Datadog Cloud Security Identity Risks

datadoghq.com

From $10/mo Free trial Web

Spec score 8.0 #6 of 25 in Cloud Infrastructure Entitlement Management Software

What it is

Datadog Cloud Security Identity Risks is a cloud infrastructure entitlement management product for finding and reducing identity risks. It scans AWS, Azure, and GCP for lingering administrative privileges, privilege escalation, permission gaps, broad blast radii, and cross-account access. Detections cover users, roles, groups, policies, EC2 instances, and Lambda functions. Access Insights shows which resources an entity can reach and which principals can reach them directly or indirectly. Remediation options include narrower policy suggestions, Datadog Workflows, cloud-console links, Terraform-generated GitHub pull requests, and Jira issues. AWS IAM Access Analyzer can supply unused-access findings for policy recommendations and permission-gap detections. Scanning is agentless, and Datadog says snapshots remain within the customer environment. Standard permission-gap detections cover 90 days; Access Analyzer can use 180- or 360-day periods. CSM Pro costs $10 a month per CSM host, while Enterprise costs $25 a month per host. A 14-day trial covers the product suite.

Spec sheet

Purpose: Cloud Security Identity Risks is a Cloud Infrastructure Entitlement Management product that continually scans cloud infrastructure for entitlement risks and helps mitigate IAM-based attacks.Read 30 Sep 2026 · docs.datadoghq.com
Trial: Datadog advertises a 14-day free trial of its entire product suite.Read 30 Sep 2026 · datadoghq.com
Headquarters: Datadog says it is headquartered in New York City.Read 30 Sep 2026 · datadoghq.com
Founded: 2010Read 28 Sep 2026 · datadoghq.com
Access visibility: Access Insights shows which entities a resource can access and which principals can access it directly or indirectly.Read 30 Sep 2026 · docs.datadoghq.com
Additional AWS cost: AWS IAM Access Analyzer has an additional AWS cost when enabled for the first time, and its insights can take up to two hours to appear in Datadog.Read 30 Sep 2026 · docs.datadoghq.com
Agentless scanning: Datadog Cloud Security can scan cloud infrastructure for identity risks without deploying an agent, and the product page says snapshots are not sent outside the customer environment.Read 30 Sep 2026 · datadoghq.com
AWS integration: Datadog CIEM integrates with AWS IAM Access Analyzer to use unused-access findings to recommend downsized policies and enrich permissions-gap detections.Read 30 Sep 2026 · docs.datadoghq.com
Cloud coverage: Identity Risks is available for AWS, Azure, and GCP.Read 30 Sep 2026 · docs.datadoghq.com
Detection scope: Detections include users, roles, groups, policies, EC2 instances, and Lambda functions.Read 30 Sep 2026 · docs.datadoghq.com
Permissions-gap window: Datadog’s usual permissions-gap detections cover 90 days; AWS IAM Access Analyzer can be configured for longer periods such as 180 or 360 days.Read 30 Sep 2026 · docs.datadoghq.com
Remediation: The product suggests downsized policies, Datadog Workflows based remediations, and links to cloud consoles.Read 30 Sep 2026 · docs.datadoghq.com
Risk types: It identifies lingering administrative privileges, privilege escalations, permission gaps, large blast radii, and cross-account access.Read 30 Sep 2026 · docs.datadoghq.com
Workflow integrations: Identity risks can be remediated through Terraform-generated GitHub pull requests, Jira issues, or automated Datadog Workflows.Read 30 Sep 2026 · docs.datadoghq.com

Plans and prices

Cloud Security Management (CSM) Pro $10 a month Per CSM host, per month Listed prices: $10, $12, or $12 per host per month Read 30 Sep 2026 · datadoghq.com

Cloud Security Management (CSM) Enterprise $25 a month Per CSM host, per month Listed prices: $25, $30, or $30 per host per month Read 30 Sep 2026 · datadoghq.com

Every Datadog Cloud Security Identity Risks plan and price →

Strong points and limits

Strong points

Covers AWS, Azure, and GCP
Agentless identity-risk scanning
Access Insights maps direct and indirect access
Terraform, Jira, and Workflow remediation options
14-day trial of the product suite

Limits

No free plan
AWS IAM Access Analyzer adds AWS cost
Analyzer insights can take up to two hours
Standard permission-gap window is 90 days

Who it suits

This product suits security and cloud teams managing identity permissions across AWS, Azure, or GCP. It is relevant when teams need visibility into access paths and automated or workflow-based remediation.

Verdict

Datadog Cloud Security Identity Risks focuses on entitlement visibility and remediation across three major clouds. Its pricing is per CSM host, and some AWS analysis requires a separately charged service.