Datadog Runtime Code Analysis

Name: Datadog Runtime Code Analysis
Brand: Datadog
Rating: 4.5 (18 reviews)

Leader

Datadog provides cloud-scale monitoring and security for metrics, traces and logs in one unified platform.

Est 2010|Valuation $91.4B|Raised $795.9M

LinkedIn 546K|Website|Web traffic 4.6M|FTEs 8,100|HQ New York, New York, US

MarketsApplication Security Testing (AST)IAST

Datadog Runtime Code Analysis screenshot

Published May 16, 2026

01Common complaints

Broad IAST coverage is required across languages Datadog does not support

When Go, Ruby, or PHP are core service languages and uniform IAST coverage is a requirement, Datadog IAST may not meet coverage needs without supplemental tooling. https://docs.datadoghq.com/security/code_security/iast/setup/

Tracer standardization on Datadog is not feasible

If the organization does not intend to adopt Datadog tracing libraries or has standardized on alternative tracing backends, integrating Datadog IAST may be impractical.

Shift-left code scanning and PR gating are the primary objectives

Organizations focused primarily on developer-centric scanning in CI and PRs may prefer SAST/SCA-first tooling (for example, Snyk, GitHub Advanced Security, Semgrep) that provides immediate feedback without production instrumentation.

Budget constraints and cost predictability are paramount

Community feedback highlights concerns about platform-level costs and billing complexity; organizations with stringent budgeting constraints should evaluate total platform spend and consider lighter-weight or single-purpose alternatives.

1) Broad IAST coverage is required across languages Datadog does not support - When Go, Ruby, or PHP are core service languages and uniform IAST coverage is a requirement, Datadog IAST may not meet coverage needs without supplemental tooling. https://docs.datadoghq.com/security/code_security/iast/setup/ 2) Tracer standardization on Datadog is not feasible - If the organization does not intend to adopt Datadog tracing libraries or has standardized on alternative tracing backends, integrating Datadog IAST may be impractical. 3) Shift-left code scanning and PR gating are the primary objectives - Organizations focused primarily on developer-centric scanning in CI and PRs may prefer SAST/SCA-first tooling (for example, Snyk, GitHub Advanced Security, Semgrep) that provides immediate feedback without production instrumentation. 4) Budget constraints and cost predictability are paramount - Community feedback highlights concerns about platform-level costs and billing complexity; organizations with stringent budgeting constraints should evaluate total platform spend and consider lighter-weight or single-purpose alternatives.

Deal disqualifiers (poor fit)

Environments with significant coverage of certain language ecosystems where uniform IAST controls across those languages are required.
Organizations that are not prepared to standardize on Datadog tracing libraries or prefer a different tracing backend without Datadog tracers.
Organizations that require strict, highly predictable platform-level cost structures and are sensitive to billing variability.

Explicitly documented limitations

Language support constraints: Datadog documents that IAST supports Java, .NET, Node.js, and Python, and indicates limited or no support for Go, Ruby, and PHP in the compatibility table. https://docs.datadoghq.com/security/code_security/iast/setup/
Python runtime behavior: documentation notes that IAST modifies Python code at runtime and warns about potential accuracy limitations when codebases rely heavily on C/C++ modules or CPython API usage. https://docs.datadoghq.com/security/code_security/iast/setup/

- Language support constraints: Datadog documents that IAST supports Java, .NET, Node.js, and Python, and indicates limited or no support for Go, Ruby, and PHP in the compatibility table. https://docs.datadoghq.com/security/code_security/iast/setup/ - Python runtime behavior: documentation notes that IAST modifies Python code at runtime and warns about potential accuracy limitations when codebases rely heavily on C/C++ modules or CPython API usage. https://docs.datadoghq.com/security/code_security/iast/setup/

Operational limitations (inferred)

Traffic-dependent coverage: detection depends on executed runtime paths; unexercised code may not generate findings.
Performance overhead: vendor materials discuss runtime instrumentation; buyers should conduct performance validation (canaries, benchmarking) to quantify latency and CPU impact in representative environments.

Roadmap and previews

Datadog Code Security includes multiple capabilities at varying maturity levels (for example, Secret Scanning and Supply Chain Security may be in preview or request-access modes). https://docs.datadoghq.com/security/code_security/

02Why they buy

Differentiators supported by documentation and product design

Runtime + observability context: Datadog links vulnerability findings to traces, services, and ownership metadata, enabling contextual prioritization and lifecycle automation. https://docs.datadoghq.com/security/code_security/iast/
Reported reduction in false positives via confirmed-flow detection: Datadog describes a taint-tracking approach that confirms exploitable flows before surfacing findings. Documentation explains this technique as an approach used to reduce noise.

- Runtime + observability context: Datadog links vulnerability findings to traces, services, and ownership metadata, enabling contextual prioritization and lifecycle automation. https://docs.datadoghq.com/security/code_security/iast/ - Reported reduction in false positives via confirmed-flow detection: Datadog describes a taint-tracking approach that confirms exploitable flows before surfacing findings. Documentation explains this technique as an approach used to reduce noise.

Vendor claims requiring verification

Vendor-reported benchmark and detection claims (for example, OWASP Benchmark results) are presented on product pages; prospective buyers should request methodology details and replicate testing in representative environments before relying on those figures.

Areas where competitors have advantages

Specialized AppSec vendors often provide deeper governance, policy management, and program-level reporting.
Shift-left ecosystems (Snyk, GitHub Advanced Security) provide developer-centric workflows and CI gating without production instrumentation.

03Field reports

Review platforms (Gartner Peer Insights, G2, TrustRadius)

G2 and TrustRadius reviews tend to cover the broader Datadog observability platform rather than IAST-specific feedback. (G2 product review pages) (TrustRadius product review pages)

Implication for IAST buyers: public review platforms often aggregate feedback about Datadog's overall platform, making it difficult to isolate sentiment specific to runtime code analysis.

Gartner Peer Insights lists Datadog Code Security (IAST). Access to full review content may be limited; available snippets reference practical compatibility notes (for example, Java runtime requirements). (Gartner Peer Insights product review page) G2 and TrustRadius reviews tend to cover the broader Datadog observability platform rather than IAST-specific feedback. (G2 product review pages) (TrustRadius product review pages) Implication for IAST buyers: public review platforms often aggregate feedback about Datadog's overall platform, making it difficult to isolate sentiment specific to runtime code analysis.

Community & social (Reddit) — representative sentiment and paraphrased quotes

Community discussions commonly emphasize Datadog's pricing model, perceived complexity, and platform value — factors that affect total cost of ownership and adoption of add-ons such as IAST.

Multiple Reddit users have expressed concerns about platform cost for smaller organizations, describing Datadog as potentially unsuitable for organizations with limited budgets. (Relevant Reddit discussion threads)
Several community posts describe internal pressure to reduce logs/metrics to control costs. (Relevant Reddit discussion threads)
Threads about unexpected charge increases and billing complexity are present on Reddit. (Relevant Reddit discussion threads)

Security-related community discussion indicates the Datadog security suite is often perceived as more effective when organizations already use the Datadog platform; adoption of specific modules (such as code analysis) is sometimes described as modular. (Security community discussion threads)

Community discussions commonly emphasize Datadog's pricing model, perceived complexity, and platform value — factors that affect total cost of ownership and adoption of add-ons such as IAST. - Multiple Reddit users have expressed concerns about platform cost for smaller organizations, describing Datadog as potentially unsuitable for organizations with limited budgets. (Relevant Reddit discussion threads) - Several community posts describe internal pressure to reduce logs/metrics to control costs. (Relevant Reddit discussion threads) - Threads about unexpected charge increases and billing complexity are present on Reddit. (Relevant Reddit discussion threads) Security-related community discussion indicates the Datadog security suite is often perceived as more effective when organizations already use the Datadog platform; adoption of specific modules (such as code analysis) is sometimes described as modular. (Security community discussion threads)

Why organizations adopt Datadog Runtime Code Analysis (inferred from sources)

From Datadog's positioning and community sentiment, common adoption drivers include:

Platform consolidation: using a single vendor for observability and security workflows may simplify operations.
Runtime context: prioritization that incorporates whether code is running and exposed in production.
Vendor-reported reductions in false positives (note: independent verification may be limited; see Critical Analysis for details).

Why some organizations discontinue Datadog (platform-level churn drivers)

Common reasons cited in public community discussions include:

Cost and unpredictability at scale.
Complexity and learning curve for new adopters.
Preference for open-source or lower-cost alternatives for logs/metrics/traces.

Vendor-published enablement and workflow claims

Key vendor-described mechanics:

Vulnerability lifecycle automation (for example: automatic status changes tied to service version changes and time-bound reopen behavior described in vendor documentation on IAST lifecycle automation).
Remediation workflow hooks: status changes, assignment, and Jira issue creation (requires Jira integration and permissions; see vendor documentation on remediation workflow integrations).

Critical evaluation: these features describe operational capabilities; however, public sources did not disclose independently validated ROI or audited time-to-remediate improvements specific to Datadog Runtime Code Analysis (IAST).

Public Datadog materials describe workflows such as vulnerability lifecycle automation, integration with issue trackers, and observability-based prioritization. These materials explain operational mechanics but are vendor-published and do not constitute third-party verified case studies. Key vendor-described mechanics: - Vulnerability lifecycle automation (for example: automatic status changes tied to service version changes and time-bound reopen behavior described in vendor documentation on IAST lifecycle automation). - Remediation workflow hooks: status changes, assignment, and Jira issue creation (requires Jira integration and permissions; see vendor documentation on remediation workflow integrations). Critical evaluation: these features describe operational capabilities; however, public sources did not disclose independently validated ROI or audited time-to-remediate improvements specific to Datadog Runtime Code Analysis (IAST).

Press/analyst-style context (not a customer case study)

Press and analyst-style articles noted Datadog's expansion into application security and the addition of IAST as part of its Code Security suite. These items provide context but are not a substitute for independent customer case studies (see press coverage and analyst articles).

Datadog investor materials reference security launches and capabilities but are company-authored (see investor materials and corporate filings).

04Best fit

Company size

Most applicable: mid-market to enterprise organizations operating multiple production services where runtime vulnerability prioritization can reduce security triage effort.
Practical estimate: mid-sized to large organizations with complex microservices and a dedicated security engineering or DevSecOps function.

Industries

SaaS, fintech, e-commerce, and other online businesses where production attack surface changes frequently and runtime context informs prioritization.

Roles/personas

Decision makers: Head of AppSec, CISO (security engineering), VP Platform/Infra.
End users: DevSecOps engineers, platform engineers, backend engineers responsible for services.

Fit criteria (what indicates a good fit)

Widespread adoption of Datadog APM tracing libraries across the environment.
Need to connect vulnerability findings to runtime evidence such as traces and service ownership.
Preference for consolidating observability and security workflows within a single vendor platform.

05The pitch

What the product does (objective value proposition)

Datadog describes the offering as intended for production use and reports lower false positives and prioritized results based on runtime context. Product pages highlight (a) continuous runtime detection, (b) prioritization via Datadog Severity Score, and (c) integration with observability data and workflows.

Primary official product pages:

Runtime Code Analysis (IAST) product page — official vendor product overview and feature pages.
Runtime Code Analysis (IAST) documentation — official product documentation.
Code Security platform overview (includes IAST alongside SAST/SCA/etc.) — vendor platform overview.
Code Security docs overview — vendor documentation hub.

Datadog Runtime Code Analysis (IAST) is an application security capability that detects certain classes of first‑party code vulnerabilities from inside running services by instrumenting applications via Datadog tracing libraries (i.e., it leverages APM-style instrumentation). It analyzes real application traffic (rather than only pre-production scanning) to identify exploitable data flows (for example, tainted input reaching a sink), and surfaces findings in Datadog with remediation guidance and operational context. Datadog describes the offering as intended for production use and reports lower false positives and prioritized results based on runtime context. Product pages highlight (a) continuous runtime detection, (b) prioritization via Datadog Severity Score, and (c) integration with observability data and workflows. Primary official product pages: - Runtime Code Analysis (IAST) product page — official vendor product overview and feature pages. - Runtime Code Analysis (IAST) documentation — official product documentation. - Code Security platform overview (includes IAST alongside SAST/SCA/etc.) — vendor platform overview. - Code Security docs overview — vendor documentation hub.

Target market and positioning

Target buyers: platform engineering, DevSecOps, and application security teams in organizations that already use Datadog APM/observability (or are willing to standardize on its tracing libraries).
Positioning: Datadog emphasizes the intersection of security and observability—using runtime signals and production context to provide vulnerability findings with operational context.
Typical adoption motion: commonly deployed as an add-on to an existing Datadog footprint; the feature set is most accessible when Datadog tracing libraries are already in use.

- Target buyers: platform engineering, DevSecOps, and application security teams in organizations that already use Datadog APM/observability (or are willing to standardize on its tracing libraries). - Positioning: Datadog emphasizes the intersection of security and observability—using runtime signals and production context to provide vulnerability findings with operational context. - Typical adoption motion: commonly deployed as an add-on to an existing Datadog footprint; the feature set is most accessible when Datadog tracing libraries are already in use.

Get a comprehensive analysis of Datadog Runtime Code Analysis including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →