July 2026 Summaries

The Datadog Runtime Prioritization Engine (RPE) enhances cloud security management by prioritizing security findings based on ownership and the criticality of resources, thus minimizing alert noise and focusing on significant risks. It leverages real-time telemetry data combined with AI-powered capabilities to automatically infer the most likely owner for security issues, even when explicit ownership information is missing, by evaluating various signals such as owner tags, cloud audit logs, and source control integrations. Additionally, RPE dynamically identifies critical resources, or "crown jewels," by continuously analyzing observability data to maintain an up-to-date inventory of essential applications and databases, thereby helping security teams address the most impactful threats. This system enables organizations to streamline their security operations by integrating ownership information directly into their workflows and updating critical resource inventories as cloud environments evolve, ensuring efficient and effective remediation efforts.

The text explores strategies for effective error handling in React applications, emphasizing the importance of collecting and displaying critical troubleshooting information. It discusses various error tracking levels - render, business, and global - to ensure comprehensive error logging and handling. Render-level errors are managed using error boundaries, while business-level errors require manual logging mechanisms for logical issues. Global-level error tracking is achieved through root-node callbacks, providing broader visibility of uncaught errors. The enrichment of error data with user, session, and application context is recommended for thorough debugging, but caution is advised to prevent data leaks by sanitizing sensitive information. The use of tools like Datadog Error Tracking is highlighted for its ability to automatically collect, enrich, and group errors, facilitating faster resolution through AI-assisted investigations and reducing the risk of manual configuration errors.

Datadog faced significant challenges in achieving FedRAMP High certification for its Agent software, which operates on customer-managed infrastructure and must adhere to stringent security and compliance requirements. Unlike the FedRAMP Moderate baseline, the High baseline demands more rigorous control enforcement and cryptographic operations, eliminating exceptions allowed in the Moderate level. The transition required a complete redesign of the Agent's architecture to integrate cryptographic enforcement directly into its runtimes, rather than relying on an external proxy, which was the solution for Moderate compliance. This redesign involved selecting between cryptographic implementations for Go and Python runtimes, ultimately opting for Microsoft's Go distribution to ensure broader platform support and control over cryptographic libraries. The new architecture simplifies customer interactions by embedding cryptographic operations within the Agent itself, thus reducing environment-specific configurations and facilitating easier compliance demonstrations during audits. Despite achieving certification, Datadog remains committed to maintaining compliance as system components evolve, ensuring the Agent continues to meet FedRAMP High requirements.

Nicolas Grislain and his team have developed a two-stage detection pipeline to enhance AI-driven security detection at scale, addressing the challenge of applying expensive AI reasoning to every security event in large data streams. The first stage employs Mambark, a small state-space model pre-trained on sequences of audit logs to score every event, forwarding only the most suspicious ones for further investigation by an AI agent. Mambark's design choices include using a Mamba selective state-space model architecture and a uniform representation for diverse security telemetry data, allowing it to efficiently handle vast amounts of data while maintaining high performance across public benchmarks. In production, Mambark operates as a retriever, enabling the AI agent to focus on a prescreened shortlist of events, thus significantly reducing costs while enhancing detection precision. This system is currently being tested with Datadog Cloud SIEM design partners and represents a potential next generation of AI-powered security detection, integrating efficient anomaly detection with in-depth reasoning capabilities.

Google Security Operations (SecOps) is a platform designed to handle security threats by processing large volumes of security telemetry using a Unified Data Model (UDM), which standardizes logs from various sources like firewalls and endpoints. This standardization allows security teams to easily analyze and respond to threats as data is normalized before it reaches Google SecOps, enabling efficient investigations and reducing the need for separate detection logic for each source. The platform includes Google SecOps packs that come with preconfigured mappings for different log sources, such as Palo Alto Firewall and Windows Event Log, ensuring that they conform to UDM standards and are ready for analysis. These packs streamline the process by allowing teams to write detection rules once and apply them across all sources, reducing manual maintenance and controlling ingest costs by focusing on high-value logs. Observability Pipelines further supports this by providing tools to map logs to both UDM and Open Cybersecurity Schema Framework (OCSF), enhancing the data's utility and enriching it with additional context for better security insights.

Organizations are increasingly adopting multiple AI models to optimize performance and cost for agent tasks and LLM calls, without a clear frontrunner emerging. Treating inference like a pipeline, teams routinely evaluate and switch models for different stages, using lightweight models for simpler tasks and frontier models for complex synthesis. However, infrastructure challenges complicate rapid iteration, safety, and compliance enforcement, especially when providers throttle requests or experience performance issues. AI gateways address these challenges by offering a unified API endpoint for accessing multiple models, enhancing security and reliability while simplifying model evaluation and selection. Gateways enable centralized fallback, retries, and rate limiting, improving agent reliability and budget management. They allow for easy model configuration changes without modifying application code, facilitating iterative model selection. Observability is crucial for understanding trends and ensuring gateway reliability, while budget controls are essential for managing costs and preventing overruns. The integration of observability tools like Datadog provides trace-level visibility into LLM calls, aiding in monitoring and optimizing agent environments.

Stripe Projects, currently in developer preview, is a command-line interface (CLI) tool designed to simplify the setup, management, and billing of third-party SaaS solutions, exemplified through its integration with Datadog. It enables users to initiate a Datadog organization with just two commands in the Stripe CLI, bypassing traditional setup hurdles like email verification and API key retrieval. By collaborating with Datadog, Stripe has streamlined the process of choosing and provisioning observability services, embedding ease of use akin to a package manager for app stack provisioning. Users benefit from seamless billing integration with their existing Stripe accounts, transitioning from a 14-day free trial to a pay-as-you-go plan without additional setup or procurement processes. This collaboration reduces the friction typically associated with managing SaaS tools, allowing technical teams to focus on their core development goals rather than administrative overhead.

Java Flight Recorder (JFR) has long been a vital tool for Java engineers to diagnose performance issues, but its sampling can be biased, especially in CPU-bound investigations, leading to incomplete results. To address this, modern Java profilers, including Datadog's, have combined JFR with agents built on the Java Virtual Machine Tool Interface (JVMTI) and other low-level mechanisms like AsyncGetCallTrace to enhance accuracy. This collaboration with SAP, Amazon, and the OpenJDK community has led to the introduction of a new first-class CPU profiling event in JFR, starting with JDK 25. This new event promises unbiased CPU-time sampling directly within the JVM, reducing reliance on unsupported APIs and enhancing profiling accuracy. The initiative also aims to improve the JVM's profiling capabilities further, with ongoing efforts to support native frames and capture stacks around specific events. As the Java ecosystem adopts newer JDK versions, this development sets the stage for a new generation of Java profiling tools that offer reliable, production-safe diagnostics.

Instrumenting a tech stack for distributed tracing can be a complex and time-consuming process, often taking weeks or even months for large fleets with services written in multiple languages. Datadog's Single Step Instrumentation (SSI) significantly reduces this time, allowing applications to send traces to Datadog APM in minutes by automatically injecting tracers at process startup without requiring code changes. Although SSI is recommended as the default method due to its efficiency, there are instances where manual or custom instrumentation may be necessary, such as with Go services, unsupported runtime versions, or platforms lacking host-level Agent control. Manual instrumentation offers control over the tracer's version and upgrade cadence, while custom instrumentation provides additional detail for specific business contexts by allowing developers to add their own spans or tags. The decision between using SSI, manual, or custom instrumentation hinges on the specific needs and constraints of the services involved, with SSI serving as the primary method and manual or custom options filling in where SSI falls short.

Datadog has expanded its support for OpenTelemetry (OTel), a vendor-neutral telemetry standard that recently achieved CNCF graduation, to accommodate organizations using the OpenTelemetry Protocol (OTLP), OTel Collector, and OTel SDKs. This enhancement allows teams to send OTel data to Datadog via standard OTLP HTTP Exporter, bypassing proprietary components like the Datadog Agent, and enabling direct data ingestion without intermediate layers. Datadog now integrates OTel data into its Infrastructure Monitoring and Application Performance Monitoring (APM), offering consistent experiences without the need for data transformation or Datadog-specific instrumentation. This includes using OTel-native data for Kubernetes monitoring, semantic normalization for hybrid environments, and visibility into OTel-native traces, all while Datadog contributes to OTel's development by advancing standards and collaborating on projects like OTel Profiles. By supporting OTel-native instrumentation, Datadog facilitates vendor neutrality and incremental adoption of OTel, allowing teams to leverage Datadog's capabilities with familiar OTel semantics.

Security engineers using Cloud SIEM navigate complex workflows by investigating signals, tuning detection rules, and managing suppressions, with agents becoming crucial tools in this process. To address these needs, a set of security tools were developed for the Datadog MCP Server, designed to support various interconnected workflows while managing a shared context window to prevent task confusion. The development of these tools was driven by real user behaviors, analyzed through API call patterns, Real User Monitoring data, and chat logs, highlighting common tasks such as detection rule authoring and bulk signal triage, which often hit the system's limits. Progressive disclosure and a custom evaluation framework were employed to manage the context window and test tools' reliability, ensuring that only necessary information is provided for each task and that tools function as intended despite non-deterministic behavior. A lightweight governance model was implemented to maintain tool quality across a growing multi-team toolset, focusing on real user interactions to guide development and refinement, while setting standards to prevent new tools from degrading existing ones.

Bits Chat's Cloud Cost skill integrates cloud cost management with conversational workflows, allowing FinOps and engineering teams to efficiently manage and analyze expenses related to cloud, SaaS, and AI services. By enabling users to ask cost-related questions in plain language, it streamlines the process of tracking budgets, identifying cost anomalies, and determining the root causes of cost changes without manually navigating multiple dashboards or constructing complex queries. With capabilities to correlate cost data with observability metrics such as CPU and memory usage, the tool provides detailed insights into cost spikes and changes, which helps teams identify optimization opportunities and understand the underlying technical factors driving costs. The platform supports a range of providers, including OpenAI and Anthropic, and facilitates seamless investigations directly from cost anomaly alerts, helping users transition from detection to analysis swiftly. This integration also allows the creation of Datadog Notebooks to document investigations, ensuring comprehensive context retention for future reference.

Datadog has been recognized as a Leader in the 2026 Gartner Magic Quadrant for Observability Platforms for the sixth consecutive year, highlighting its ability to execute effectively within this space. The platform's comprehensive capabilities enable organizations to observe, secure, and take action across technology stacks, supporting the growing complexity of AI-native applications with features like Bits Investigation, Agent Observability, and Observability Pipelines. These tools provide autonomous investigation of alerts, visibility into AI agent performance, and control over telemetry data, which collectively help reduce outages and enhance incident response times. Datadog's unified observability and security platform fosters collaboration among IT operations, development, security, and business teams, allowing them to work from a single source of truth and replace multiple point solutions with over 30 integrated products. With end-to-end application performance monitoring and digital experience monitoring, Datadog offers deep insights into user actions and system performances, tying customer experiences to backend systems and business outcomes, driven by user feedback that continually informs platform improvements.

Apigee X is Google Cloud's API management platform used to secure, publish, and govern APIs, with Datadog offering an integration that automatically collects Apigee X metrics to streamline monitoring. This integration aids in tracking proxy traffic, latency, and security posture by incorporating these metrics into the Google Cloud stack, enabling teams to monitor API health and detect anomalies from a unified dashboard. By using metrics like request and response counts, end-to-end latency, and security scores, teams can pinpoint issues, discern between traffic spikes and potential attacks, and align API performance with service level objectives. Moreover, the integration facilitates comprehensive investigation by allowing correlation with logs and traces, enhancing the ability to identify root causes of latency or security incidents. As a result, teams can efficiently manage API performance and security across various environments, with dashboards and monitors that scale as the API program expands, ensuring timely responses to potential problems.

In the realm of AI engineering, managing token costs has emerged as a significant challenge, as excessive token usage can inflate production costs and obscure productivity measures. Datadog's 2026 State of AI Engineering report highlights this issue, noting a substantial increase in token usage per request among its customers. The text explains that token costs accumulate across sessions, tool calls, and users, emphasizing the importance of visibility in tracking these costs to prevent unexpected expenses. It outlines strategies for reducing token costs, such as trimming tool catalogs, using prompt caching, and managing session history through windowing or summarization, while also addressing the need for governance through token budgets and the use of tools like Datadog Agent Observability to monitor and enforce cost controls. The importance of balancing efficiency with agent capability is underscored, as excessive pruning or compression might limit an agent's functionality, suggesting that these optimizations should be guided by data-driven assessments of their impact on performance and cost.

As .NET Multi-platform App UI (MAUI) emerges as the standard for cross-platform UI development within the Microsoft ecosystem, its adoption for building iOS and Android applications has not been matched by advances in observability. Developers often face challenges with unsupported community bindings or maintaining their own SDK wrappers, compounded by the discontinuation of Microsoft Visual Studio App Center. Datadog addresses these issues with its official .NET MAUI SDK, which facilitates application instrumentation through a single supported NuGet package, offering features such as crash reporting, error tracking, network monitoring, and Session Replay. This SDK captures telemetry data across managed and native application layers, providing insights into crashes, user sessions, and performance, while integrating seamlessly into existing Datadog views for comprehensive analysis. Automatic instrumentation and deobfuscation of stack traces enhance engineers' ability to investigate and resolve issues efficiently. The SDK's capabilities extend to tracking user interactions and network requests, providing a unified dataset that aids in performance analysis across multiple platforms, thereby offering a reliable path for monitoring .NET MAUI applications without the need for custom solutions.

AI Guard is a security solution developed by Datadog for AWS Strands Agents to address the dynamic security risks associated with AI agents that can reason through tasks, call tools, and adapt based on intermediate results. By integrating with the Strands plugin, AI Guard evaluates prompts, model responses, and tool interactions during the agent's runtime, allowing it to monitor or block unsafe behavior without embedding security checks throughout the application code. This system registers callbacks on Strands life cycle events and assesses interactions in context, enabling the detection of multistep attacks such as prompt injection, data exfiltration, and tool misuse. AI Guard operates in both a monitoring mode and a blocking mode, allowing teams to adjust security policies without editing the agent code or redeploying applications, making it easier to manage security across various environments. Datadog provides detailed insights into the evaluations with traceable events and aggregate views, helping teams investigate potential security breaches while ensuring compliance with established policies.

DASH 2026, held in New York City, brought together thousands of technology professionals for 2½ days of sessions, workshops, and demos focused on modern systems' building, operating, and securing. Keynote announcements highlighted Datadog's AI-driven features like Bits Detection for autonomous monitoring and Bits Remediation for issue fixing, alongside tools for AI workload monitoring and network management. More than 100 technical sessions covered topics such as AI innovation's impact on engineering, with industry leaders and customers like OpenAI and Samsung sharing insights. Hands-on workshops and expo theaters offered practical guidance on Datadog's platform, while the Security Zone provided immersive experiences to enhance security skills. The event also featured regional delegations, a Women in Tech panel discussing AI's role in the industry, and the fifth annual DASH Partner Summit, which celebrated partnerships and strategic growth in observability, security, and AI.

Apple's platform ecosystem, including watchOS and visionOS, is experiencing growth as developers create applications for the Apple Watch and Apple Vision Pro, yet these platforms lack mature observability tools compared to iOS. Datadog Real User Monitoring (RUM) addresses this gap by providing comprehensive visibility into app behavior, supporting crash reporting, error tracking, and session-level observability for both platforms without requiring a separate SDK. It extends the dd-sdk-ios package to ensure compatibility and testing on watchOS and visionOS, enabling developers to monitor crashes with deobfuscated stack traces, identify runtime errors in WatchKit and SwiftUI apps, and analyze user interactions. Datadog's symbolication platform enhances error resolution by collecting system symbols, allowing developers to use existing workflows for tracking and resolving issues. This integration allows teams to gain insights into user experience and enhance app reliability on these evolving platforms.

Datadog's Static Code Analysis enhances static application security testing (SAST) by incorporating agentic evaluation and Bits Memories, which aim to reduce false positives and improve the accuracy of security assessments. Agentic evaluation allows for a comprehensive analysis of findings by examining repository-wide context, tracing related code paths, and assessing validators to determine whether vulnerabilities are genuine. Bits Memories adds another layer by integrating organizational knowledge and historical false positive reports, providing a more informed context for evaluations. This approach helps security teams prioritize vulnerabilities by distinguishing real threats from false alarms, thereby optimizing developer efforts and improving remediation processes. These features, when used together, offer a holistic view that mirrors human evaluators' depth of analysis, combining code repository evidence with institutional memory to deliver accurate security insights.

Datadog's exploration into experimentation reveals the challenges and strategic insights offered by understanding the effect distribution in experimental programs. While standard practices such as setting sample sizes, waiting for statistical significance, and maintaining a 95% confidence level are followed, the aggregate analysis of multiple experiments often uncovers interpretative pitfalls, primarily due to the inherent 5% chance of false positives under the null hypothesis. The true effect distribution provides a more accurate understanding of experiment outcomes, counteracting the inflated expectations created by the observed effects, which can mislead decision-making and resource allocation. By estimating the effect distribution, teams can better gauge the realistic magnitude of true effects and thereby improve the design and impact of their experiments. This approach not only mitigates errors like the winner's curse and Type S errors but also enhances decision-making through concepts like the expected value of sample information (EVSI), which quantifies the value of information gained from experiments. Moreover, analyzing separate effect distributions for different experiment categories can guide resource allocation more effectively, as seen in the comparison of customer service versus search ranking experiments. Understanding and applying effect distributions transform experimentation from isolated decisions to a strategic asset, offering significant insights regardless of the statistical framework employed.

Datadog Incident Response introduces three AI-powered features to streamline incident investigation and coordination, enhancing the efficiency of engineering teams. The "Bits Investigation" acts as an AI responder, analyzing the same context as human teams to develop hypotheses and identify root causes without assumptions, while providing updates and summaries in real-time. AI-generated chat summaries offer quick context for responders joining incidents in progress, reducing the time needed to catch up by synthesizing ongoing remediation work and key developments. Additionally, the integration with video conferencing tools allows automatic capture and summarization of bridge call discussions, ensuring critical decisions and plans are documented within the incident timeline. These capabilities unify data and communication across platforms, minimizing time spent on information gathering and improving overall incident management effectiveness.

Datadog has been leveraging AI tools to enhance its software development life cycle (SDLC), resulting in significant improvements in internal tooling and processes. One of their key initiatives includes creating an automated AI support application using Gas City to streamline the management of deployment support requests, which has notably increased the number of resolved requests per shift. Additionally, Datadog has developed a shadowing platform using Claude Code and Cursor to test backend query changes against real-world conditions, allowing for comprehensive validation and reducing guesswork. Another innovation involves optimizing memory allocation in their Go services through the implementation of a new parser designed with Claude Code, which led to a 10% increase in network capacity and potential annual savings of $2 million. These projects underscore Datadog's commitment to using AI to foster more efficient development workflows and enhance the overall performance and reliability of their systems.

Datadog's Data Completeness team has developed a robust system to ensure the integrity and completeness of data across its vast distributed ingestion pipelines, which handle billions of payloads per second. This system is crucial for maintaining the reliability of automated decisions and customer-facing dashboards, as incomplete data can lead to flawed outcomes. To achieve this, the team tracks data completeness by segmenting pipelines and monitoring payloads as they traverse each segment, using create and acknowledgment events to gauge completeness. By employing a time-bucket model, the system ensures idempotency and minimizes external dependencies, allowing it to remain functional even during system degradations. Additionally, a load-shedding mechanism dynamically adjusts sampling to maintain accuracy without incurring prohibitive costs. The completeness system is designed to be resilient, deploying independently across multiple availability zones and employing custom in-memory storage to handle the vast data volumes efficiently. By integrating metadata for real-time topology insights and facilitating incident response, Datadog has created a system that not only detects and mitigates pipeline issues swiftly but also supports ongoing automation and scalability efforts.