✓You're security-led and want the deepest cloud-security posture / CNAPP
Splunk ES / Microsoft Sentinel if…
- ✓You want the deepest, dedicated enterprise SIEM for a security-led SOC
Prisma Cloud if…
- ✓You want a broad, dedicated CNAPP (Palo Alto ecosystem)
Snyk if…
- ✓You want the deepest developer-first code/dependency security
What do email threats cost you?
Drag the sliders (count cloud resources/hosts; security-hour cost as loaded rate). Estimates contrast siloed security (separate SIEM, context-poor findings, misconfigurations missed) vs Datadog Cloud Security (SIEM + CSPM on your data, findings in full context) — the biggest win is preventing breaches (esp. via CSPM fixing misconfigurations, the #1 cause). NB: it adds to the Datadog bill — TechBag manages it. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models actual device counts and modules.
Three ways to consume it
Datadog Cloud Security is priced per-unit (public) by component (Cloud SIEM per-GB analysed, CSPM/ASM per host…) — but ADDS to Datadog's compounding bill. Datadog bills in USD. TechBag scopes the components, advises unified-vs-specialist (vs Wiz/Splunk/Snyk), manages cost, and handles GST.
Cloud Security (SIEM + CSPM + ASM)
Best for unified security + observability
- Per-unit pricing by component — but ADDS to the Datadog bill
- Cloud SIEM, CSPM (+CIEM/CWPP), ASM, code security
- Correlated: finding → trace → infra → code (DevSecOps)
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
+ Honest advice & managed cost
Best with TechBag
- Unified (Datadog) vs specialist (Wiz/Splunk/Snyk) — advised honestly
- TechBag scopes components + manages the added cost
- Datadog bills USD; TechBag handles cost mgmt + GST
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your device counts and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Do you want security united with observability (DevSecOps) — shared data, findings in full context? Datadog puts security on your observability platform.
Are cloud misconfigurations (the #1 breach cause) checked continuously? CSPM finds them; CIEM flags risky identities; compliance is assessed.
Do you have security monitoring without a separate heavy SIEM? Cloud SIEM detects threats on the logs/cloud activity you already collect.
Are your apps protected code-to-runtime? ASM protects running apps/APIs (leveraging APM); Code Security catches vulnerabilities early.
Security-led with deep single-area needs? Weigh specialists (Wiz for CSPM, Splunk/Sentinel for SIEM, Snyk for code). Datadog's edge is unification. TechBag advises.
Already use Datadog for observability? The security correlation and shared platform are the payoff — unified security-and-ops.
Cloud Security adds to Datadog's bill (Cloud SIEM per-GB analysed, on top of logs) — manage it. TechBag scopes and governs cost.
Datadog bills in USD — TechBag scopes, manages cost, advises unified-vs-specialist, and handles GST.
Questions buyers ask
Ready to unite security with your observability?
Scope Datadog Cloud Security (SIEM, CSPM, app security — correlated with your observability, DevSecOps) — and let a TechBag advisor honestly assess whether Datadog's unified approach fits or a specialist (Wiz/Splunk/Snyk) is warranted, manage the cost, and handle GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.