Datadog App and API Protection

Name: Datadog App and API Protection
Brand: Datadog
Rating: 5 (3 reviews)

Leader

Datadog provides cloud-scale monitoring and security for metrics, traces and logs in one unified platform.

Est 2010|Valuation $91.4B|Raised $795.9M

LinkedIn 546K|Website|Web traffic 4.6M|FTEs 8,100|HQ New York, New York, US

MarketsWeb Application & API Protection (WAAP)

Datadog App and API Protection screenshot

Published May 16, 2026

01Common complaints

Consider alternatives when: 1. An organization requires edge-only WAAP or API schema enforcement without in-application instrumentation; edge-first vendors (Cloudflare, Akamai, Imperva) can enforce protection without agent rollouts. 2. The organization is not already using Datadog and does not intend to adopt Datadog Infrastructure Monitoring/APM broadly; AAP’s benefits are strongest with an existing Datadog footprint. 3. Cost predictability is the primary procurement requirement; public reviews and community discussions identify pricing and forecasting as potential challenges when telemetry usage grows. 4. The program requires a dedicated, API-centric security platform focused on deep schema governance, gateway integrations, or advanced API testing and fuzzing; a specialist API security vendor may better meet those needs. 5. Procurement constraints disallow an additional per-host security SKU on top of baseline infrastructure monitoring.

Deal disqualifiers (common)

Teams that do not want in-application libraries or agents for security controls
Organizations seeking a standalone WAAP without observability platform coupling
Very cost-sensitive startups requiring basic edge WAF or rate-limiting functionality

1) Platform dependency and rollout constraints

AAP depends on supported APM libraries, language coverage, and the Datadog Agent. Coverage and enablement vary by library versions and remote configuration capabilities.

2) Feature maturity differences (preview features and evolving capabilities)

Some documentation previously indicated parts of API security were in preview. Buyers should confirm current general availability status, support SLAs, and any feature limitations for their Datadog site.

3) Cost and complexity risks (reported in reviews)

User feedback aggregated on review sites and community channels frequently cites pricing concerns and a learning curve for large-scale deployments.

4) Limited public, AAP-specific third-party review density

AAP has fewer product-specific independent reviews compared with mainstream WAF offerings; most public review signal is Datadog platform-level or adjacent security products.

02Why they buy

Differentiators supported by product documentation and positioning

In-application context via APM tracing: attack signals are enriched with service topology, traces, stack traces, and ownership metadata, which supports triage and remediation workflows.
Unified workflows inside the Datadog platform: security views are integrated with service pages, traces, and other observability artifacts, facilitating investigation without tool switching.

Where competitors may have an advantage

Edge WAAP vendors can protect many applications and APIs without deploying language-specific tracing libraries.
Dedicated WAAP/API security platforms may provide deeper schema governance and policy enforcement at the gateway or API management layer.
Some vendors (for example, Dynatrace) present different pricing models that may align better with particular infrastructure characteristics.

03Field reports

Review platform availability caveat

Review platforms tend to cover Datadog at the platform level (observability) or adjacent security products (such as Datadog Cloud SIEM) rather than AAP specifically. Much of the accessible review signal is platform-level, which remains relevant because AAP operates within the broader Datadog UI, billing model, and data workflows.

Representative review excerpts (platform-level)

- A review on a major enterprise review platform described the Cloud SIEM offering as positive on capability but noted cost considerations. - Another reviewer described usability complexity at scale, observing that the platform can become large and harder to navigate. These excerpts are platform-level and not AAP-specific, but they highlight two recurring procurement themes relevant to AAP: platform breadth adds complexity, and perceived value is sensitive to cost.

G2 (Datadog product-level pros/cons)

G2’s aggregation of Datadog pros and cons highlights recurring themes:

Pros: monitoring features, integrations, and real-time monitoring capabilities.
Cons: pricing concerns and a learning curve.

TrustRadius (Datadog product reviews)

TrustRadius contains multiple Datadog reviews, reinforcing the platform’s observability capabilities while indicating that buyers should evaluate cost implications.

Community / social (Reddit examples; mixed)

Positive/neutral themes: - Some practitioners report that Datadog security tools are effective when the organization already uses the Datadog platform, noting integration advantages. Negative themes: - API rate limits: community posts describe instances of encountering Datadog API rate limits. - Pricing unpredictability: community threads report perceived difficulty forecasting Datadog bills and occasional billing surprises (these are community claims and not vendor-confirmed). - Complexity at scale: multiple posts and reviews describe the platform becoming large and complex, which can hinder navigation and operations.

Why customers choose Datadog (and, by extension, AAP)

Common selection reasons expressed in reviews and community discussions include:

High integration density (dashboards, metrics, logs, and traces correlation)
Consolidation of tools (observability and security signals within the same platform)
Incident investigation workflows that enable pivoting from alerts into traces and logs

Why some customers leave or consider alternatives

Common churn drivers identified in reviews and community channels include:

Cost escalation as usage grows (logs, synthetics, broad adoption)
Migration to open-source or lower-cost stacks (for example, the Grafana ecosystem)
Frustration with pricing complexity and forecasting

Vendor-published case snippets and quotes

Datadog’s application security pages include vendor-selected testimonials such as a quote from Arc XP stating that AAP "can quickly pinpoint an attack or unusual activity… to make a more informed choice about whether blocking is necessary." These vendor-selected testimonials do not include independent verification and should be evaluated in that context. Critical evaluation: - Vendor-selected testimonials typically lack detailed methodology, independent verification, or quantified outcomes (for example, false positive rates, time-to-detect, or prevented loss metrics). - Training and enablement materials exist for adoption, but availability of training is not evidence of operational outcomes.

04Best fit

Company size

Common fit: mid-market to enterprise organizations operating multiple services and environments where centralized telemetry already exists.
Practical range: organizations with hundreds to many thousands of employees, often with dedicated SRE/platform and security engineering functions.

Industries

Technology/SaaS, financial services, e-commerce, and other web/API-focused businesses where credential stuffing, injection attempts, and API abuse are material risks.

Roles and personas

Decision makers: CISO/VP Security Engineering, Head of Platform/SRE, DevSecOps leadership.
Daily users: AppSec engineers, SREs, on-call engineers, and incident responders.

Pain points addressed

Limited visibility into which attacks reach application code paths
Slow investigations due to context switching between WAF, SIEM, APM, and logs
API sprawl and incomplete endpoint inventories (shadow APIs)

05The pitch

What the product does (core value proposition)

Datadog App and API Protection (AAP) is a runtime-focused application and API security product embedded within the Datadog platform. It is designed to: - Discover and inventory APIs (including "shadow/undocumented" endpoints) and evaluate posture against rules aligned to established best practices (for example, the OWASP API Top 10). - Detect application and API attacks in production using context derived from APM traces (request, route, service, and stack trace correlations). - Protect and block malicious traffic using an in-application WAF / RASP-style approach (policy rules, exclusions, blocking by IP/user/request attributes) and optionally integrate with edge/perimeter controls. Datadog describes AAP as providing in-application context compared to classic edge WAFs and point API-security tools, emphasizing investigation speed via shared observability context (logs, traces, errors, service catalog). Official product documentation provides implementation details.

Target market and positioning

Primary buyers/users: security engineering, DevSecOps, platform engineering/SRE, and DevOps teams.
Environments where the product is a practical fit: organizations already using Datadog APM/Agent broadly; microservices and distributed systems where correlating attacks to code-level execution context is useful.
Positioning: a consolidated interface that combines security signals and observability telemetry, rather than deploying separate WAF/RASP tools.

Get a comprehensive analysis of Datadog App and API Protection including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published May 16, 2026

01Common complaints

Consider alternatives when:

An organization requires edge-only WAAP or API schema enforcement without in-application instrumentation; edge-first vendors (Cloudflare, Akamai, Imperva) can enforce protection without agent rollouts.
The organization is not already using Datadog and does not intend to adopt Datadog Infrastructure Monitoring/APM broadly; AAP’s benefits are strongest with an existing Datadog footprint.
Cost predictability is the primary procurement requirement; public reviews and community discussions identify pricing and forecasting as potential challenges when telemetry usage grows.
The program requires a dedicated, API-centric security platform focused on deep schema governance, gateway integrations, or advanced API testing and fuzzing; a specialist API security vendor may better meet those needs.
Procurement constraints disallow an additional per-host security SKU on top of baseline infrastructure monitoring.

Deal disqualifiers (common)

Teams that do not want in-application libraries or agents for security controls
Organizations seeking a standalone WAAP without observability platform coupling
Very cost-sensitive startups requiring basic edge WAF or rate-limiting functionality

1) Platform dependency and rollout constraints

AAP depends on supported APM libraries, language coverage, and the Datadog Agent. Coverage and enablement vary by library versions and remote configuration capabilities.

2) Feature maturity differences (preview features and evolving capabilities)

Some documentation previously indicated parts of API security were in preview. Buyers should confirm current general availability status, support SLAs, and any feature limitations for their Datadog site.

3) Cost and complexity risks (reported in reviews)

User feedback aggregated on review sites and community channels frequently cites pricing concerns and a learning curve for large-scale deployments.

4) Limited public, AAP-specific third-party review density

AAP has fewer product-specific independent reviews compared with mainstream WAF offerings; most public review signal is Datadog platform-level or adjacent security products.

02Why they buy

Differentiators supported by product documentation and positioning

In-application context via APM tracing: attack signals are enriched with service topology, traces, stack traces, and ownership metadata, which supports triage and remediation workflows.
Unified workflows inside the Datadog platform: security views are integrated with service pages, traces, and other observability artifacts, facilitating investigation without tool switching.

Where competitors may have an advantage

Edge WAAP vendors can protect many applications and APIs without deploying language-specific tracing libraries.
Dedicated WAAP/API security platforms may provide deeper schema governance and policy enforcement at the gateway or API management layer.
Some vendors (for example, Dynatrace) present different pricing models that may align better with particular infrastructure characteristics.

03Field reports

Review platform availability caveat

Representative review excerpts (platform-level)

A review on a major enterprise review platform described the Cloud SIEM offering as positive on capability but noted cost considerations.
Another reviewer described usability complexity at scale, observing that the platform can become large and harder to navigate.

These excerpts are platform-level and not AAP-specific, but they highlight two recurring procurement themes relevant to AAP: platform breadth adds complexity, and perceived value is sensitive to cost.

G2 (Datadog product-level pros/cons)

G2’s aggregation of Datadog pros and cons highlights recurring themes:

Pros: monitoring features, integrations, and real-time monitoring capabilities.
Cons: pricing concerns and a learning curve.

TrustRadius (Datadog product reviews)

TrustRadius contains multiple Datadog reviews, reinforcing the platform’s observability capabilities while indicating that buyers should evaluate cost implications.

Community / social (Reddit examples; mixed)

Positive/neutral themes:

Some practitioners report that Datadog security tools are effective when the organization already uses the Datadog platform, noting integration advantages.

Negative themes:

API rate limits: community posts describe instances of encountering Datadog API rate limits.
Pricing unpredictability: community threads report perceived difficulty forecasting Datadog bills and occasional billing surprises (these are community claims and not vendor-confirmed).
Complexity at scale: multiple posts and reviews describe the platform becoming large and complex, which can hinder navigation and operations.

Why customers choose Datadog (and, by extension, AAP)

Common selection reasons expressed in reviews and community discussions include:

High integration density (dashboards, metrics, logs, and traces correlation)
Consolidation of tools (observability and security signals within the same platform)
Incident investigation workflows that enable pivoting from alerts into traces and logs

Why some customers leave or consider alternatives

Common churn drivers identified in reviews and community channels include:

Cost escalation as usage grows (logs, synthetics, broad adoption)
Migration to open-source or lower-cost stacks (for example, the Grafana ecosystem)
Frustration with pricing complexity and forecasting

Vendor-published case snippets and quotes

Critical evaluation:

Vendor-selected testimonials typically lack detailed methodology, independent verification, or quantified outcomes (for example, false positive rates, time-to-detect, or prevented loss metrics).
Training and enablement materials exist for adoption, but availability of training is not evidence of operational outcomes.

04Best fit

Company size

Common fit: mid-market to enterprise organizations operating multiple services and environments where centralized telemetry already exists.
Practical range: organizations with hundreds to many thousands of employees, often with dedicated SRE/platform and security engineering functions.

Industries

Technology/SaaS, financial services, e-commerce, and other web/API-focused businesses where credential stuffing, injection attempts, and API abuse are material risks.

Roles and personas

Decision makers: CISO/VP Security Engineering, Head of Platform/SRE, DevSecOps leadership.
Daily users: AppSec engineers, SREs, on-call engineers, and incident responders.

Pain points addressed

Limited visibility into which attacks reach application code paths
Slow investigations due to context switching between WAF, SIEM, APM, and logs
API sprawl and incomplete endpoint inventories (shadow APIs)

05The pitch

What the product does (core value proposition)

Datadog App and API Protection (AAP) is a runtime-focused application and API security product embedded within the Datadog platform. It is designed to:

Discover and inventory APIs (including "shadow/undocumented" endpoints) and evaluate posture against rules aligned to established best practices (for example, the OWASP API Top 10).
Detect application and API attacks in production using context derived from APM traces (request, route, service, and stack trace correlations).
Protect and block malicious traffic using an in-application WAF / RASP-style approach (policy rules, exclusions, blocking by IP/user/request attributes) and optionally integrate with edge/perimeter controls.

Datadog describes AAP as providing in-application context compared to classic edge WAFs and point API-security tools, emphasizing investigation speed via shared observability context (logs, traces, errors, service catalog). Official product documentation provides implementation details.

Target market and positioning

Primary buyers/users: security engineering, DevSecOps, platform engineering/SRE, and DevOps teams.
Environments where the product is a practical fit: organizations already using Datadog APM/Agent broadly; microservices and distributed systems where correlating attacks to code-level execution context is useful.
Positioning: a consolidated interface that combines security signals and observability telemetry, rather than deploying separate WAF/RASP tools.

Get a comprehensive analysis of Datadog App and API Protection including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →