Episode Transcript
KB [00:00:10]:
What's up everyone? It's KB, and I'm on the ground at Dash by Datadog at the Javits Center here in New York City. This is the 9th year Datadog has run this conference. This used to be a room that came for dashboards and uptime alerts. 5,000+ people are here now 60-odd sessions, 20 workshops, and 30+ speakers are gathered here this week. Teams have pushed AI into production, and a lot of them can't see what it's doing once it's running, which means you either have to catch the problem at 3 AM or your customers catch it for you. So across the next few segments, I'm sitting down with the people running and securing These environments to find out what's actually holding up and what's still a slide. You'll also get to hear from both of Datadog's co-founders too. This is From the Field in New York City.
KB [00:01:21]:
Joining me now is Olivier Pomel, CEO and co-founder at Datadog. And today we're talking about the current security flaw, the observability advantage, and why modern attacks are exposing what could be a much bigger industry problem. So, Ollie, great to have you here.
Olivier Pomel [00:01:36]:
Thank you, Karissa.
KB [00:01:37]:
Okay, so I was at the keynote yesterday. I know you were all sort of like revolving through a door and having a lot of product announcements. So Datadog has launched more than 100 capabilities at Dash over the last couple of days. And which of those launches on the security side do you think will make the biggest impact to customers?
Olivier Pomel [00:01:57]:
Yes. So we actually would like to think of pretty much everything we do these days in 2 buckets. There's Datadog for AI and AI for Datadog. And I think for security, it's the same. I think there's 2 really interesting pieces we ship. One is, you know, when you think of Datadog for AI, we shipped AI Guard, which is a new piece of functionality that actually goes and intercepts everything that goes in and out of AI agents and AI models and helps detect and block attacks, basically. So that works for the agents people are running already, the agents people are building, the new ones. Okay.
Olivier Pomel [00:02:33]:
It works with coding agents, which is a really interesting new attack surface that is being massively adopted, massively deployed in every single company we can see. So it's becoming very important. And it also helps detect or auto-detect which agents are talking to which models, are talking to which services anywhere. So that's a big problem for companies. So that's the first part, which is Datadog for AI. Second part in AI for Datadog, is around helping companies respond, analyze and respond to all of the threats and vulnerabilities they have. So we shipped a lot more functionality into our Bits AI assistant for security.
KB [00:03:15]:
Yes.
Olivier Pomel [00:03:15]:
So, you know, it can do threat hunting and do a number of different things. But also it is really, really, really good at investigating all of the signals, the issues, the incidents And understanding which ones are benign and which ones need further investigation.
KB [00:03:34]:
Because you've got that fidelity there.
Olivier Pomel [00:03:36]:
Yes.
KB [00:03:36]:
Yes. Right, right, right. So I want to shift gears slightly for a second. So Datadog has come historically from an observability background, not traditional security. So looking back now, did that actually become your biggest advantage given altogether contextualized the fidelity that you've got
Olivier Pomel [00:03:56]:
Yes, so I mean, that's our right to win, right? That's why we entered the space to start with. That's why we're different. That's why we come in with something fresh, you know, because if you looked at the market in security 5 years ago, you know, you ask yourself, do you need another security company? Maybe, maybe not. You know, there's plenty out there. There's 2 ways to look at this also. The first one is when you think of the data that is coming together for security, Most of it is the same as observability data. You know, it's data about the networks, what's running on the machines, what the end users are doing, what traffic's going through. So all of that is data we already get.
Olivier Pomel [00:04:34]:
And, you know, it doesn't make sense actually for companies to gather it in multiple places, pay the performance and the storage tax twice to send it to different providers, once for security, once for observability. So that's, that's one way to look at it. Another way to look at it is The users. Who are the people who actually consume, produce, and fix the security issues? These are the developers, the ops people mostly. And so if you actually want to catch up with the constant increase in security surface and attacks and everything else, you have to treat that at the source. You have to put the security tooling in the hands of the developers and the ops people. That's what we do.
KB [00:05:14]:
I've come from a security practitioner background myself, and when I'm talking to vendors, they're like, well, you can't really do security without observability. That's exactly what you do. Mm-hmm. So where do you sort of see the future of this going? Do you think that's going to be more pressure from customers, not necessarily towards Datadog, but on vendors to say, hey, we need that capability to contextualize things, to have that data, to have it in the one place, to understand the fidelity and really understand what we're doing moving forward to remediate some of these security issues?
Olivier Pomel [00:05:44]:
Yes, I think it's, I mean, it's completely where the world's going. We see it today a little bit, and we've seen it early on with our security products. We have thousands of customers on it, on that part of the business. So we see the pull from the market. Also, if you zoom out, if you step back a little bit, and if you look at where things are going, like we see a great increase in productivity for engineers, who can use AI agents for coding. What it means is that, you know, what used to be done by a team of 8 with a lot of specialized roles, now maybe will be done by a team of 2 or 3. What this means is that you'll see a lot of those roles come together. Instead of relying on someone who is completely specialized and focused on security, maybe you'll have one person who does a little bit of product, a little bit of development, a little bit of security, a little bit of design, and has to understand and bring together all of those different task streams together.
Olivier Pomel [00:06:36]:
Wow. As part of their building activity. So we think that The world is getting there. Now, what this means for the ecosystems, I think we'll see. Right now, it's a very fragmented ecosystem. There's a lot of different companies doing a lot of very different things. We hope that the path from here to there involves quite a bit more of us and observability to tie it together.
KB [00:06:54]:
Just going back to your comment, like everyone will do a little bit of everything. Do you think it'll just get to a point in the future, whereas historically, development teams have been in a silo and security security or AppSec or whatever you want to call it have sort of had their own team. Do you envision, given your role in this space, it'll just become like one sort of big team and then people will really specialize in an area? What are your sort of thoughts given everything you're doing here at Datadog, but just the industry in general and where it's headed?
Olivier Pomel [00:07:23]:
Yeah, I mean, I will preface it by saying it's hard to predict exactly where it's going because we're all getting up to speed with the tools, the agents. Even when you talk to the companies that are actually building the models to start with, even these companies have to keep transforming in terms of how they structure their teams. Now, that being said, I think a very logical outcome is you'll have a bunch of new products. Each of those products will have owners, developers that will have to cover the full spectrum, likely from product to value to security to infrastructure and pretty much everything else. Then you probably will have other centers, maybe specializations, folks who specialize in security, in incidents and things like that, that can cut across those various teams and give them influence, tooling, et cetera, et cetera.
KB [00:08:12]:
So Ollie, what I really want to know, and you're one of the best people to answer this question, would be, was there pressure internally or externally to follow the industry playbook, to just acquire your way into security?
Olivier Pomel [00:08:27]:
I mean, look, there's always an expected way of doing things. We've never— we haven't done very large acquisitions. You know, we've mostly done acquisitions for talent, builder talent, I would say, like teams that were focusing in a specific area that had some product success, some market success, and that we could build around. But the way we deliver value is mostly by providing a very unified platform. So it's not the case that, you know, we'll just buy a company and, you know, change it. Plug it in. Yeah, plug it in, change the color palette on the product and call it a day. Whenever we do an acquisition, we replatform everything, we rebuild it on our core platform so everything's fully integrated.
Olivier Pomel [00:09:07]:
So we might still do more, we probably will do more, and we likely do bigger acquisitions in the future, but we still keep in mind that understanding that we need everything to be fully integrated, that's part of the core value we give to the customer. But the other part of it is how you go to market and do you need to replicate some specific ways of interacting with the market that you could get from another company? Culturally, we've also been very adamant on trying to figure out what would work in the market, build it differently, see if it sticks. We've done that for observability. When we started in observability, we were told that You cannot build a successful enterprise business in observability, or at the time it was called monitoring, not observability. You cannot build a successful enterprise business unless you're quite heavily go-to-market-centric and top-down in terms of the way you sell. And we've done very, very well by selling a product that is largely bottom-up, largely adopted before it's being sold, and combining that with an enterprise motion later on. Yes. In the security space, we're trying to do the same thing.
Olivier Pomel [00:10:12]:
We start largely bottom-up. We were very successful with the acquisition of bottom-up customers, and now we're coming to the point where we're building the top-down motion that goes with it so we can really speak the CISO language and make sure we connect that, we fill that gap there.
KB [00:10:27]:
So do you think that vendors that buy just like companies and like plug them in, one of the things that I've heard in this space would be they're worried, as in customers are worried about like interoperability because it's not there. But you're sort of saying, well, we take it, we replatform it. you know, replatform everything, we do it properly. Obviously, that's probably a little bit longer of an approach, but it's better long-term, it's more sustainable, there's more longevity. Are you hearing that as well from perhaps some of your customers?
Olivier Pomel [00:10:52]:
Yes, and again, I mean, we're biased obviously because that's our approach, and when customers become our customers, they also buy into that approach. So, but definitely we see the value of having everything being fully integrated. The data is integrated, the user experience is integrated, the worldview is integrated. What you end up with if you have a very fragmented setup is you have blind spots, impedance mismatches between various parts of your instrumentation or your tooling. You have pockets of users, so people don't really speak the same language internally because some of them use one tool, another one, the others use another tool. They don't speak to each other. And by the way, that's why we started Datadog to start with. I mean, the founding story was My co-founder and I used to work together.
Olivier Pomel [00:11:37]:
I used to run the dev team, he used to run the ops team. The dev and the ops team used different tools and they were fighting all the time. You know, we were dealing with the finger-pointing. We started Datadog as a response to that. I think security is another leg, and we've definitely seen the same dynamics, you know, both in our companies and in the real world around us.
KB [00:11:52]:
That's a great point because I remember even being in security, people would say like, you guys are like the police trying to tell us what to do, but it's like, we're just trying to do our jobs. Do you think now, like with Datadog, but just the way the industry is moving, that finger-pointing and not being collaborative is starting to reduce now, would you say?
Olivier Pomel [00:12:10]:
Yes, I think, you know, when I look back at what made us successful for observability, we brought those teams together, so we did that. At the same time, you know, this was the rise of the cloud, and the cloud was also forcing those 2 roles to come together. And so we were right, you know, we had the right idea, the right implementation at the right time with the right technical shift that would favor it. I think we're going to see the same thing now with AI. AI is a catalyst that is going to bring together security with DevOps, and we want to be there for that, basically.
KB [00:12:41]:
Do you think as well, because of AI, I've also been hearing that that is like pushing people to do more now, like it's sort of forcing them in a position to think more about security and these other elements. Do you think if AI wasn't where it is day, people wouldn't be thinking like that?
Olivier Pomel [00:12:55]:
I think there's just a level of urgency that we haven't seen in a while, and part of it is new surfaces that are quite a bit scarier to manage than others, like the agents and the AIs. Part of it is also the, you know, the next stage in the arms race we're living through right now with agents making it a lot easier to both discover and exploit security vulnerabilities. And so there's a level of urgency that is far Sure.
KB [00:13:20]:
So Ollie, when you look forward to the next few years, and I know it's a hard question to answer because things change day to day, week to week, do you think the market will start consolidating around platforms that understand system behaviour end to end rather than sort of a standalone security product? Now, I ask you that because if we go back in time, It was we outsourced everything to a vendor, then we went to a point solution, and now, you know, we've got tool sprawl, AI sprawl, people sort of bringing it back. So it's almost like history does repeat itself.
Olivier Pomel [00:13:55]:
Yeah, I mean, look, we've lived through it with observability. It was a very, very, very Balkanized, crowded set of categories, a lot of tiny, tiny products that were used and combined together. We've proven that the right approach was to have a platform that covers a wide breadth of issues and brings as many users and as many teams as possible. We think the same is happening, already started happening for security, and I hope, you know, in 5 years we can have that conversation again and say obviously that's what happened. It doesn't make sense for customers to combine 47 different solutions and be the system integrator. Everything has to live together.
KB [00:14:37]:
Do you think that people then are worried about there being disjointed, mismatched things, like you said before, like blind spots? Do you think that's a very big fear for them perhaps?
Olivier Pomel [00:14:47]:
Yeah, and I think they see it through the angle of the blind spot. They see it through the angle of, hey, nobody can agree about reality in my company. They all say different things. It can also be the fact that they don't feel like they're getting good value from what they bought, you know, because they have all these tools. Yeah, they overlap or they're not fully deployed, or, you know, they're not, you know, because it's hard to get enough momentum behind any one of them. And so you end up in this uncomfortable situation where you have a ton of stuff, you don't feel like you're fully covered, you don't get good agreement internally about what's going on, you know, and that's not a good position to be in.
KB [00:15:20]:
So how do you think we got there as an industry? Is it because so-and-so used this tool and they started, then they want that tool, and then we just get a bit of a melting pot of tools then as a result of it?
Olivier Pomel [00:15:31]:
Yeah, I think it's in great part it's because there's constantly new threats and new approaches emerging, and it's tempting to go after the very specific thing that is new and differentiated. And so, you know, these new issues are top of mind for, you know, a year, 2 years, and tools get bought and they get added to the mix. And as you know, it's very, very difficult to get rid of a tool in security. Like, it's a a nerve-wracking choice to make.
KB [00:15:58]:
Well, yes, because people talk about the risk, but then also the cost of doing that. Do you think that there are vendors that perhaps know that and perhaps have lacked then innovation because they know it's hard to just move out of this, would you say?
Olivier Pomel [00:16:14]:
Yes, yes. I definitely think it's the case. I think, again, if I project everything back to what we've seen 10 years ago in observability, that was the case too. We disrupted companies that were so big and so— that had so much more resources than we did. And the reason we were able to do that is monitoring and what we were doing was very bite-sized, also very sticky. It was very difficult to remove those kinds of tools. The incumbents didn't have a strong incentive to keep innovating. They atrophied their muscles for innovation.
Olivier Pomel [00:16:44]:
It became a lot easier to displace those. Not everyone, but a lot of players in the security Yeah, because
KB [00:16:51]:
I always thought that. I always thought if it's too hard, cost, risk, people won't move away. How does a new player sort of come into it? But you've obviously done a very good job at doing that.
Olivier Pomel [00:17:02]:
Yes, and I think the challenge is always, you know, when you have a platform approach, you need to do very good at a number of things at the same time. When you— it's easier to get early rapid traction with something that is very specialized. In the long run though, the value comes from being broad and, you know, cut across a large number of issues, bring together as many teams as possible, as many eyes as possible. You know, what gets me excited is that we're starting to really close together, to close the operations and development loops. So we get to a point where, you know, with the help of all of our observability products and streams and everything else, as well as the agents we built on top of them, Mm-hmm. we can go from detecting an issue, diagnosing an issue, auto-resolving an issue, and make that work in a fairly automated fashion. That's pretty exciting. Same thing when it comes to development, building a feature.
Olivier Pomel [00:17:52]:
So that's already handled by the coding agents, but then testing it, validating it against production, shipping it, making sure it still works when it's running in production, understanding what the end users are doing with it. Is it delivering the right value to the business once you've shipped it? Is it secure? Automating all that loop, I think, is super exciting and is going to be liberating for not just for us, but for our customers.
KB [00:18:13]:
Well, I'll have to come back next year and see how many more announcements you're going to bring out. So, Ollie, thank you so much for your time. Really appreciate it.
Olivier Pomel [00:18:19]:
Thank you.
KB [00:18:19]:
Thank you. Joining me now is Alexis Lê-Quôc, CTO and co-founder at Datadog. And today we're talking about system behavior and the AI reality. And honestly, the way you describe modern attacks almost sounds like the rules of security have completely changed. So Alexis, great to have you here.
Alexis Lê-Quôc [00:18:52]:
Thank you. Thank you for having me.
KB [00:18:54]:
Okay, so I really want to start with, you've said AI attacks now behave more like systems than traditional security events. So It's a pretty massive shift, but what do you sort of mean by that?
Alexis Lê-Quôc [00:19:05]:
I mean, I think of what we've seen probably in the past, you know, a couple of months, but we've been— we've seen it coming, but now it's very clear is the speed at which sort of the whole cybersecurity environment is moving. Yes, it's mind-boggling in the sense that I think I remember the days where sort of the proper SLAs for reacting to a particular security event was, you know, it's critical, we have 30 days, you know, we'll get it done. And even that was, you know, frankly difficult for a lot of people because of the complexity, because of the amount of communication that there amount of coordination between teams. And now what's forced upon us is a much faster cadence, a much faster pace, and it's coming from all over the place. So I think it's an entirely new game out there. I think the industry has to adapt and the view we take, and I think it validates the thesis we've had for a long time, which is— Right. Proper security flows through proper observability. These are two sides of the same coin.
Alexis Lê-Quôc [00:20:27]:
And I think up until now, the case stood, but maybe needed, you know, a bit more explaining. And I think now everybody's facing the reality that you have to know where your potential problems are. Now, remember, this was maybe 2023. Mm-hmm. the whole industry was seized by the Log4j problem, right? Yes. And this was something where I remember in the first few days trying to figure out what's the exploit, what are the patches, and there were a few iterations, you know, and after a week or two everything was sorted out. On paper we knew where we stood, and then 6 months in you'd still have people chasing down instances of Log4j because they didn't know where it was deployed, they didn't know who had access to it. Yes.
Alexis Lê-Quôc [00:21:19]:
So I think the speed, the scope, the complexity are really acting as huge hurdles, and I think the traditional approach is just not going to work. And now if we had doubts, if anybody had doubts before, and we had doubts, Now it's, it's blindly obvious. It's— that's the traditional way of doing security just cannot stand. It has to change. And AI is forcing us to change, um, with, you know, in a timeline that's— we have to change, you know, next week. Now we have to change, you know, 2 years from now. We'll change this because who knows what, what's gonna, what's gonna happen next week. And literally, uh, between, you know, I think between an attack being public and the first exploits being available, we're talking, you know, days, you know, hours.
Alexis Lê-Quôc [00:22:14]:
We don't know. I think the concept of zero-day, which was reserved for the most expensive, valuable type of vulnerabilities, or that's now, you know, Table stakes. Mm-hmm. Like why would it take you more than a couple of hours to come up with something? And then you can spend equal, you could go easily fast, as fast to go scan and let's see what's available for attack. And so now on the receiving end of that, what I think that triggers is that triggers a lot of a strong, necessity to go and act immediately, a response that has to be structured. Panic is not going to cut it either, right? No. It's not like, oh well, we don't know, because it's going to come from all directions at once. And I think the ones that can withstand this level of intensity are the ones that have a proper operating model for cybersecurity.
Alexis Lê-Quôc [00:23:19]:
And that comes from knowing what you have, knowing what's going on, knowing who's responsible for what. So The concept of ownership of systems, the concept of these systems being observable, being able to know what you run, where, how long it's been, if you need to change it, who you need to talk to, all that stuff, which I think we came to somewhat as an industry, you know, it was very laborious and labor-intensive. That's changing under the, you know, Under the pressure of AI.
KB [00:23:52]:
So I want to get your view. Where do you sort of think customers are? Do you think— and you mentioned before, like, it's sort of forcing people to change. Historically, people don't want to change. They take ages to make decisions. Panic's not going to cut it, to your point. So where do you think people are at the moment?
Alexis Lê-Quôc [00:24:09]:
I think there's— they're on a spectrum. Of course, if you imagine you start a company today, you bake that in, in your operating model, right? Everybody who is part of joining the company, that's their reality. The difficulty is for much more established companies that have existed for a long time. To me, the first stage is kind of acceptance of the new reality. Yeah. And that in itself is not something that that happens overnight. Right. But nonetheless, I think there's been enough sort of media attention, enough actual examples, enough importance paid by sort of large credible organizations to say this is a real problem.
Alexis Lê-Quôc [00:24:57]:
This is not just science fiction anymore. And so now there's a lot of top-down pressure inside organizations to adapt. There's not a very clear playbook that's And that's also what we're trying to give our customers is, look, we're giving you the platform to operate this change. I think if I look back in terms of profound transformation, you have the cloud transformation. That was much more comfortable in a sense. It was also fairly profound, but it was much more comfortable because the pressure didn't come with such an intensity and such an urgency. Sure. I think today AI, whether it's in security or whether it's in, you know, sort of coding agents and software engineering, the urgency is felt very deeply.
Alexis Lê-Quôc [00:25:47]:
That's causing a lot of angst, I guess. But again, I think you have to look at it with a sort of dispassionate eye and say, okay, what's the problem now? Where, if I think about, you know, where are my critical assets? We start there. There's no point in trying to boil the ocean and transform the company from soup to nuts. You start from the critical assets. What's in place? What do we have? What do we need to change? And you do what you need to do. If you don't have good observability there, you need to put it in place because there's no— The old world where someone's looking at logs, scroll by. It's not possible. I mean, I think it's okay when once in a while you have a problem happening.
Alexis Lê-Quôc [00:26:40]:
It doesn't work when it's, you know, from one day to the next. And you could have one day with multiple things hitting you at once, whereas— and this would be an all-hands-on-deck response. Most organizations are reasonably well equipped to have all hands-on-deck response, you know, once in a while, not multiple times a day. And so there's no world in which that goes through, that is solved with, you know, human labor. The speed, the breadth, it's unmatched. So we need deep automation. And that automation, AI can provide it if and only if it's grounded in in sort of the truth as it is, the system as they are, what is running, who owns what. And so that I think is a chance for the industry also to evolve.
Alexis Lê-Quôc [00:27:31]:
Right. And I think it's— I'm optimistic that we come out on the other side of that with a much more sort of streamlined type of operation, much less painful, because I think when we talk to customers, there's also a sense that the way we've been doing things is painful. It has been workable, but this is not the ideal way. I think no one will say, yes, we've been doing, you know, cyber, it's been ideal, and if only we could keep doing it this way. I think even then, you know, there'd be, okay, yes, it's the status quo, it's okay, but could we— if only we had the opportunity to do something better. Okay, now the opportunity is in front of us.
KB [00:28:16]:
So then do you still think a lot of companies are still looking for attacks like the old way then? Do you think that mindset's still there or do you think it's dissipating now?
Alexis Lê-Quôc [00:28:24]:
You know, mindset is probably the— tech changes much faster than mindset. The gating factor is mindset. And once in a while you have, I think you do have pieces of technology that reset the mindset. And very fast. I mean, if I think about, you know, things like ChatGPT and at the end of 2022, the change in mindset was almost overnight. Now, is it possible that the new cyber landscape acts as an accelerant in the same way? I think time will tell. I think everybody overall in our industry, everybody knows that AI is is sort of hurling us towards a deep transformation. No one's, I think, fully mapped out exactly what shape it's going to take, but there's this sense of the old way cannot last.
Alexis Lê-Quôc [00:29:18]:
We haven't figured out exactly precisely what the new way looks like, but we know, everybody knows, that doing things the old way is not possible anymore. Now there still can be a form of acceptance of that. There could be denial. But, you know, I want to see the ship sail. And so we, you know, we have to get on with the program.
KB [00:29:41]:
So then do you think people are rattled by we don't have a new way yet? And also, if you look at a large enterprise, historically it would take so long to make decisions. So do you think because of AI is now forcing them to make things like make these decisions faster than before? They— it's sort of maybe not punching them in the face, but it's sort of— it's really catching them off guard.
Alexis Lê-Quôc [00:30:05]:
I mean, it's— I think large enterprises or, or small companies, you know, equally, uh, any change, you know, I think to the point you're making about changing the way we do things, of course, if you're a small group of people, it's easier to adapt because effectively communication becomes your bottleneck, right? So if you talk to a few, you only have to talk to 10 people to change the way you do things, you can think about doing that relatively quickly. It's a large enterprise, it's much more difficult, and the speed at which and the fidelity at which the information percolates through, people change the way they do things, varies. I think the large enterprises that that give autonomy to the people doing the actual work, I think they can adapt much faster. Because they're saying, the frameworks change, the old way doesn't work. Mm-hmm. We can't dictate to every single person the new way is this. Nuances in certain pockets of the organization, for a variety of reasons, that the the classical sort of command and control structure cannot anticipate. But now, if you think about AI, the beauty of the AI tools is you can also use it to reason through the kind of change you need to put in place.
Alexis Lê-Quôc [00:31:29]:
I see. And that's something new, right? So before, maybe you'd have to enlist third parties to come in and perform an audit on how you do things and come up with best practices and sort of a transformation plan and so on. And I think what we're seeing is this obviously cannot happen at the scale that needs to happen. Right. It will need to be— the teams themselves will need to take ownership of that and say, okay, the old way doesn't work. We have to figure out the new way, how we go about it. I have faith in this bottom-up transformation. Then needed is a sense of leadership, right? At the top is like, the direction is this, this is where we're going.
Alexis Lê-Quôc [00:32:12]:
Right. I think it's having also setting realistic expectation from leadership. It's like, we can achieve this and that's acceptable for our customers, for instance. What's not helping is if you have messages coming from the top that are, everything's going to change completely, but, and you are expected to all go in one direction, as fast as you can. Okay, that conveys the urgency. The problem is, it's difficult then to translate into an answer to the simple question, okay, but what do we do? That has to come more tactically understood. It's more of a bottom-up transformation, ultimately. Every single The person has to change.
Alexis Lê-Quôc [00:33:03]:
There's a message from leadership that has to carry clarity, but the change ultimately is the individual who changes, not the organization. The organization changes because the individual changes. Even at Datadog, we've worked making sure that what AI brings in terms of how we build products, how we operate software stacks, how we secure products, how we understand attack surfaces, how we think about security response. That has to be— it's a message that the fact that it changes is something I've broadcast to our entire team, but then also giving them the ability to define how they want to do it. So I think what we want to see is, for instance, you know, in terms of response time, we go from, you know, X to Y. Okay. That's the high-level objective. How exactly that happens, are we organized in the right way? I don't necessarily know because I'm not the one who's experiencing the friction every day.
Alexis Lê-Quôc [00:34:07]:
So I think that has to be given to the individuals, to the teams to figure out. And where I see ourselves as Datadog, as a provider, as a platform, is like, Here's the substrate you can build on. Here's the platform you can use to make your work visible, gather the data. We're trying to simplify things, right? So if you want to get deep telemetry about a system, you don't have to invent that. We took care of that. Now, what you make of it, how you feed that into your operating model, That's for you to decide. That's always been our position is we provide the platform, we provide the tools, but it's largely, you know, the SaaS model has enabled that. It's like we will accompany you in that transformation, but the transformation is still within.
Alexis Lê-Quôc [00:35:07]:
We're supportive, but nonetheless external to that.
KB [00:35:12]:
What I'm really curious to know is when we sort of look ahead the next few years, again, it's hard to know, you're not Nostradamus, I understand that, but does the security industry fundamentally need to rethink what detection even means in this AI sort of space now?
Alexis Lê-Quôc [00:35:30]:
I mean, I think it has to rethink itself, you know, from the ground up. That's my— Detection, response, remediation. Again, I think detection where the deciding agent for detection is a human, I think that's no longer applicable. It's not a job anybody would want because there's just too much going on. And of course, there are people in that role and The IT world will evolve. For instance, when I think about AI, the impact that it has, whether it's security or operations, more broadly speaking, the opportunity that AI provides is not one where we replace people. The message I think we've tried to convey at the keynote is, yes, we want to drive towards more Autonomy always has an element of human judgment, which the machine just can't— can sometimes approximate, but can never fully sort of substitute. Right.
Alexis Lê-Quôc [00:36:46]:
It's like somebody has to say yes or no. Now, I think it's our job to make it so that the time when somebody says yes or no is as least disruptive leverage as possible. But nonetheless, I think detection, it has to be completely agentic now. Now the question is, and this is where context plays a huge role, right? Because if on the one hand we say, well, there's a lot more going on and the various models that create easily exploitable vulnerabilities or effectively make them obvious, That doesn't mean that all of a sudden we have to patch and fix everything all the time because the context that we have to feed into it is what are the assets that are behind it, right? So the intent from a security standpoint, if I were to go after a particular asset, the value, the perceived value of the asset plays a huge role. Yeah. Even if the means of coming up with an exploit, even that price, that cost is going down. It's still, you know, I'm not gonna go spend time to get, you know, some test data in some, you know, S3 bucket that's left open. Like, okay, it has no real value.
Alexis Lê-Quôc [00:38:03]:
So for me, because I can't make something out of it. So I think the context is, okay, what's valuable? What assets are valuable? And in that context, needs to be fed into agents. The value, it's inherently human. It's human judgment. What is valuable? What is not valuable? The machine doesn't— the models don't have a concept of that. I mean, they can infer some of that, but fundamentally it is— some of it is conventional, but fundamentally it is a human judgment. Right. So this is where autonomy For us, autonomy has— human judgment is just somewhat displaced.
Alexis Lê-Quôc [00:38:44]:
And I think it was applied historically in the security industry at the wrong place. So detection, for instance, it's expensive. It's sort of these repetitive, where you have to be on alert all the time. It's something that we're not well equipped to do. And the machine just go on and on and on. It doesn't get tired. And so it just performs, and its performance doesn't degrade over time. It doesn't degrade with fatigue.
Alexis Lê-Quôc [00:39:12]:
It doesn't get bored. And so that's what we go leverage. And before AI, the tech wasn't ready. You'd have a bunch of rules, heuristic. It was very brittle. As soon as the conditions changed, the rules failed, and you missed something. And thus People had to come back and say, okay, well, the rules don't work, or I'm going to spend my day— instead of spending my day triaging, now I spend my day tweaking the rules. It was not ideal either.
Alexis Lê-Quôc [00:39:41]:
But now I think the tech gets to the point where it can triage pretty effectively. It can triage at scale, but then it needs the context to be able to figure out, okay, what do we do next? And so that it's not Every single signal triggers a whole response regardless of, you know, of the issue at hand.
KB [00:40:04]:
So final question for you would be, at the keynote you mentioned that you were always asking your customers like, how can we help? Remember you saying that? What I really want to know is when people leave Dash this week here in New York City, what's the one message you hope that they take away?
Alexis Lê-Quôc [00:40:23]:
I think they— what I'd love them to walk away with is one where, yes, we can help, and we can help in very concrete ways. I was talking to customers earlier, and what they were excited by in the keynote, it's actually interestingly varied, right? Mm-hmm. said, look, the investigation is absolutely awesome. It saves us a lot of time. But the other thing that saves us time is that Bits AI SRE drafts our postmortem. Mm-hmm. And it may sound trivial to some of the customers, like, no, no, this, we like to do it. For them, it was very important.
Alexis Lê-Quôc [00:41:08]:
It saves them time. There are other folks for which database optimization is That's the time saver or the key thing that is like, oh my God, I'm so excited. The approach that we've taken since the start of the company is to think about truly how can we help in very concrete ways. So that's why I think through our keynote, we try to show the products in ways that are very tangible. We don't have big, high-flying concepts in the slides. Like, you see the product, The goal is you can imagine when I get back to my desk, as it were, I can go and I see myself using it and I see in which case that's going to be helpful. Mm-hmm. It's going to be helpful.
Alexis Lê-Quôc [00:41:50]:
And that's exactly what we want. So I think various customers will take and various prospects will take various things from what they've heard this week. But hopefully what they walk away with, we are definitely helpful. And it is a gradual journey they can be with us. They don't have to necessarily go all in day one because we also, we know that we operate in an existing ecosystem and there'll be opportunities for us to expand, I think, our footprint in a given customer. But we go at the speed with which they're comfortable. And that's something that's always been important to us.
KB [00:42:32]:
Alexis, thank you so much for your time. Really appreciate you being here. Thank you for having me. Thank you. And there you have it. This is KB On The Go. Stay tuned for more.
