Datadog IaC Security

Name: Datadog IaC Security
Brand: Datadog

Leader

Datadog provides cloud-scale monitoring and security for metrics, traces and logs in one unified platform.

Est 2010|Valuation $91.4B|Raised $795.9M

LinkedIn 546K|Website|Web traffic 4.6M|FTEs 8,100|HQ New York, New York, US

MarketsCloud-Native Application Protection Platform (CNAPP)IaC Security

Published Sep 26, 2026

01Common complaints

1) An organization that prioritizes a specialist IaC scanner as a standalone tool If the primary requirement is deep IaC coverage (broad format support, plan scanning, IDE plugins, and advanced policy-as-code workflows) and correlation with observability is not required, specialist vendors such as Snyk or Checkov-based solutions may be better validated for standalone IaC use cases. 2) Budget-sensitive organizations or those requiring strict spend predictability Smaller organizations or those with strict predictability requirements should consider the potential for multi-meter billing across platform modules and evaluate total cost scenarios carefully. 3) Organizations that require highly automated governance reporting via programmatic access If the program depends on easy programmatic extraction of findings for dashboards, GRC tools, or evidence automation and Datadog’s security findings APIs do not meet requirements, a specialist tool may reduce integration effort. 4) Organizations that require guaranteed feature availability across all Datadog sites/regions Datadog documentation indicates feature availability may vary by site; global organizations should verify availability for each business unit or region. 5) Organizations not already standardized on Datadog for observability Adopting Datadog primarily for IaC Security alone can be harder to justify versus open-source or specialist options unless there are plans to adopt more of the Datadog platform.

Deal disqualifiers (poor fit)

- Need for extensive IaC format coverage (CloudFormation, Pulumi, etc.) beyond what Datadog supports in the organization’s region/site. - Requirement for fully local/offline scanning with no SaaS access to code (some organizations require local-only CLI scanning approaches). - Need for mature, security-program-centric reporting and APIs (evidence exports, SLAs, exception workflows) where Datadog’s security APIs are insufficient for the program’s automation needs.

Publicly visible limitations and uncertainties

- Feature availability by Datadog site: documentation indicates that product availability may vary by site, implying regional or tenant constraints. - IaC scope: public documentation emphasizes Terraform and Kubernetes manifests; organizations that require CloudFormation, Pulumi, or Terraform plan/state scanning should confirm current support. - Pipeline/CLI scanning maturity: a Datadog blog post from Dec 2, 2024 indicated pipeline scanning via CLI was planned for the first half of 2025; purchasers should confirm whether this capability is generally available, in preview, or otherwise limited.

Common platform-level risks affecting IaC Security rollouts

Cost governance: platform adoption can be constrained by finance and chargeback concerns.
Operational complexity: rollout across many teams and repositories requires ownership mapping, rule tuning, and change management.

02Why they buy

Differentiators with documented rationale

Unified code-to-cloud policy alignment: IaC Security is positioned as part of Datadog’s cloud security posture program, using a common rule engine (Rego/OPA) across code and cloud, which can reduce duplicated policy logic and maintenance effort.
Developer workflow integration: PR comments, remediation hints, and PR gating workflows are provided; these features align security feedback with developer workflows within the Datadog ecosystem.

Areas where competitors may have advantages

Pricing and packaging transparency: some competitors present different licensing models that may be easier to forecast for certain buyers.
IaC depth and ecosystem: specialist IaC vendors and open-source scanners have longer histories focused on IaC, which may translate to broader community tooling and established workflows.

03Field reports

Important limitation: review granularity

Most third-party reviews discuss Datadog as a platform or Datadog Cloud Security Management overall rather than IaC Security specifically. IaC Security is newer relative to core observability products, which reduces the volume of IaC-specific public reviews.

Select review excerpts and summaries

- Gartner Peer Insights for Datadog Cloud Security includes mixed-to-positive sentiment with some implementation friction: reviewers cited value but noted documentation limitations; other reviewers reported bugs affecting implementation speed; and at least one reviewer noted an API/automation gap for querying findings. - G2 reviews for Datadog (primarily platform-level) commonly highlight pros such as a unified interface, dashboards, and many integrations; cons typically mention cost escalation as usage grows, a learning curve, and UI criticisms. - Community discussions (e.g., Reddit) often emphasize pricing unpredictability and billing friction. Comments indicate security features can be more effective when Datadog observability is already deployed, whereas some users perceive certain security features as incomplete or less mature than specialist vendors.

Why customers choose Datadog (inferred from reviews)

Common selection drivers across review sources include:

Consolidation: preference for a single vendor to provide observability and security signals.
Integrations and dashboards that centralize data.
Faster investigation capability by correlating security findings with runtime telemetry.

Why customers leave or evaluate alternatives

Common churn drivers mentioned publicly include:

Total cost and billing complexity (particularly for logs/APM and other usage-driven components).
Platform complexity and a steep learning curve.
Perception that some features lag specialist security vendors in depth or maturity.

Vendor-published narratives (limited independent verification)

Datadog’s IaC Security materials primarily include feature descriptions and workflow screenshots rather than third-party-verified case studies with quantified ROI. For example, a recent Datadog blog post described PR scanning, policy unification (OPA/Rego), and noted a roadmap item that pipeline scanning via CLI was planned for an upcoming release window. Critical evaluation: - The blog describes operational benefits (catch issues earlier, reduce tool duplication) but does not provide independently validated metrics such as incident reduction percentages. - The planned CLI pipeline scanning claim should be verified against current documentation and release notes if pipeline scanning is required.

Industry report tie-ins (not product-specific ROI)

Datadog’s broader DevSecOps and cloud security reports provide macro-level context (e.g., IaC adoption rates, credential hygiene risks) but do not validate IaC Security efficacy directly.

04Best fit

Company size and maturity (practical ranges)

Most suitable for: mid-market to enterprise organizations with formal DevSecOps practices and sufficient scale that tool consolidation offsets per-seat and usage costs.
Budget reality: teams that already have a Datadog contract often find incremental add-ons easier to justify than introducing a new vendor.

Industries

Common adopters include software/SaaS, fintech, e-commerce, digital-native enterprises, and regulated organizations that value centralized reporting and audit trails.

Roles and personas

Decision makers: CISO / Head of Cloud Security, VP Engineering/Platform, Director of SRE.
Day-to-day users: cloud security engineers defining policies, platform engineers maintaining CI workflows, developers receiving PR comments.

Pain points addressed

Misconfigurations introduced via Terraform or Kubernetes changes.
Lack of visibility into where insecure defaults enter the codebase.
Fragmented tooling for PR-time scanning versus runtime scanning, with inconsistent rules.

Qualification criteria (good fit)

Organization already uses Datadog and wants security findings correlated with observability data.
Capacity to standardize repository integrations (GitHub/GitLab/Azure DevOps) and enforce PR checks.
Capacity to tune policies/exclusions and run an enablement rollout.

05The pitch

What the product does (objective summary)

Datadog Infrastructure-as-Code (IaC) Security is a shift-left cloud security capability that scans infrastructure configuration files in source control (not deployed runtime resources) to detect cloud misconfigurations and policy violations before changes reach production. It focuses on identifying insecure defaults and configuration risks (e.g., overly permissive IAM, missing encryption, public exposure) in IaC such as Terraform and Kubernetes manifests, and surfacing findings in developer workflows (PR comments, gating) and in Datadog’s security explorers. Key product claims and capabilities (vendor-stated): - Continuous repository scanning and PR feedback with remediation guidance and code snippets. - PR comments for GitHub/GitLab and support for Azure DevOps repositories. - PR gates to report pass/fail checks and optionally block merges depending on VCS settings. - Findings triage: severity, status, repo/team filters; muting rules and exclusions to reduce noise. - Uses the same policy language/engine as Datadog Cloud Security misconfiguration rules: Rego via Open Policy Agent (OPA), enabling a unified code-to-cloud policy approach. (These items are documented across Datadog’s IaC Security product page, blog post, and docs.)

Target market and positioning

Primary users: platform engineers, SRE/DevOps, cloud security engineers, DevSecOps teams.
Best suited for: organizations already using Datadog for observability and/or Datadog Cloud Security Management that aim to consolidate tooling and correlate security findings with operational context in one platform.
Positioning rationale: align misconfiguration detection rules and triage across code and cloud to reduce duplicate tooling and policy maintenance.

Get a comprehensive analysis of Datadog IaC Security including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →