The open bucket, found the same day.
Not at the next audit.
Datadog Cloud Security Posture Management checks every cloud resource and Kubernetes cluster against misconfiguration rules, continuously and without an agent on the resource. We implement it inside the Datadog you already run, decide with you which accounts and rules are in scope, and operate it every month so each misconfiguration has an owner and a date.
Quick facts
Related
- Cloud Security, the group this belongs to
- IaC Security, the same rules, before the apply
- Compliance, the findings mapped to a framework
The configuration of every account, checked against a rule, without logging into any of them
An estate of twelve cloud accounts has twelve consoles, and the security group that was opened for a vendor demo is in the one nobody opens. Posture management reads the configuration of every resource through the integration and evaluates it against the rules on a cycle. The open group is a finding by the afternoon, with the resource, the rule and the fix attached.
Nothing to install on the resource. Cloud resources are read through the AWS, Azure and Google Cloud integrations with resource collection on. Storage, networking, identity, databases and compute are evaluated where they are, on a cycle of between fifteen minutes and four hours by resource type.
Inside the cluster too. The CIS Kubernetes, Docker and host benchmarks are checked by the Agent that already runs for metrics, with its compliance feature switched on. The account view and the cluster view land in the same findings list.
Rules you can read and write. Over a thousand Datadog-maintained rules, each tied to a framework control. Custom rules in Rego against the same resource schema, for the control your policy has and the catalogue does not.
History that survives the fix. Fifteen months of misconfiguration history, so the answer to "when was that bucket public" is a date rather than a guess. The mute, its reason and its expiry are kept in the same record.
An integration role from 2022, every rule on, and a mute with no end date
How it bills. Posture management is part of Datadog Cloud Security, billed per host it protects, whether through the Agent or agentless scanning, with containers metered against a per-host allotment. Cloud and Kubernetes posture management is in both plans, CSM Pro and CSM Enterprise. Account-level checks read the cloud integration's resource collection rather than an Agent. Agentless vulnerability scanning, where it is switched on, runs scanners inside your own cloud account, and their compute and networking appear on the cloud provider bill. Datadog publishes the meters and rates. The lever is which accounts and clusters are in scope, and that is decided before resource collection is switched on, not after the first invoice.
The configuration traps. The cloud integration was set up years ago for metrics, with a role that predates resource collection, so half the resource types are never read and the dashboard looks complete. Every rule enabled on day one across every account, so the finding on the account that holds customer data sits in a list with the findings on the sandbox. Kubernetes assumed covered because the account is, when the cluster benchmarks need the Agent's compliance feature and it is off by default. A mute set with no expiry, so the accepted risk is never reviewed.
Field noteThe most common gap we see is the integration role. It was created for CloudWatch metrics, resource collection was added later, and the role was never widened. Posture checks run against the resource types the role can read and skip the rest, and no finding says so.
Field noteAccount-level checks and cluster-level checks come from different places. The pattern we keep finding is an account that scores well and a cluster inside it that was never benchmarked, because the Agent was rolled out for metrics and the compliance flag stayed off.
Field noteMutes added during a migration outlive the migration. The resource was going to be decommissioned, so the finding was muted indefinitely. The decommission slipped, the mute did not, and the resource is still there a year later with the finding hidden.
Field noteFiltering by severity alone misreads the estate. A medium finding on the one account that holds production data matters more than a critical one on a sandbox, and a critical-only view puts the production finding in a queue that is never opened.
Accounts first. Rules per account. A mute policy before the first mute.
Posture management is delivered inside the Cloud Security Accelerator, four weeks and fixed scope, alongside the other Cloud Security capabilities you have chosen. If Datadog is new to the estate, LaunchPad runs the platform rollout first. The posture sequence is the same either way.
- Inventory the accounts and clusters. Every AWS account, Azure subscription and Google Cloud project, with what it holds and who owns it. Production and anything holding customer data go first.
- Fix the integration roles. Resource collection switched on, the role widened to read every resource type the rules need, checked per account rather than assumed from one.
- Enable the Agent compliance feature on the clusters in scope. Through your deployment tooling, so the CIS Kubernetes and Docker benchmarks run where the workloads run.
- Choose the rules per account. Start from the framework you are measured against. Switch off rules for risks accepted in writing. Write custom rules in Rego for the controls your policy has and the catalogue lacks.
- Set the mute policy and the routing. Every mute carries a reason, an approver and an expiry. Each finding type goes to a named team through the channel they already use. Nothing lands somewhere with no owner.
- Work the first list, then hand over in writing. The initial findings are triaged with your engineers. What sits in the runtime we operate, we fix. The rest leave with an owner. You get the scope, the rules in force, the mutes and their reasons, and the open findings on the day we finished.
Access is admin on the Datadog organisation, read-only on the cloud accounts for resource collection, and Agent rollout through your deployment tooling. We do not need write access to the cloud accounts to implement posture management, and we do not ask for it.
The rules do not drift. The accounts, the roles and the mutes do.
A new account is created for a project. A cluster is rebuilt and the compliance flag is lost in the rebuild. An integration role is tightened by a well-meant policy and stops reading a resource type. Managed Observability is the monthly service that keeps the scope, the roles and the mutes matching the estate as it is now.
Every month, the new misconfigurations are triaged. Against the rules in force and the mutes on file. What is in the runtime we operate is fixed. What is not goes to its owner with the resource, the rule and the evidence attached.
Scope follows the accounts. New accounts, subscriptions, projects and clusters are added to coverage when they appear. Integration roles are re-checked against the resource types the rules need, so coverage does not shrink silently.
Mutes are kept honest. Every mute that reaches its expiry is renewed with a fresh reason or removed. The mute list is reported each month, so an accepted risk never becomes a forgotten one.
The evidence is already there. Finding history, mute reasons and the rules in force per account, dated. When a customer questionnaire asks how you know no bucket is public, the answer is a report, not a search.
We operate the stack. You own the product.
We are not a security company, and we do not pretend to be. We are a managed runtime operator. We run the posture tooling inside your Datadog, keep the scope and the rules matching the estate, fix the misconfigurations that sit in the runtime we operate, and route the rest with the evidence attached. The policy, the risk decisions and the auditor stay yours. We operate and evidence the runtime controls that support your compliance obligations.
Datadog is our proof, not our headline. Datadog certified one managed provider globally. We are it. The Powered by Datadog accreditation means Datadog's own engineers reviewed how we instrument, alert, respond and report. We are also a Datadog Advanced Partner, ISO 27001 certified and Cyber Essentials Plus certified, with offices in Cardiff, London and Dublin.
Datadog Cloud Security Posture Management, answered plainly
Is Datadog CSPM agentless?
For cloud accounts, yes. Datadog reads the configuration of AWS, Azure and Google Cloud resources through the cloud integration, with resource collection switched on. Each resource is evaluated against the misconfiguration rules on a cycle of between fifteen minutes and four hours, depending on the resource type. Nothing is installed on the resource. Checks inside a host or a Kubernetes cluster, such as the CIS Kubernetes and Docker benchmarks, come from the Datadog Agent with its compliance feature enabled. Most estates need both, and the gap between the two is where coverage usually goes missing.
How is Datadog Cloud Security Posture Management billed?
Posture management is part of Datadog Cloud Security, billed per host it protects, whether through the Agent or agentless scanning, with containers metered against a per-host allotment. Cloud and Kubernetes posture management is in both plans, CSM Pro and CSM Enterprise. Account-level checks read the cloud integration's resource collection rather than an Agent. Datadog publishes the current meters and rates, and we check them with you before resource collection is switched on. We do not publish prices. What we decide with you is which accounts and clusters are in scope, which is what sets the number.
Which rules does Datadog CSPM come with?
Over a thousand rules maintained by Datadog, each mapped to a framework or benchmark control. The catalogue covers the CIS Foundations benchmarks for AWS, Azure and Google Cloud, CIS Kubernetes, PCI DSS, SOC 2, ISO 27001 and NIST 800-53. Custom rules are written in Rego against the same resource schema, cloned from a Datadog rule or built from scratch, with a severity and remediation text of their own. The decision that matters is not how many rules exist but which ones are in force for which accounts.
What happens to a misconfiguration that is an accepted risk?
It is muted, with a written reason and an expiry date, and the mute is reviewed when it expires. Datadog allows a mute to run indefinitely. We do not. A public bucket that serves static assets is an accepted risk today and may not be after the next re-platform. The mute carries the reason, the approver and the date it must be looked at again. The evidence of that decision stays in Datadog, which is what the auditor asks for.
What does Critical Cloud do with Cloud Security Posture Management every month?
Managed Observability reviews the new misconfigurations against the rules in force, adds new accounts and clusters to scope as they appear, expires or renews the mutes that are due, checks that the integration role still covers every resource type the rules need, and reports what was found, fixed and routed. Findings in the runtime we operate are fixed by us. The rest go to a named owner with the evidence attached.
- Datadog products: every product, and how we implement and run each one
- Cloud Security: the group, with posture, identity, vulnerabilities, compliance and workload protection on one findings view
- IaC Security and Compliance: the same rules before the apply, and the same findings mapped to a framework
- Cloud Security Accelerator: scope, rules, routing and the first triage, in four weeks
Every account in scope. Every finding with an owner.
Tell us how many cloud accounts you have and which framework you are measured against. We will show you what posture management would find, which rules belong in force, and what it takes to run it.