From Watchdog To Working Dog: Datadog And The Expanding Control Layer
Summary
DASH by Datadog 2026 showcased Datadog's expansion beyond traditional monitoring into a comprehensive IT management platform, now generating approximately \$4 billion/year. Positioned at the direct operations and control layer, Datadog is building an "operational envelope" around modern systems, observing behavior, cost, and safety, and increasingly acting on these insights. This includes "left-shifting" to integrate information from the entire software development lifecycle, enabling automated forensic analysis with source code context. The company is also advancing autonomy with its "Bits" agentic family, designed to perform bounded, reversible actions like Kubernetes pod restarts. Furthermore, Datadog is enhancing its security offerings, using production telemetry to prioritize vulnerabilities, layering AI-driven analysis on SAST, and introducing "AI Guard" for runtime protection of AI coding agents like Claude Code, addressing potential data leaks and misuse.
Key takeaway
For DevOps Engineers and AI Architects evaluating IT management and security solutions, Datadog's evolution signifies a shift from pure observability to a broader operational control plane. You should consider its expanded capabilities for integrating SDLC context into incident analysis, utilizing runtime telemetry for precise vulnerability prioritization, and securing AI coding agents with "AI Guard." This approach allows for more autonomous, self-healing systems and proactive security, but requires careful configuration of agentic actions and clear linkages to business governance.
Key insights
Datadog is expanding its IT management platform from operations into work management and security, utilizing runtime telemetry and AI.
Principles
- IT management platforms can emerge from the direct control layer.
- Operational envelopes observe and act on system behavior, cost, and safety.
- Runtime telemetry enhances vulnerability prioritization and agent security.
Method
Datadog builds an operational envelope by observing system behavior, cost, and safety, then increasingly acts on these observations, including left-shifting into the SDLC and using AI agents for bounded, reversible actions.
In practice
- Prioritize vulnerabilities using production telemetry for exploitability.
- Implement AI-driven SAST for triage and remediation guidance.
- Use runtime protection for AI coding agents to prevent data leaks.
Topics
- Datadog
- IT Management Platforms
- Application Security
- AI Agents
- Observability
- Runtime Telemetry
- Software Development Lifecycle
Best for: CTO, VP of Engineering/Data, Director of AI/ML, MLOps Engineer, DevOps Engineer, AI Architect
Related on AIssential
Editorial summary, takeaway, and curation by AIssential. Original article published by Featured Blogs - Forrester.