Datadog Workload Protection

Name: Datadog Workload Protection
Brand: Datadog
Rating: 4.4 (1416 reviews)

Leader

Datadog provides cloud-scale monitoring and security for metrics, traces and logs in one unified platform.

Est 2010|Valuation $91.4B|Raised $795.9M

LinkedIn 546K|Website|Web traffic 4.6M|FTEs 8,100|HQ New York, New York, US

MarketsCloud-Native Application Protection Platform (CNAPP)

01Competitive Landscape

Top competitor comparison (snapshot)

| Aspect | Datadog Workload Protection | CrowdStrike Falcon Cloud Security Runtime | Wiz Runtime Sensor | |---|---|---|---| | Starting Price | Published per-host and per-container pricing is available from the vendor, with both annual and on-demand options listed | Quote-based; some marketplace pay-as-you-go options exist | Marketplace listing shows subscription model; platform pricing generally quote-based | | Typical fit | Organizations already invested in the Datadog platform seeking runtime detection integrated with telemetry correlation | Organizations seeking mature EDR + cloud runtime protection with managed options | Organizations using CNAPP-first approaches that want to extend posture capabilities into runtime visibility | | Key strengths | Single agent integration with the platform; telemetry correlation across security and observability; published engineering work on eBPF scalability (vendor-authored) | Broad security platform footprint; established runtime protection capabilities; marketplace pay-as-you-go for cloud options | Strong cloud security graph and remediation workflows; CNAPP posture capabilities | | Key weaknesses | Community concerns about pricing volatility; Active Protection appears limited/in preview for certain threats; limited independent efficacy publications | Can be modular and costly; public pricing transparency varies | Runtime sensor is part of a larger paid platform; overall platform learning curve and cost considerations |

Narrative analysis

Where Datadog Workload Protection is likely to be most effective: - Contextual investigations: the platform integrates security signals with logs, metrics, and traces, which can support investigation workflows for organizations that already rely on the vendor platform. - Ease of adoption when the Datadog Agent is already deployed: adding runtime security can be operationally simpler for organizations standardized on that agent. - Engineering documentation: the vendor has published details on eBPF-based monitoring and event filtering that indicate investment in telemetry efficiency (vendor-authored). Where competitors may have advantages: - Broader prevention/enforcement: other vendors may document broader runtime enforcement capabilities beyond the initial previewed blocking features. - Dedicated security-first workflows: CNAPP and security-specialist vendors may provide deeper posture and remediation workflows tailored for security teams. - Open-source alternatives: some organizations prefer open-source runtime detection projects integrated with custom backends to reduce license cost and maximize control. Adoption trends / share signals (caution): - Third-party "mindshare" or engagement metrics are available from market platforms, but these should not be treated as authoritative market share data without careful validation.

01Competitive Landscape

Top competitor comparison (snapshot)

Aspect	Datadog Workload Protection	CrowdStrike Falcon Cloud Security Runtime	Wiz Runtime Sensor
Starting Price	Published per-host and per-container pricing is available from the vendor, with both annual and on-demand options listed	Quote-based; some marketplace pay-as-you-go options exist	Marketplace listing shows subscription model; platform pricing generally quote-based
Typical fit	Organizations already invested in the Datadog platform seeking runtime detection integrated with telemetry correlation	Organizations seeking mature EDR + cloud runtime protection with managed options	Organizations using CNAPP-first approaches that want to extend posture capabilities into runtime visibility
Key strengths	Single agent integration with the platform; telemetry correlation across security and observability; published engineering work on eBPF scalability (vendor-authored)	Broad security platform footprint; established runtime protection capabilities; marketplace pay-as-you-go for cloud options	Strong cloud security graph and remediation workflows; CNAPP posture capabilities
Key weaknesses	Community concerns about pricing volatility; Active Protection appears limited/in preview for certain threats; limited independent efficacy publications	Can be modular and costly; public pricing transparency varies	Runtime sensor is part of a larger paid platform; overall platform learning curve and cost considerations

Narrative analysis

Where Datadog Workload Protection is likely to be most effective:

Contextual investigations: the platform integrates security signals with logs, metrics, and traces, which can support investigation workflows for organizations that already rely on the vendor platform.
Ease of adoption when the Datadog Agent is already deployed: adding runtime security can be operationally simpler for organizations standardized on that agent.
Engineering documentation: the vendor has published details on eBPF-based monitoring and event filtering that indicate investment in telemetry efficiency (vendor-authored).

Where competitors may have advantages:

Broader prevention/enforcement: other vendors may document broader runtime enforcement capabilities beyond the initial previewed blocking features.
Dedicated security-first workflows: CNAPP and security-specialist vendors may provide deeper posture and remediation workflows tailored for security teams.
Open-source alternatives: some organizations prefer open-source runtime detection projects integrated with custom backends to reduce license cost and maximize control.

Adoption trends / share signals (caution):

Third-party "mindshare" or engagement metrics are available from market platforms, but these should not be treated as authoritative market share data without careful validation.