Datadog Secret Scanning

Name: Datadog Secret Scanning
Brand: Datadog

Leader

Datadog provides cloud-scale monitoring and security for metrics, traces and logs in one unified platform.

Est 2010|Valuation $91.4B|Raised $795.9M

LinkedIn 546K|Website|Web traffic 4.6M|FTEs 8,100|HQ New York, New York, US

MarketsApplication Security Testing (AST)Secret Scanning

Published May 16, 2026

01Common complaints

1) If the organization is not committed to an organization-wide rollout and enforcement If PR checks and policy enforcement cannot be applied across most repositories, coverage will be partial and risk reduction limited. Community commentary identifies partial adoption as a common failure mode for platform expansions. 2) If the primary need is secrets-first governance beyond code repositories If the principal requirement is addressing secrets sprawl across collaboration tools, ticketing systems, wikis, and developer endpoints, a dedicated secrets platform may provide deeper program capabilities. 3) If the organization relies primarily on native VCS security suites If most repositories are hosted on a single VCS platform and existing native scanning covers requirements, native features may reduce operational overhead. 4) If Datadog pricing and cost predictability are significant internal concerns Community discussions highlight surprise charges and high bills for some customers. Adding a per-committer SKU can increase cost scrutiny.

Deal disqualifiers (poor fit)

Very cost-sensitive organizations that consider Datadog unaffordable.
Highly heterogeneous SCM/CI environments where centralized rollout is difficult.
Teams requiring an on-prem or self-hosted secret scanning engine for stricter data residency requirements than what Datadog provides.

Publicly visible limitations / constraints

Documentation notes that hosted scanning is supported for specific providers (GitHub, Azure DevOps, GitLab). Organizations using other VCS providers may need to rely on CI-based integration.
Regional or site availability differences are indicated in documentation; organizations should verify support for their selected Datadog site.

Commonly reported platform limitations (indirect but relevant)

Pricing complexity and forecasting difficulty (frequently discussed on Reddit and Hacker News).
Learning curve and onboarding complexity (noted in G2 reviews and other analysis of Datadog broadly).

Roadmap visibility

Public roadmap details specific to Secret Scanning were not found in the sources reviewed. Prospective purchasers should request roadmap commitments and timelines during evaluation.

02Why they buy

Key differentiators described in vendor documentation (require independent validation): - Validation of credentials with third-party providers to prioritize active secrets and reduce false positives. - Commit and merge blocking via CI/CD and VCS integrations. - Correlation across the Datadog platform (linking code findings with runtime and infrastructure signals). Where competitors may have advantages - Dedicated secrets vendors typically provide more specialized workflows and broader perimeter scanning. - Native VCS scanning can be simpler to operate and may be more cost-effective depending on existing licensing.

03Field reports

Review-platform reality check (important limitation)

Secret Scanning is a feature within Datadog Code Security and the broader Datadog platform; most third-party reviews aggregate at the Datadog product level rather than feature-level.

G2 (Datadog platform reviews — not feature-specific)

Examples captured from G2 indicate both positive value and pain points: - Positive (feature breadth): A reviewer noted that real-time traces and linking RUM with APM helped trace errors and map them to user experience. - Negative (setup complexity): The same reviewer cited installation complexity, especially in Docker-based setups. - G2 also shows very low ratings among some reviewers in excerpts, suggesting polarized experiences. Interpretation: These reviews are about Datadog broadly, but the themes (setup complexity, breadth of capabilities when configured well) are relevant when considering adding Code Security modules such as Secret Scanning.

TrustRadius (Datadog platform reviews — not feature-specific)

TrustRadius hosts Datadog reviews; accessible excerpts are descriptive. Feature-specific quotes were not available in the sampled results.

Reddit / community discussions (Datadog broadly; some security-suite commentary)

Common community themes that can affect Secret Scanning adoption (even if not directly about the feature):

Pricing anxiety and surprise bills: multiple threads discuss Datadog being expensive and/or hard to forecast.
Aggressive sales outreach complaints: several high-upvote posts describe aggressive outreach by Datadog sales.
Skepticism toward online reviews: some community posts express difficulty trusting reviews online.

Hacker News (community sentiment, cost skepticism, and outages)

Hacker News contains multiple threads where practitioners describe:

Datadog being expensive and requiring careful onboarding and usage discipline;
cost driven by many axes of usage-based pricing;
commentary about incidents and outages, including a noted outage in 2023 referenced in community posts.

What’s missing

Gartner Peer Insights: attempts to find Gartner Peer Insights coverage for the feature were limited by gated access and were not available as primary quote sources in the accessible results.

Vendor-published materials (limited independent verification)

Datadog’s product announcements describe Secret Scanning as generally available and outline key features such as: - continuous monitoring of repositories and CI/CD, - blocking commits and merges, - third-party validation examples (examples provided by the vendor include AWS, GitHub, and OpenAI), - correlation with other Datadog security signals. Critical evaluation: - These are vendor-authored claims. The sources reviewed did not provide independently audited metrics such as: - documented reductions in false positives (no quantified figures provided), - measurable improvements in time-to-remediate, - reductions in incidents or breaches directly attributable to the feature, - coverage benchmarks versus competitors.

Suggested buyer approach

Request from Datadog (or run a pilot to measure):

estimates of detection accuracy and false positive/negative behavior on representative repositories,
validation coverage by provider type,
baseline time-to-remediate versus post-rollout improvements,
developer sentiment and friction metrics (how often developers are blocked and frequency of overrides).

04Best fit

Company sizes

A good fit tends to be:

mid-market to enterprise organizations with sufficient engineering scale that secret leakage risk is material and that already invest in security tooling.
Organizations already paying for Datadog observability/security are more likely to realize platform-integration benefits.

Industries

Common fits (inferred from typical buyers of secrets scanning and Datadog):

SaaS, fintech, healthcare tech, e-commerce, and regulated environments where credential leakage leads to compliance and breach risk.

Roles and personas

Decision makers: CISO, Head of AppSec/DevSecOps, VP Engineering/Platform.
End users: developers, security engineers, DevOps.

Pain points addressed

Hardcoded secrets in source and configuration files
Developer mistakes and AI-generated code that includes credentials
Alert fatigue from false positives (Datadog states that credential validation is intended to reduce false positives)

Qualification criteria (good fit)

The organization already uses Datadog and seeks convergence between security and observability.
The organization can enforce CI policies organization-wide.
The organization can operationalize remediation (rotation, revocation, incident response).

05The pitch

What the product does (objective value proposition)

Datadog Secret Scanning is a shift-left code security capability designed to detect (and, in some workflows, block) secrets such as API keys, tokens, and passwords before they propagate into repositories, CI/CD pipelines, or production. It is part of Datadog Code Security and focuses on: - scanning source code and configuration files for potential secrets; - validating some detected secrets with third-party providers to determine whether they are active (intended to reduce false positives); - integrating with developer workflows (Git providers and CI/CD) to prevent commits or merges that introduce secrets. (Feature claims are vendor-stated unless otherwise noted.)

Target market and positioning

- Primary buyers: Security engineering / AppSec / DevSecOps leadership in organizations already using Datadog for observability and/or cloud security. - Primary users: Developers, platform engineering, security operations (triage and remediation). - Positioning: Datadog describes the capability as integrated with its observability and security telemetry, enabling correlation between code findings and runtime signals, vulnerabilities, and cloud misconfigurations for end-to-end risk context.

Get a comprehensive analysis of Datadog Secret Scanning including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published May 16, 2026

01Common complaints

If the organization is not committed to an organization-wide rollout and enforcement If PR checks and policy enforcement cannot be applied across most repositories, coverage will be partial and risk reduction limited. Community commentary identifies partial adoption as a common failure mode for platform expansions.
If the primary need is secrets-first governance beyond code repositories If the principal requirement is addressing secrets sprawl across collaboration tools, ticketing systems, wikis, and developer endpoints, a dedicated secrets platform may provide deeper program capabilities.
If the organization relies primarily on native VCS security suites If most repositories are hosted on a single VCS platform and existing native scanning covers requirements, native features may reduce operational overhead.
If Datadog pricing and cost predictability are significant internal concerns Community discussions highlight surprise charges and high bills for some customers. Adding a per-committer SKU can increase cost scrutiny.

Deal disqualifiers (poor fit)

Very cost-sensitive organizations that consider Datadog unaffordable.
Highly heterogeneous SCM/CI environments where centralized rollout is difficult.
Teams requiring an on-prem or self-hosted secret scanning engine for stricter data residency requirements than what Datadog provides.

Publicly visible limitations / constraints

Documentation notes that hosted scanning is supported for specific providers (GitHub, Azure DevOps, GitLab). Organizations using other VCS providers may need to rely on CI-based integration.
Regional or site availability differences are indicated in documentation; organizations should verify support for their selected Datadog site.

Commonly reported platform limitations (indirect but relevant)

Pricing complexity and forecasting difficulty (frequently discussed on Reddit and Hacker News).
Learning curve and onboarding complexity (noted in G2 reviews and other analysis of Datadog broadly).

Roadmap visibility

Public roadmap details specific to Secret Scanning were not found in the sources reviewed. Prospective purchasers should request roadmap commitments and timelines during evaluation.

02Why they buy

Key differentiators described in vendor documentation (require independent validation):

Validation of credentials with third-party providers to prioritize active secrets and reduce false positives.
Commit and merge blocking via CI/CD and VCS integrations.
Correlation across the Datadog platform (linking code findings with runtime and infrastructure signals).

Where competitors may have advantages

Dedicated secrets vendors typically provide more specialized workflows and broader perimeter scanning.
Native VCS scanning can be simpler to operate and may be more cost-effective depending on existing licensing.

03Field reports

Review-platform reality check (important limitation)

Secret Scanning is a feature within Datadog Code Security and the broader Datadog platform; most third-party reviews aggregate at the Datadog product level rather than feature-level.

G2 (Datadog platform reviews — not feature-specific)

Examples captured from G2 indicate both positive value and pain points:

Positive (feature breadth): A reviewer noted that real-time traces and linking RUM with APM helped trace errors and map them to user experience.
Negative (setup complexity): The same reviewer cited installation complexity, especially in Docker-based setups.
G2 also shows very low ratings among some reviewers in excerpts, suggesting polarized experiences.

Interpretation: These reviews are about Datadog broadly, but the themes (setup complexity, breadth of capabilities when configured well) are relevant when considering adding Code Security modules such as Secret Scanning.

TrustRadius (Datadog platform reviews — not feature-specific)

TrustRadius hosts Datadog reviews; accessible excerpts are descriptive. Feature-specific quotes were not available in the sampled results.

Reddit / community discussions (Datadog broadly; some security-suite commentary)

Common community themes that can affect Secret Scanning adoption (even if not directly about the feature):

Pricing anxiety and surprise bills: multiple threads discuss Datadog being expensive and/or hard to forecast.
Aggressive sales outreach complaints: several high-upvote posts describe aggressive outreach by Datadog sales.
Skepticism toward online reviews: some community posts express difficulty trusting reviews online.

Hacker News (community sentiment, cost skepticism, and outages)

Hacker News contains multiple threads where practitioners describe:

Datadog being expensive and requiring careful onboarding and usage discipline;
cost driven by many axes of usage-based pricing;
commentary about incidents and outages, including a noted outage in 2023 referenced in community posts.

What’s missing

Gartner Peer Insights: attempts to find Gartner Peer Insights coverage for the feature were limited by gated access and were not available as primary quote sources in the accessible results.

Vendor-published materials (limited independent verification)

Datadog’s product announcements describe Secret Scanning as generally available and outline key features such as:

continuous monitoring of repositories and CI/CD,
blocking commits and merges,
third-party validation examples (examples provided by the vendor include AWS, GitHub, and OpenAI),
correlation with other Datadog security signals.

Critical evaluation:

These are vendor-authored claims. The sources reviewed did not provide independently audited metrics such as:
- documented reductions in false positives (no quantified figures provided),
- measurable improvements in time-to-remediate,
- reductions in incidents or breaches directly attributable to the feature,
- coverage benchmarks versus competitors.

Suggested buyer approach

Request from Datadog (or run a pilot to measure):

estimates of detection accuracy and false positive/negative behavior on representative repositories,
validation coverage by provider type,
baseline time-to-remediate versus post-rollout improvements,
developer sentiment and friction metrics (how often developers are blocked and frequency of overrides).

04Best fit

Company sizes

A good fit tends to be:

mid-market to enterprise organizations with sufficient engineering scale that secret leakage risk is material and that already invest in security tooling.
Organizations already paying for Datadog observability/security are more likely to realize platform-integration benefits.

Industries

Common fits (inferred from typical buyers of secrets scanning and Datadog):

SaaS, fintech, healthcare tech, e-commerce, and regulated environments where credential leakage leads to compliance and breach risk.

Roles and personas

Decision makers: CISO, Head of AppSec/DevSecOps, VP Engineering/Platform.
End users: developers, security engineers, DevOps.

Pain points addressed

Hardcoded secrets in source and configuration files
Developer mistakes and AI-generated code that includes credentials
Alert fatigue from false positives (Datadog states that credential validation is intended to reduce false positives)

Qualification criteria (good fit)

The organization already uses Datadog and seeks convergence between security and observability.
The organization can enforce CI policies organization-wide.
The organization can operationalize remediation (rotation, revocation, incident response).

05The pitch

What the product does (objective value proposition)

scanning source code and configuration files for potential secrets;
validating some detected secrets with third-party providers to determine whether they are active (intended to reduce false positives);
integrating with developer workflows (Git providers and CI/CD) to prevent commits or merges that introduce secrets.

(Feature claims are vendor-stated unless otherwise noted.)

Target market and positioning

Primary buyers: Security engineering / AppSec / DevSecOps leadership in organizations already using Datadog for observability and/or cloud security.
Primary users: Developers, platform engineering, security operations (triage and remediation).
Positioning: Datadog describes the capability as integrated with its observability and security telemetry, enabling correlation between code findings and runtime signals, vulnerabilities, and cloud misconfigurations for end-to-end risk context.

Get a comprehensive analysis of Datadog Secret Scanning including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →