Datadog observability breaks away from SaaS with BYOC
Beth Pariseau·2026-06-11·via WhatIs
Datadog supports BYOC, federated logs search and third-party SIEMs, but one analyst warns vendor lock-in can take multiple forms.
Datadog observability tools no longer require customers to store data in its cloud, with the introduction of bring-your-own-cloud and federated logs.
Bring-your-own-cloud (BYOC) has become increasingly popular among observability vendors, especially newer startups, as enterprise data continues to grow exponentially in the era of agentic AI. Digital sovereignty concerns also often call for data to be stored locally. This week, Datadog, which was previously strictly SaaS, began supporting the analysis of metrics, logs and traces stored in customer-controlled cloud infrastructure.
"As your teams heavily invest in AI, and you're doing business across multiple geographies, many of you are seeing skyrocketing telemetry volumes at petabyte scale," said Zara Boddula, product manager at Datadog, during a keynote presentation at Datadog's annual DASH conference this week. "This, along with the compliance requirements across regions, presents many challenges. You need more control and flexibility in terms of how you collect, store and analyze those data sets."
Datadog also made it easier for users to query data across multiple log management systems with the launch of federated logs search for its Log Explorer tool, which supports external data stores such as Databricks, ClickHouse and Snowflake.
"Federated logs will be interesting to watch," said Carlos Casanova, an analyst at Forrester Research. "Cisco/Splunk is also going down the federated path for data access. Done properly, it should reduce ingest, storage and compute costs, which every organization wants, without losing data fidelity or operational context."
However, another analyst warned enterprise buyers not to view these changes as a complete escape from potential vendor lock-in. In Datadog's case, it still requires its own proprietary data collection agent or its own version of the open source OpenTelemetry data collector for many of its most advanced data analytics features, including database monitoring, data observability and cloud network monitoring.
Using a proprietary data collection system makes it more difficult for users to extract data when switching observability providers, according to Torsten Volk, an analyst at Omdia, a division of Informa TechTarget.
Torsten Volk
"There are degrees of lock-in," Volk said. "[Datadog] having [its] own OpenTelemetry distribution means that customers would only get base functionality with the upstream OpenTelemetry collector, and all the good stuff is only available when you run it with the Datadog agent."
Volk contrasted this approach with competitor Elastic, Inc, which supports data collected with open source OpenTelemetry collectors for all its observability services.
However, while it's a factor for enterprise buyers to consider, the tradeoff is that customers who buy into Datadog "get a polished, integrated, fully featured platform," he said.
Observability, AI and costs: it's complicated
AI tokenomics has emerged as a hot topic in IT management this year, as the costs of large language model (LLM) tokens have ballooned, sometimes overnight. Similar to other vendors, such as ServiceNow, Datadog has added a new Agent Console to closely govern AI agent behavior, including costs. Agent Console monitors usage and costs for Datadog's own Bits AI agents, as well as third-party agents from Anthropic and OpenAI.
Yanbing Li, chief product officer at Datadog, presents during a keynote at the DASH 2026 conference.
Datadog's AI Guard, an agentic AI security tool available in limited preview, was also designed with minimizing token costs in mind, according to Yanbing Li, chief product officer at Datadog, in an interview with TechTarget before DASH kicked off this week.
"Anything you put in your LLM chain is going to have a latency implication and a significant cost implication, so we actually have a very small model to help us perform a lot of the detection [in AI Guard]," Li said. "For a very sophisticated scenario, we might send it to a frontier LLM, but the combination of putting the vast majority of the traffic flows through a very efficient small language model allows us to make it both highly performant as well as cost-sustainable."
Agentic AI experts have also credited Datadog's Model Context Protocol (MCP) server design as highly efficient compared to default methods. Datadog's new hosted MCP server also now spans both security and observability tools, which "lets AI-native customers build their own prioritization and remediation on top of Datadog's detections and findings," said Katie Norton, an analyst at IDC.
However, reporting on agent token consumption doesn't necessarily make Datadog's AI costs totally transparent or easy to anticipate, Volk said.
I lost count of how many … features were mentioned, but a large number of them are AI-based and come at a per-use token cost.
Eric SwansonSenior SRE, MagicSchool AI
"There are tons of different, differently metered products like APM [Application Performance Management], logs, traces, RUM [Real User Monitoring], profiles, etc. that are billed separately and workload-dependent," he said. "Custom metrics and high cardinality tags quickly lead to wildly different costs for the same workload. Developers can turn on a ton of stuff in the pipeline and via instrumentation, leading to big cost surprises. You will see those on the [Agent Console] report, but it's a lot of cats to herd."
The cost of AI features was a concern for one Datadog DASH attendee this week.
"I lost count of how many 'We are proud to announce!' features were mentioned [during the keynote], but a large number of them are AI-based and come at a per-use token cost," said Eric Swanson, senior site reliability engineer at MagicSchool AI, makers of a generative AI platform for education in Denver, Colo., in an online interview this week.
Agentic AI security and governance
Datadog also expanded support for third-party tools in the security realm, decoupling its Bits Security Analyst tool from its security information and event management (SIEM) tool to allow use with competitors' SIEMs, including Splunk and Microsoft Sentinel. This standalone Bits Security Analyst rolled out in preview this week.
Katie Norton
"That is a sensible commercial move, since it widens the addressable market beyond Datadog SIEM customers and meets data where it already sits," Norton said. "But making the analyst portable to other SIEMs partially detaches it from the observability-context argument Datadog uses to justify everything else in the portfolio, so it competes more on the same footing as the standalone vendors it is chasing."
Norton pointed to a new Runtime Prioritization Engine for security vulnerabilities that Datadog previewed this week as the most significant application security update for the vendor. The tool can automatically detect which systems are most sensitive and important -- dubbed "crown jewels" -- based on telemetry, rather than manual user tags.
"Runtime prioritization is table-stakes these days, but [auto-classification] matters because tag-based prioritization is a well-documented failure mode in large environments," Norton said. "Tags go stale, ownership goes unclaimed, and security teams end up chasing findings that don't actually matter to the business. If Datadog can deliver on that, it addresses a real structural problem."
Beth Pariseau, senior news writer for Informa TechTarget, is an award-winning veteran of IT journalism. Have a tip? Email her or connect on LinkedIn.
Dig Deeper on IT systems management and monitoring
Torsten Volk
Katie Norton
