Datadog: The "Single Pane of Glass" for the Cloud Age

I. Introduction & Episode Roadmap

On the morning of August 6, 2026, Olivier Pomel got on a conference call and did something CEOs almost never do voluntarily. He told investors that his biggest customer had just cut back.

The quarter itself was extraordinary. Datadog had put up $1.12 billion of revenue, up 36% year over year — the fastest growth rate the company had posted since the pandemic boom, and the largest sequential dollar increase in its history.¹ Every headline number beat guidance. And then Pomel volunteered that a nine-figure renewal with "a leading AI company" came with a usage reduction starting in the third quarter, and that management had chosen to "fully derisk the guidance for the rest of the year with respect to that customer."²

The stock fell 19% that day.³ Two days earlier it had traded near $288. By early September 2026 it sat around $208, giving Datadog a market capitalization of roughly $74 billion — after touching a 52-week low near $98 in the winter. In the space of twelve months, the same business had been priced at $34 billion and at $101 billion. Nothing about the underlying company changed that violently. What changed was the market's belief about one question: how much of Datadog's growth is durable, and how much of it is rented from the AI capital-expenditure cycle.

That question is the spine of this story. Because Datadog is, on its face, one of the most beautiful business models in enterprise software. It sells the instrumentation layer for modern computing — the dashboards, alerts, traces, and logs that tell engineers what is happening inside systems too complex for any human to hold in their head. It charges by consumption, so when a customer's business grows, Datadog's revenue grows without a salesperson lifting a finger. It has approximately 33,400 customers, 4,720 of whom spend more than $100,000 a year, and those large accounts generate about 91% of annual run-rate revenue.¹² Its gross retention sits in the mid-to-high 90s, which is the statistical signature of software people cannot rip out.²

And yet. In fiscal 2025, on $3.43 billion of revenue, Datadog reported a GAAP operating loss of $44 million.⁴ The company that everyone describes as the rare profitable SaaS business booked $750.7 million of stock-based compensation that year — nearly 22% of revenue — and its reported net income of $108 million existed largely because it earns interest on a multi-billion-dollar cash pile, not because its operations throw off accounting profit.⁵ The non-GAAP operating margin of 22% is real cash economics. The GAAP number is real dilution. Both are true, and the gap between them is roughly $800 million a year of shareholder value transferred to employees.

To understand the scale of what is being measured here, it helps to be concrete about what Datadog actually does for a living. When a retailer's checkout page slows down on a Friday evening, when a bank's mobile app throws errors for one region and not another, when a streaming service's recommendation engine starts returning garbage — somewhere an engineer opens Datadog and starts narrowing. The company ingests the exhaust of running software: how much memory a container is using, how long a database query took, what a user clicked before the page froze, which line of code threw the exception. It stitches those signals together and presents them as a single, queryable picture. That is the product. It sounds mundane. It is also the difference between a fifteen-minute outage and a four-hour one, which for a large business is the difference between an inconvenience and a headline.

So this is not a hagiography. It is an examination of a genuinely excellent company with three unresolved tensions: a moat that binds customers to the logo but not obviously to the spend; a security and data business that management calls a growth engine but which, five years in, is a rounding error; and a governance structure that let two founders move the company's legal home to Nevada in April 2026 over what appears to have been the objection of a majority of the Class A shares that voted.⁶

There is a fourth tension underneath those three, and it is the one that makes this a genuinely interesting business rather than merely a good one. Datadog's product is a bet that complexity compounds. Every wave of technology it has ridden — virtualization, cloud, containers, microservices, and now agents — has increased the number of moving parts in a typical company's software estate faster than human comprehension could keep up. That has been true for sixteen consecutive years. The question no one can answer from the outside is whether artificial intelligence is the next chapter of that story or the first serious threat to it, because a sufficiently capable agent that fixes its own systems is, eventually, a substitute for the tool that tells a human what to fix.

The roadmap ahead: how two French engineers turned a workplace argument into a category; how a "per host" pricing decision in 2011 became a compounding machine; how the three-pillars platform strategy beat best-of-breed; how the M&A record actually reads when you look at the purchase accounting rather than the press releases; who owns this company and how they are paid; and what the AI era does to a business whose entire premise is that complexity always wins.

↑ Back to Top

II. Origins: The "Works on My Machine" Problem (2003–2010)

The founding scene of Datadog is not a garage. It is an argument.

Sometime in the late 2000s, in the New York offices of Wireless Generation — an education technology company building assessment software for K-12 teachers — a developer and an operations engineer were staring at the same broken system and describing two different realities. The developer's code worked. He had tested it. The operations engineer's servers were on fire. Each had a dashboard. Neither dashboard agreed with the other. Each had data the other could not see.

The developer was Olivier Pomel. The operations engineer was Alexis Lê-Quôc. They had met years earlier as engineering students in Paris, and they would later serve together on Datadog's board — Pomel as CEO, Lê-Quôc as President and Chief Technology Officer, both still in those seats today.⁷ Lê-Quôc had joined Wireless Generation in March 2004 and worked there through December 2010; Pomel ran technology.⁷ The company scaled to serve millions of students, which meant the arguments got louder as the systems got bigger.

This is the part of the story that matters, and it is easy to skip past because it sounds soft. Datadog's founding insight was not technical. It was organizational. In 2010, the software industry was in the middle of a slow-motion civil war between two tribes. Developers were measured on shipping features. Operations was measured on uptime. Every deployment was a transfer of risk from one group to the other, over a wall, at 5pm on a Friday. The emerging "DevOps" movement argued that this was insane — that the two functions should share tools, share on-call, and share accountability.

But you cannot share accountability if you cannot share a picture of reality. That was the wedge. Pomel and Lê-Quôc did not set out to build a better graph. They set out to build a lingua franca — one data model, one set of tags, one screen that a developer and an operations engineer could both point at and argue about productively rather than argue past.

The timing was either brilliant or lucky, and honestly it was some of both. Amazon Web Services was four years old. The dominant monitoring tools of the era — Nagios, Zabbix, and the enterprise suites from HP, CA, and BMC — had been architected for a world where a server was a physical box with a name, a location, and a five-year depreciation schedule. You configured it once. It lived a long time. Monitoring it meant checking whether a known thing was still there.

Cloud computing broke that model at the root. In the cloud, a server is not a box; it is a temporary rental that might exist for eleven minutes. There is no stable list of things to check, because the list rewrites itself continuously. Monitoring had to shift from "is this named machine alive" to "is this service healthy, whatever machines happen to be running it right now." That required automatic discovery, tagging, and aggregation as first principles — not as bolt-ons.

Incumbents could see this. They could not easily build it, because their revenue came from customers who had already paid for the old model, and their codebases assumed the old world. This is the classic counter-positioning setup that Hamilton Helmer describes: a new entrant adopts a business model the incumbent cannot copy without damaging its existing business. Datadog was SaaS-only, self-service, and priced by usage, at a moment when enterprise monitoring meant a perpetual license, a six-month implementation, and a systems integrator.

The commercial consequence of that architectural choice is the thing investors should hold onto. Because Datadog ran the service itself, it saw the telemetry of thousands of customers, which made its integrations better, which made adoption easier, which brought in more customers. Because it was self-service, its early distribution cost was close to zero — a developer found it, tried it on one server, and the credit card came later. That is a genuinely different cost structure from the enterprise software norm, and it explains how a New York company nobody had heard of could later show up in the middle of a Fortune 100 account without ever having pitched the CIO.

There is one more element of the founding worth naming, because it explains something about how this company has always behaved. Pomel and Lê-Quôc chose to build in New York. In 2010 this was close to a category error. Serious infrastructure software came from the Bay Area; New York was finance and media. The consequence was a harder fundraising environment and a smaller local pool of infrastructure engineers, but also a customer base of banks, media companies, and retailers rather than startups — buyers with real compliance requirements, real legacy systems, and real budgets. The company's product decisions have carried that fingerprint ever since: less enamoured of technical purity, more attentive to whether a large regulated enterprise can actually deploy the thing. Sixteen years later, the second office is in Paris, and about a third of Datadog's non-U.S. employees work in France — an arrangement that began as a founder's convenience and became a durable engineering base.¹⁷

What none of this solved was money. Raising capital for infrastructure software in New York in 2010 was difficult, and explaining to a generalist investor why cloud monitoring needed to be rebuilt from scratch was harder still. The problem Datadog was solving was, to most investors of that vintage, invisible — a problem that would only become obvious once a critical mass of companies had already moved to the cloud, which had not yet happened. That constraint shaped the entire operating philosophy: build the product first, let it sell itself, and add the expensive go-to-market machinery only once the pull was undeniable.

It also, in retrospect, imposed a discipline that better-funded competitors never had. A company that cannot afford a large sales force is forced to make a product that does not need one. Which is exactly what happened next.

↑ Back to Top

III. The First Inflection: Infrastructure & The Cloud Wave (2010–2016)

If you want to understand why Datadog became a $70-billion-plus company rather than a good $2 billion one, the answer is not the founding insight. It is a pricing decision and a bet on a piece of open-source software that most people had never heard of.

Start with pricing. Datadog charged per host per month — a simple, published number on a public web page, in an industry where pricing was a negotiation and a non-disclosure agreement. That transparency was partly ideology and partly go-to-market strategy: a developer could estimate the bill without talking to a human, which is the only way self-service adoption works.

But the deeper consequence was automatic revenue growth. Under a seat-based model, a software vendor grows when a customer hires people. Under Datadog's model, the vendor grows when the customer's computing footprint grows. In the 2010s, computing footprints grew far faster than headcount, because the whole point of the cloud was to let a small team run enormous infrastructure. Datadog attached its revenue to the fastest-moving variable in the customer's business and then sat still.

This is worth dwelling on, because it cuts both ways and the bear case lives here. Consumption pricing has no floor. A seat-based vendor renewing a 500-seat contract knows roughly what it will collect. Datadog does not. When customers optimize — turning off idle hosts, sampling their traces, shortening log retention — revenue falls without anyone churning. Management has spent a decade managing that reality, and as we will see, it is precisely what happened with the largest customer in 2026.

Now the second decision. In 2014, a small company called Docker was popularizing containers — a way of packaging software so that it runs identically anywhere, and, crucially, so that it can start in milliseconds and die just as fast. If cloud servers had lifespans measured in hours, containers had lifespans measured in seconds. For an incumbent monitoring vendor whose licensing model counted machines, this was an existential accounting problem. For Datadog, it was simply more entities to tag.

Datadog leaned into container monitoring early and became, for a generation of engineers adopting Kubernetes and Docker, the default answer to "how do I see what's happening in here?" There is a lesson in this that generalizes badly and is therefore often mis-taught: Datadog did not predict containers. It built a data model that was indifferent to what the thing being monitored was, and containers happened to be the next thing. Architectural generality, not forecasting skill, was the edge.

Consider what this meant operationally for a customer in 2015. Before Datadog, adding monitoring to a new service was a ticket: file a request, wait for the operations team, get a configuration file written, wait again. Under the new model, the monitoring agent ran on the machine, noticed that a new database had appeared, and started collecting the right metrics for that specific database without anyone asking. Multiply that by a few thousand services and the labor saving is enormous. But the more important effect is behavioral: when instrumentation is free and automatic, engineers instrument everything. And when engineers instrument everything, the vendor's consumption-based bill grows. Datadog's product design and its revenue model were pointing in the same direction, which is rarer in software than it sounds.

The other thing Datadog did during this period was write. The company's engineering blog became genuinely useful technical documentation for people who did not use Datadog — how to monitor Kubernetes, how to think about percentile latency, how to instrument a Postgres database. This is content marketing, but it functioned as something closer to a distribution asset. It put the brand in front of the practitioner at the moment of technical need, which is far earlier in the buying cycle than any salesperson can reach.

By the middle of the decade, the shape of the business was set: land with one team monitoring a handful of hosts, expand as their infrastructure expands, expand again as other teams inside the same company discover it, and only then send in a salesperson to convert an accumulating pile of credit-card usage into a committed enterprise contract. The sales force existed to harvest adoption, not to create it.

The evidence that this worked has held up remarkably well over more than a decade, which is why it deserves to be treated as a real structural advantage rather than a founder story. As of the second quarter of 2026, roughly 70% of Datadog's year-over-year revenue increase still came from existing customers spending more, with the remaining 30% from new logos.⁸ The land-and-expand engine is not a legacy artifact. It is still the primary mechanism.

But the same evidence contains the limit. In the S-1 era around 2019, Datadog's dollar-based net retention rate ran in the mid-140s — every dollar of existing customer revenue became about $1.46 a year later. By December 31, 2025, that trailing-twelve-month figure was approximately 120%.⁴ By the second quarter of 2026 it remained in the low 120s.² Expansion is still strong by any reasonable software benchmark. But it has compressed by roughly 25 percentage points over six years, and a mechanism that decays is a different thing from a mechanism that compounds.

The honest reading: the expansion engine is real, durable, and slower than it was. Which meant that by 2017, growth could not come from selling more of the same thing to the same people. It had to come from selling different things.

↑ Back to Top

IV. The Second Inflection: The "Three Pillars" & Platform Expansion (2017–2019)

Picture the toolchain of a reasonably sophisticated engineering organization in 2016. Metrics and dashboards in Datadog. Application traces in New Relic or AppDynamics. Logs in Splunk. Three vendors, three data models, three query languages, three bills.

Now picture 2:47 in the morning during an outage. Latency is spiking. The on-call engineer sees the spike in Datadog. To find out which service is slow, she switches to New Relic and hunts for a matching timestamp. To find out why that service is slow, she switches to Splunk and tries to construct a search that finds the right log lines within the right two-minute window. Every switch is a manual correlation performed by a tired human under pressure.

That gap — not a feature gap, a seam gap — was the entire strategic opportunity of the next phase. And it is why the "three pillars of observability" framing (metrics, traces, logs) became the organizing idea of the industry. Metrics tell you that something is wrong. Traces tell you where. Logs tell you why. Any one of them alone is a partial picture. All three, joined by a common tagging scheme so that a spike, a trace, and a log line can be linked automatically, is a qualitatively different product.

Datadog moved to close the seams in two steps. It built application performance monitoring — tracing a single user request as it hops across dozens of microservices, like a package-tracking number for a computation — entering a market already occupied by well-capitalized specialists. It did not win on tracing sophistication. It won because its APM shared a tagging model with the infrastructure metrics customers already had, so the correlation that used to require a human at 2:47am happened by default.

Then, in September 2017, it bought the third pillar. Datadog acquired Logmatic.io, a Paris-based log management company, and integrated log analytics into the same platform — making it, at the time, one of the first vendors to offer infrastructure metrics, APM, and logs in a single product.⁹ Building log management from scratch is a multi-year infrastructure problem; buying a working team in a city where Datadog already had engineers compressed that timeline substantially.

Here is the analytical point that matters more than the chronology. A platform strategy in enterprise software is usually a euphemism for feature sprawl — a vendor bolting on adjacent products to raise the average contract value, producing something customers describe as bloated. Datadog's version worked because of a specific technical property: the tags. Every piece of data entering the platform — a metric, a trace span, a log line, later a security signal — carries the same labels for service, environment, team, and version. That shared vocabulary is what makes cross-product correlation automatic rather than a professional-services project.

It is also, not coincidentally, the switching cost. A customer who has spent three years tagging their entire estate consistently so that Datadog can correlate it has built an asset that does not travel. Ripping out one pillar breaks the correlations in the other two.

The financial results of closing those seams were dramatic. Revenue reached $198.1 million in 2018 and $362.8 million in 2019 — roughly a doubling and then an 83% increase.⁵ The company that had struggled to raise money in New York was suddenly one of the fastest-scaling infrastructure software businesses in the world.

Which brought Cisco to the door. In September 2019, days before Datadog's planned listing, Cisco made a takeover approach that people familiar with the matter described as significantly higher than the roughly $7 billion valuation Datadog was targeting.¹⁰ Cisco had run this play successfully before, buying AppDynamics immediately before its IPO. Datadog rebuffed it, believing it could be worth more as a public company over time.¹⁰

On September 19, 2019, Datadog listed on Nasdaq, selling 24 million shares at $27 and raising $648 million at a valuation of about $7.83 billion.¹¹ The shares closed the first day up roughly 39%.¹¹

The listing also settled an argument that had been running through enterprise software for a decade: best-of-breed versus best-of-suite. The received wisdom held that specialists win, because a focused team building one product will always beat a generalist team building twelve. That is true at the level of any individual feature, and it remains true today — there are better standalone log tools and better standalone tracing tools than Datadog's. What the wisdom missed is that the buyer is not evaluating features in isolation. The buyer is an engineering leader who must choose between one vendor whose products are each an eight out of ten and interoperate perfectly, or four vendors whose products are each a nine but require humans to do the joining. In a discipline defined by how fast you can find a problem at 3am, the integrated eight wins.

Two observations about the Cisco decision, seven years on. First, it was obviously correct in dollar terms: the business now generates more revenue in a single quarter than it did in the full year before the IPO. Second — and this is the part usually left out of the founder-mythology version — the decision was only available because of the dual-class share structure and the founders' control. A company with a conventional single-class structure and a board full of late-stage funds facing a volatile IPO window in September 2019 might well have taken the certain money. Founder control created the option value. As we will see in Section VII, that same structure has since been used for decisions that public shareholders liked considerably less.

↑ Back to Top

V. M&A Strategy: Build vs. Buy & Capital Deployment

There is a specific moment that tells you more about Datadog's acquisition philosophy than any of the press releases. In 2025, when Datadog wanted to enter feature flagging and experimentation — the tooling that lets companies release a change to 1% of users and measure what happens — it first pursued LaunchDarkly, the established leader in the category, and then instead bought Eppo, a much smaller company.¹²

That is the entire strategy in one anecdote. Datadog does not buy market leaders at market-leader prices. It buys the technology and the team, and then rebuilds the thing inside its own platform so it inherits the shared tagging model.

The mechanism behind that choice is worth spelling out, because it is the difference between platform companies that feel coherent and ones that feel like a filing cabinet of other people's software. Most serial acquirers in enterprise software bolt the acquired product onto the side: it keeps its own database, its own user interface conventions, its own permissions model, and a "single sign-on" link in a navigation bar. Customers notice immediately. The tell is that data from the acquired product cannot be joined to data from the core product without exporting a CSV.

Datadog's stated approach is to rewrite the acquired technology so it lands inside the existing data model — same tags, same query surface, same permissions. That is slower and more expensive than bolting on, and it means the acquired team spends its first year rebuilding something that already worked. The payoff is that the new product becomes correlatable with everything else on day one of general availability, which is precisely the property that makes the platform worth more than the sum of its parts. Some acquisitions continue to run under their original names for existing customers during the transition — Metaplane and Eppo both kept operating under their own brands after purchase — while the technology is folded into the core.¹²²⁷

The record supports this reading in a way that is unusually easy to verify, because purchase accounting does not care about press-release framing. Across the whole of fiscal 2025 — a year in which Datadog completed three acquisitions, including the open-source search engine company Quickwit, the data-observability company Metaplane, and Eppo — the total aggregate purchase price was $178.4 million, consisting of $109.3 million in cash net of cash acquired, $16.1 million of deferred holdback payments, and 770,044 restricted shares.¹³ Of that, $17.6 million was allocated to intangible assets and $163.1 million to goodwill.¹³ In the first half of fiscal 2026, three more acquisitions — including the reinforcement-learning startup Adaptive ML — totaled $191.5 million.⁸

Put those numbers next to the free cash flow. Datadog generated $915 million of free cash flow in fiscal 2025.¹⁴ It spent less than a fifth of one year's free cash flow on all of 2025's M&A combined. This is not a company using its stock as an acquisition currency to buy revenue. Compare it to the neighbors: Cisco paid roughly $28 billion for Splunk in a deal completed in March 2024; Palo Alto Networks completed its acquisition of the observability company Chronosphere in January 2026 at an announced price of $3.35 billion.¹⁵¹⁶ Datadog's entire cumulative acquisition spend is a fraction of a single one of those transactions.

Now the falsification test, because "disciplined capital allocation" is exactly the kind of characterization that deserves scrutiny rather than applause.

The strongest available evidence for discipline is that Datadog has recognized no goodwill impairment in the years ended December 31, 2023, 2024, or 2025, and carried $530.6 million of goodwill on a $6.6 billion balance sheet at the end of 2025.¹⁷⁵ That is a bounded, specific record over three named years — not a general assurance. It is meaningful evidence that the acquired assets have not been written down, though it is worth noting that goodwill impairment testing for a company with a single reporting unit and a large market capitalization is a low bar to clear. A tuck-in that quietly failed would be absorbed without ever triggering a charge.

The stronger challenge to the discipline narrative is not the cash. It is the equity. Datadog issued 770,044 restricted shares in the 2025 deals and 796,509 in the first half of 2026.¹³⁸ More broadly, shares outstanding rose from roughly 348.6 million at June 30, 2025 to roughly 359.0 million a year later — about 3% annual dilution — and stock-based compensation ran at $227.1 million in the second quarter of 2026 alone.⁸ There is no share repurchase program offsetting this. An activist looking at Datadog would not attack the M&A spend; they would attack the fact that a company generating close to a billion dollars of annual free cash flow returns none of it to shareholders while diluting them 3% a year.

There is also a structural question the tuck-in strategy raises. Buying small teams works beautifully when the adjacent category is immature and the incumbent is beatable on integration. It works less well when the adjacent category has a scaled, well-funded leader — which is increasingly the case in security, where Palo Alto's Chronosphere purchase and Snowflake's announced acquisition of Observe in January 2026 signal that the deep-pocketed platform vendors have decided observability and security belong together.¹⁶¹⁸ Datadog's stated approach implies it will build rather than buy its way through that fight. The evidence on whether it can is in the next section, and it is mixed.

The calibrated conclusion on M&A: the history supports a narrow version of the discipline claim — Datadog has consistently avoided large, dilutive, revenue-buying acquisitions and has not written down what it bought over the past three reported years. It does not support a strong version. The company has never been tested by a deal large enough to fail visibly, and its capital allocation choices have favored employees over shareholders at the margin. Watch for the first nine-figure-plus acquisition; that will be the first real data point.

↑ Back to Top

VI. "Hidden" Businesses & The Security Pivot (2020–Present)

Before the products, the arc — because the six years after the IPO contain the single best natural experiment anyone has run on Datadog's business model, and it is usually skipped.

Revenue went from $362.8 million in 2019 to $603.5 million in 2020, $1.03 billion in 2021, and $1.68 billion in 2022 — three consecutive years of growth between 63% and 70%.⁵ The pandemic, which flattened much of enterprise software, accelerated Datadog: every company simultaneously moved workloads to the cloud, and consumption pricing collected the proceeds automatically.

Then came 2023, and the bill arrived. Growth fell from 63% to 27%.⁵ Nothing had broken. No major competitor had taken share. What happened was that interest rates rose, cloud budgets came under review, and Datadog's largest customers — the same cloud-native companies that had driven the boom — went through what the industry politely called "optimization." They turned off idle instances, sampled their traces, shortened log retention, and negotiated harder. Datadog's revenue fell with them, automatically, because that is what consumption pricing does.

This is the most important historical evidence available on the durability question, and it deserves to sit next to any claim about the strength of the moat. In 2022 and 2023, Datadog's customers did not leave — retention stayed excellent — and revenue growth still more than halved. The switching cost held; the spend did not. Growth then stabilized at 26% in 2024 and 28% in 2025 before the AI cycle reaccelerated it.⁵¹⁴ The pattern that matters is that Datadog's growth rate is a function of its customers' capital expenditure decisions, and it always has been. The AI boom is the upswing of the same mechanism that produced the 2023 downswing. Anyone underwriting 30% growth as a property of the company rather than of the cycle is reading the record selectively.

With that in mind, the single most useful number Datadog discloses is not revenue. It is the percentage of customers using four or more products.

At the end of the second quarter of 2026, 58% of customers used four or more products, 37% used six or more, and 13% used ten or more — up from 52%, 29%, and 7% respectively a year earlier.¹² The ten-or-more figure nearly doubling in twelve months is the cleanest available proof that the platform thesis is not marketing. Customers who buy ten products from one vendor are not comparison-shopping feature by feature; they have made an architectural decision.

So what are all these products? Beyond the three pillars, the platform now spans digital experience monitoring — real user monitoring, which watches actual browser sessions, and synthetic monitoring, which fakes user traffic to catch problems before a human hits them — plus software delivery tooling for continuous integration pipelines, incident management, cloud cost management, product analytics, and a growing security suite.

At its Investor Day on February 12, 2026, management put ARR figures behind the major lines for the first time in this level of detail: infrastructure monitoring at approximately $1.6 billion, log management above $1 billion, and the combined APM and digital experience suite above $1 billion.¹⁹ Three billion-dollar product families inside one company is genuinely rare, and it reframes what Datadog is: not a monitoring vendor with extensions, but a portfolio in which the original product is now less than half the business.

The real user monitoring line is the clearest current proof point. On the second-quarter call, Pomel said RUM had passed $200 million in ARR and had accelerated to over 50% growth at that scale.² A product growing faster at $200 million than most products grow at $20 million is what platform distribution looks like: Datadog builds it, and 33,400 existing customers can turn it on without a procurement cycle.

Then there is Flex Logs, which deserves explanation because it is the most direct competitive weapon in the portfolio and the technical concept is not obvious.

Traditional log management makes you pay twice. You pay to ingest the data, and then you pay — expensively — to index it, which means building the search structures that let you query it instantly. Indexing is what makes Splunk fast and what makes Splunk bills legendary. The practical result is that engineering teams throw away most of their logs, because indexing everything is unaffordable. They are making a bet, under budget pressure, about which data they will need during a future emergency. They frequently bet wrong.

Flex Logs, launched in August 2023, separates storage from compute: you store enormous volumes of logs very cheaply, and pay for query capacity only when you actually search them.²⁰ Storage starts at $0.05 per million log events per month, with querying billed separately by instance-hour.²⁰ The trade-off is honest — Flex queries return in minutes rather than seconds, so it suits compliance retention and forensic investigation rather than live incident response.

Strategically, this is an attack on the economics of the incumbent rather than its features. If a customer can afford to keep everything, the calculus of what to send to Splunk changes. And it worked commercially: management said at Investor Day that Flex Logs was approaching $100 million in ARR and growing very rapidly.¹⁹ On the second-quarter call, Pomel described the largest Bring Your Own Cloud win to date — part of a multi-year deal with more than $30 million in total contract value with one of the world's largest online media companies — displacing a legacy commercial logging tool at petabyte scale.²

The other quiet expansion has been into the developer's workflow itself — what the industry calls "shifting left." Historically, observability began the moment code reached production. Datadog has been pushing steadily earlier: monitoring continuous-integration pipelines so teams can see which test suites are slow or flaky, running synthetic checks before a release ships, and, after the 2025 Eppo acquisition, embedding feature flags and experimentation so a team can release a change to a fraction of users and measure the result inside the same platform that measures everything else.¹² In the first quarter of 2026 the company launched Datadog Experiments, pairing statistical A/B testing with real-time observability guardrails.²⁵

The strategic logic is that the earlier Datadog appears in the software lifecycle, the harder it is to dislodge, because it stops being a tool the operations team bought and becomes a tool the entire engineering organization builds around. The commercial logic is more prosaic: each of these is another product to attach, and attachment is the metric that drives everything else.

Now the part of this section that the outline frames as a "secret growth engine," and where the evidence requires a much more careful verdict.

Datadog entered security in February 2021 by acquiring Sqreen, an application security platform, alongside Timber Technologies, the company behind the Vector data pipeline.²¹ Five years later, at Investor Day, management disclosed that security had more than 8,500 customers but more than $100 million in ARR, and — the telling number — that security represented only about 2% of spend within large accounts.¹⁹ One in four Fortune 500 companies used Datadog security, and 70% of million-dollar customers used at least one security product.¹⁹

Read those numbers together and a specific picture emerges. Datadog has succeeded brilliantly at distributing security — getting it turned on in thousands of accounts, including the largest ones. It has not yet succeeded at monetizing it. More than 8,500 customers generating roughly $100 million of ARR implies an average of well under $15,000 per account. That is a trial-sized footprint, not a displacement of a dedicated security vendor. Against a company like Palo Alto Networks, which just paid $3.35 billion for an observability company specifically to fuse the two categories, a $100 million security line inside a $4.5 billion revenue business is not yet a competitive threat.

The calibrated conclusion: the security bet is best understood as optionality that has not yet converted, not as a hidden growth engine. Wide adoption at low spend is exactly what you would see either in the early innings of a genuine displacement or in a product that customers use as a free-ish add-on and buy seriously from someone else. Five years is long enough that the burden of proof has shifted. The falsifiable test is straightforward and does not require guesswork: security ARR needs to compound meaningfully faster than total revenue, and the 2%-of-large-account-spend figure needs to move. If it is still near 2% at the next Investor Day, the honest read is that Datadog sells security the way Microsoft sells "included" features — as a retention tool rather than a business.

One more thread belongs here, because it quietly undercuts a bull-case leg that has appeared in every Datadog write-up for a decade: international expansion as untapped upside.

The reality in 2026 runs the other way. In the second quarter, North American revenue was $824.7 million against $296.8 million internationally — meaning North America grew roughly 41% year over year while international grew roughly 24%.⁸ Revenue from outside North America fell to approximately 27% of the total in the first half of 2026, down from 29% a year earlier.⁸ Datadog is becoming more American, not less, because the AI buildout driving its acceleration is overwhelmingly a United States phenomenon — a point Obstler made explicitly on the call when noting particular strength in the Americas.²

The correct conclusion is not that international is failing; 24% growth is respectable, and management has continued to invest in Europe, the Middle East and Africa.⁸ It is that "international is early, therefore international is upside" has been an untested assertion for years and the recent data contradicts it. If the AI cycle cools, the geographic mix will likely normalize; until then, investors should treat Datadog as a business whose fortunes track U.S. technology capital expenditure closely, with less geographic diversification than the customer-count-in-35-countries framing implies.

↑ Back to Top

VII. Current Management & Incentives

Two French engineers, sixteen years in, still running the company they founded. It is genuinely rare, and it is the foundation of most bullish narratives about Datadog's culture and long-term orientation. It is also, on close inspection, the source of the sharpest governance question in the story.

Start with the control. Datadog operates a dual-class structure in which Class B shares carry ten votes each and Class A shares carry one. As of December 31, 2025, the Class B shares represented approximately 43% of total voting power despite being a small minority of shares outstanding.¹⁷ As of the 2026 proxy, Pomel personally controlled about 17.3% of total voting power and Lê-Quôc about 15.5%; all executive officers and directors as a group held roughly 35.5%.⁷ For comparison, Vanguard — the largest institutional holder, with 12.7% of the Class A shares — controlled about 7.2% of the vote.⁷

Then came April 2026, and the clearest test to date of what that structure means in practice.

On February 27, 2026, Datadog called a special meeting of stockholders with a single item of business: approving the redomiciliation of the company from Delaware to Nevada by conversion.⁶ Nevada corporate law is generally understood to be more management-protective than Delaware's, with narrower avenues for shareholder litigation over fiduciary duties. A number of companies with concentrated founder control made the same move in 2024 and 2025, and it has been a persistent flashpoint with institutional investors.

The vote, held April 21, 2026, was 332,195,858 for, 199,605,477 against, and 351,779 abstaining, with Class A shares voting one vote each and Class B shares ten votes each.²² The redomiciliation took effect at 11:59pm Eastern that night.²²

Do the arithmetic that the filing does not do for you. There were roughly 24.3 million Class B shares outstanding as of early February 2026, carrying up to about 243 million votes.¹⁷ The "against" tally of 199.6 million votes therefore exceeds any plausible Class B bloc, and given roughly 328 million Class A shares outstanding, the arithmetic strongly implies that a majority of the Class A shares that voted were opposed — and that the proposal carried on the strength of the founders' super-voting shares. Datadog did not break out the vote by class, so this is an inference from the disclosed totals rather than a disclosed fact. But the inference is difficult to escape.

This matters for reasons beyond governance aesthetics. The same structure that let Pomel and Lê-Quôc reject Cisco in 2019 — a decision that created enormous value for every shareholder — let them relocate the company's legal home over apparent Class A objection in 2026. Founder control is not a value; it is a mechanism. It amplifies whatever judgment the founders have. Investors who cheered the first outcome own the second one too.

Around the founders sits a leadership team that is notably long-tenured by software standards. David Obstler has been Chief Financial Officer since before the IPO and remains the company's principal voice on guidance philosophy — a philosophy he has described consistently across years of calls as basing forecasts on recent observed trends with an element of conservatism built in.² Adam Blitzer joined as Chief Operating Officer and Sean Walters serves as Chief Revenue Officer; both were named executive officers in the most recent proxy.⁷ The board includes Dev Ittycheria, who runs MongoDB and therefore understands consumption-priced infrastructure software from the inside, alongside investors Shardul Shah and Matthew Jacobson and operators Amit Agarwal, Titi Cole, Michael Callahan, Dominic Phillips, Julie Richardson and Ami Vora, in a classified structure with three staggered classes.⁷

The classified board is worth flagging alongside the dual-class shares and the Nevada move. Individually each is common. Together — staggered director terms, ten-to-one voting shares held by management, and a jurisdiction chosen for its narrower fiduciary litigation exposure — they constitute an unusually complete set of takeover and shareholder-action defenses for a company of this size. Whether that matters depends entirely on whether one trusts the people it protects.

On compensation, the record is more nuanced than the "their wealth is tied to the stock" framing suggests. Cash pay is modest by megacap standards: base salaries for Pomel, Lê-Quôc, Chief Financial Officer David Obstler, and Chief Operating Officer Adam Blitzer were all set at $450,000 effective March 2025.⁷ Bonuses are tied to two specific corporate metrics — net new ARR and non-GAAP operating income — which is a defensible pairing because it forces a trade-off between growth and profitability rather than rewarding either alone.⁷

But the equity is large and growing fast. Pomel's total reported 2025 compensation was $27.06 million, of which $25.83 million was stock awards — up from $19.05 million in stock awards in 2024 and $10.91 million in 2023.⁷ Lê-Quôc's 2025 total was $20.36 million.⁷ These are substantial annual grants to two people who already own roughly $1.5 billion and $1.3 billion of stock apiece at recent prices. The 2025 bonus payout came in at approximately 183% of target, reflecting net new ARR achievement of about 139% of the target level.⁷

A skeptical investor would make two observations here. First, granting nine-figure-adjacent equity packages over a few years to founders whose incentive alignment is already total is, economically, a transfer from other shareholders that does not buy additional alignment. Second, a bonus plan that pays 183% of target is either evidence of extraordinary outperformance or evidence that the target was soft. Given that 2025 revenue growth of 28% was a deceleration from prior years, the target-setting deserves the question.¹⁴

To be fair to the board, shareholders have not objected loudly: approximately 96% of votes cast supported the say-on-pay proposal at the 2025 annual meeting.⁷ That is a strong endorsement, and it is the correct counterweight to the criticism above. High say-on-pay support alongside apparent Class A opposition to redomiciliation suggests investors are comfortable with how management is paid and uncomfortable with how much protection management has arranged for itself.

The management-credibility read, on balance: Pomel and Obstler have been consistent and specific across calls. When the largest customer cut usage, they said so on the day, quantified how they had handled it in guidance, and answered the follow-up questions from Morgan Stanley and Barclays directly rather than deflecting — including Pomel's blunt line that if you back out the largest customer, "you get pretty much the same growth rate as the rest of the business."² That is the behavior of a management team that expects to be believed later. It is also the single best argument for extending them the benefit of the doubt on the harder questions ahead.

↑ Back to Top

VIII. The Next Act: AI & LLM Observability

Here is the problem with monitoring artificial intelligence, explained without jargon.

Traditional software is deterministic. Give it the same input twice and you get the same output twice. When it breaks, it breaks loudly — an error, a crash, a timeout. Monitoring it means watching for those loud failures.

A large language model is not like that. Give it the same input twice and you may get different answers. When it fails, it usually fails quietly and confidently — returning a fluent, well-formatted, completely wrong answer, with a 200 OK status code and normal latency. Every traditional monitoring signal says the system is healthy. The customer knows better.

Now stack agents on top. An AI agent does not answer a question; it takes a sequence of actions — calls a search tool, queries a database, writes a file, calls another model — chaining dozens of steps to complete a task. Debugging that means reconstructing the entire chain of reasoning and tool calls, and figuring out which link produced the bad outcome. This is, structurally, exactly the distributed tracing problem Datadog solved for microservices a decade ago, with two new dimensions: cost per step, and correctness of output.

That framing explains why Datadog has been an unusually clean beneficiary of the AI cycle, and it also explains the risk. Both matter, and management has been careful to separate the strands.

On the second-quarter 2026 call, Pomel laid out four distinct AI vectors.² First, AI as a demand tailwind: customers building AI applications consume more cloud, which consumes more Datadog, with no new product required. Second, AI for Datadog — the Bits AI family of agents that investigate alerts, generate code fixes, validate releases, and triage security signals. Third, Datadog for AI — the products that observe the AI stack itself, including GPU monitoring, agent observability, and AI Guard. Fourth, an internal research effort producing time-series foundation models.

The commercial evidence on the first vector is unambiguous and large. As of the second quarter of 2026, more than 750 AI customers used Datadog, including all ten of what management characterized as the top ten AI leaders; 31 of them spent more than $1 million annually and eight spent more than $10 million.² The 10-Q discloses that this AI-native cohort contributed a high single-digit number of percentage points to the company's 36% year-over-year revenue growth in the quarter.⁸ A year earlier, the cohort contributed approximately seven percentage points of growth in the December 2025 quarter.¹⁷

That is the tailwind, and it is also the concentration risk, and the two are inseparable. Roughly eight points of a 36-point growth rate came from a cohort that "includes our largest customer" — the same customer that reduced usage starting in the third quarter of 2026.⁸² This is why the company's own most useful disclosure has become the growth rate excluding AI-native customers: high 20s in the second quarter of 2026, up from mid-20s the prior quarter and 18% a year earlier.² Five consecutive quarters of acceleration in the non-AI base is the strongest available evidence that the AI boom is lifting the whole business rather than papering over a stagnant core.

The second vector — Bits AI — is where the claims get further ahead of the evidence, and where investors should apply the "certification is not commercialization" discipline. Datadog announced Bits Investigation as an autonomous on-call agent at its 2025 DASH conference and shipped a substantially faster version in 2026 that pulls from metrics, logs, traces, dashboards, change events, source code, real user monitoring, database monitoring, and continuous profiling.²³ At DASH in June 2026, the company announced more than 100 new capabilities, including fully autonomous detection-to-remediation workflows, Bits Code for generating fixes, and AI Guard for defending against attacks on AI agents.¹²

At Investor Day, management disclosed that Bits AI SRE had run "well over 100,000" investigations since launch and had more than 2,000 customers active in January 2026.¹⁹ Those are adoption metrics, not revenue metrics, and Datadog has not disclosed Bits AI revenue. The honest characterization is that Bits AI is a well-adopted feature set whose monetization is unproven. The relevant historical base rate is the security business: wide free-or-cheap distribution across thousands of accounts, slow conversion to real spend. It would be a mistake to assume Bits AI converts faster simply because AI is the current narrative.

The research effort is the most speculative and the most interesting. Datadog built a time-series foundation model called Toto — essentially a model trained to understand the shape of operational metrics the way a language model understands text — and released a second version in May 2026 that management described as state-of-the-art on key benchmarks and, more importantly, as demonstrating scalability for time-series models.² At Investor Day, the company noted roughly nine million downloads on Hugging Face and a training cost of approximately $375,000.¹⁹ In June 2026, Datadog acquired Adaptive ML, a startup building a reinforcement-learning operations platform, to accelerate research into world models and agentic post-training; terms were not disclosed.²⁴

The strategic logic is coherent: Datadog sits on an enormous, unusually structured corpus of real production telemetry, and that data is the input to models nobody else can easily train. Whether that translates into pricing power or merely into better features that customers expect for free is genuinely unknown, and there is no historical analogue in Datadog's own record to judge it against. Treat it as a call option with no established conversion rate.

There is a further wrinkle in the AI cohort that changes how it should be read. On the second-quarter call, Obstler noted that the 750-strong group is no longer just AI startups — it now includes hyperscalers running in-house AI labs.² That diversification matters, because a cohort of one dominant lab plus a long tail of venture-funded startups is a fragile revenue base, while a cohort that includes the research arms of the largest technology companies on earth is considerably less so. The eight customers spending more than $10 million each are a concentration risk; the fact that the group is broadening is the mitigant. Both facts belong in the same sentence.

The deal narratives from the quarter give a sense of what the AI-adjacent business looks like in practice. Datadog signed seven-figure annualized agreements with two AI labs scaling model-training workloads, who use the platform for visibility across training infrastructure and GPU fleets.² It also signed a seven-figure expansion within an eight-figure relationship at a Fortune 100 health insurer, where the differentiators cited were HIPAA compliance and handling of personally identifiable information across real user monitoring, logs, and cloud SIEM — a customer expanding to nineteen Datadog products.² Those are two entirely different businesses: one is exposed to the AI capital cycle, the other to the slow, durable modernization of regulated enterprises. The second is what management means when it points to acceleration in the non-AI base.

Then the existential question, which deserves a direct answer rather than a rhetorical dodge. If AI writes better code, does the world need less observability?

The bull answer — complexity always wins — is probably right but is not a law of nature. The mechanism is that AI does not reduce the number of systems; it multiplies them. Agents generate more services, more calls, more data, and more non-deterministic behavior, all of which needs watching. Datadog's own reported evidence is consistent with this: management said the number of calls to its MCP endpoints — the interface AI coding tools use to pull live telemetry — quadrupled quarter over quarter and grew more than 22 times versus the fourth quarter of 2025.² Datadog's own research report found that nearly 5% of AI model requests failed in production, with close to 60% of those failures caused by capacity limits.²⁵

There is also a second-order effect that has not been priced into either camp's argument. If AI agents write substantially more code than humans did, they will also write substantially more bad code, faster, in volumes no human review process can absorb. The historical relationship between lines of code shipped and incidents generated has never been favorable. An organization whose deployment frequency rises tenfold because agents are writing and merging changes will need proportionally more instrumentation, not less — and it will need instrumentation that other agents can query programmatically, which is precisely the direction Datadog's MCP integrations point.

The bear mechanism is subtler and worth stating plainly: if AI agents become the primary consumers of observability data rather than humans, the value may migrate from the interface — the beautiful dashboards, the single pane of glass, the thing Datadog charges a premium for — to the raw data, which is comparatively commoditized. A world where an agent queries cheap object storage directly and reasons about it is a world where the pane of glass matters less. Datadog's Bring Your Own Cloud and Flex Logs initiatives can be read as management hedging exactly that risk by moving down the stack toward the data layer before someone else does.

↑ Back to Top

IX. Analysis: Power & Moats

Time to war-game this properly. Start with Helmer's 7 Powers, because three of the seven apply and four do not, and the discipline of saying which is which is more useful than a general assertion of "moat."

Switching costs — strong, but binding the logo rather than the spend. This is the primary power. A mature Datadog deployment is not a subscription; it is a tagging convention embedded in thousands of services, a library of dashboards, hundreds of alert rules wired into pager rotations, runbooks written around those alerts, and a workforce trained on the query language. Replacing it is a multi-quarter engineering project with no customer-facing benefit. The evidence is in gross revenue retention in the mid-to-high 90s, and in management's Investor Day disclosure of 97%-plus overall retention and 98%-plus for enterprise customers.²¹⁹

But now apply the falsification test properly, because this is the single most important claim in the investment case. If switching costs were as binding on spend as they are on logos, net retention would not have fallen from the mid-140s at IPO to approximately 120% now.⁴ And the second quarter of 2026 provided the cleanest possible experiment: Datadog's largest customer renewed a nine-figure agreement and simultaneously reduced usage.²³ The switching cost held — the customer stayed. The pricing power did not — the customer spent less.

That is the correct, narrowed version of the moat claim, and it should be the reader's takeaway: Datadog's switching costs reliably prevent displacement but only partially resist optimization. Sophisticated customers cannot leave, but they can and do turn down the dial. The KPI that would falsify even the narrowed claim is gross revenue retention. If GRR drops out of the mid-90s, the moat is genuinely breaking. Net retention drifting lower is a pricing story; gross retention breaking is a moat story.

Counter-positioning — historically decisive, now largely spent. Datadog beat Splunk and New Relic because those companies could not rebuild for the cloud without cannibalizing themselves. That advantage has been substantially harvested. The relevant competitors in 2026 are not encumbered legacy vendors: Grafana Labs offers a credible open-source stack, Chronosphere was purpose-built for exactly the cardinality-and-cost problems that make Datadog bills painful, and Snowflake and Palo Alto are now integrating observability into much larger data and security platforms.¹⁶¹⁸ Counter-positioning is a power you use once.

Scale economies in R&D — real and probably underrated. Datadog spent more than $1 billion on research and development in 2025 with roughly 4,000 engineers, running R&D at approximately 30% of revenue on a non-GAAP basis.¹⁹ On a GAAP basis, R&D expense was $1.55 billion, or about 45% of revenue.⁵ The leverage is not in the spending; it is in the distribution. When Datadog builds a new product, it can offer it to 33,400 existing customers at essentially zero incremental acquisition cost. A standalone startup building the same product must acquire every customer from scratch. That asymmetry is what produced a $200 million RUM business growing 50%-plus and, less impressively, the still-small security line.²¹⁹

Network effects — weak, and frequently overstated. Datadog benefits from cross-customer pattern recognition and from an integration library that makes it the default target for third-party vendors. But a customer's Datadog does not become more valuable because another customer joined. This is a scale advantage in data, not a network effect, and describing it as the latter overstates the moat.

Cornered resource, process power, brand — not material. Datadog holds 43 patents globally as of December 31, 2025, which is not a defensive position in enterprise software.¹⁷ Its brand is strong with practitioners but does not command a price premium in a competitive bake-off.

Now Porter, quickly, focused on where the pressure actually is.

Buyer power is rising, and it is the most important force in this industry. The Investor Day framing was that Datadog serves about 32,000 customers against a target market of roughly 500,000, implying about 7% penetration.¹⁹ That sounds like enormous headroom, and in logo terms it is. But the binding constraint is not logos; it is the budget line within each logo. Observability spend has become large enough to attract CFO attention, and the buyer's leverage is asymmetric: they cannot switch vendors easily, but they can absolutely reduce volume, sample traces, shorten retention, and route data to cheaper tiers.

Gabriela Borges of Goldman Sachs put this to management directly on the second-quarter call in one of the more revealing exchanges of the year: at DASH, engineers loved the pace of innovation, while "the CFOs love to complain a little bit about their Datadog bills."² Pomel's answer was straightforwardly commercial — there are only two reasons anyone buys software, to make money or to save money — and he pointed to Infinite Cardinality Metrics as a direct response to the longest-standing source of customer frustration, where sending more granular data produced unpredictable bills.² That is management confronting the bill-shock problem rather than dismissing it, which is the right instinct. It also confirms that the problem is real and structural.

Rivalry is intensifying through consolidation. Three of Datadog's meaningful competitors were absorbed into much larger platforms within about two years: Splunk into Cisco in March 2024, Chronosphere into Palo Alto in January 2026, and Observe into Snowflake following a January 2026 announcement.¹⁵¹⁶¹⁸ The strategic implication is that observability is being repositioned as a feature of larger security and data platforms. Datadog's counter is that a specialist beats a bundle when the product is used daily by engineers who care intensely about quality. That has been true so far, evidenced by six consecutive years as a Gartner Magic Quadrant Leader for observability platforms.¹ It is not guaranteed to remain true against buyers under budget pressure who want fewer vendors.

Substitutes are the quiet threat. Prometheus and Grafana are free, competent, and widely deployed. The open-source stack is genuinely worse at correlation, support, and scale — which is why companies pay Datadog — but "worse and free" wins a meaningful share of the market during cost-cutting cycles, and the OpenTelemetry standard is steadily reducing the instrumentation lock-in that used to make migration painful.

Supplier power is a live gross-margin issue. Datadog runs on the hyperscalers' infrastructure. Second-quarter 2026 gross margin was 79.6%, down from 80.9% a year earlier, and Obstler attributed the variation to investments in new capabilities offset by efficiency work, reaffirming an expectation of roughly 80% plus or minus.² Purchase commitments for cloud hosting and other services totaled $1.4 billion at the end of 2025.⁵ The hyperscalers are simultaneously Datadog's largest suppliers, significant customers, and competitors through their native monitoring tools.

Myth versus reality

Three consensus beliefs about Datadog deserve correction, and they are all beliefs held by people who like the company.

Myth: Datadog is the rare profitable SaaS business. Reality: on a GAAP basis, Datadog reported an operating loss of $44 million in fiscal 2025 and operating income of $5 million in the second quarter of 2026 — a 0% operating margin.⁴¹ The reported GAAP net income exists largely because the company earns substantial interest on its cash. The 22-23% non-GAAP operating margin is a legitimate measure of cash economics, and the free cash flow is real. But the $750.7 million of annual stock-based compensation that separates the two figures is a real cost borne by shareholders through 3% annual dilution, with no buyback to offset it.⁵⁸ The accurate statement is that Datadog converts revenue to cash extremely well and converts revenue to accounting profit not at all.

Myth: consumption pricing is a one-way growth engine. Reality: it is a beta amplifier. It delivered 63-70% growth through 2022 and then delivered a collapse to 27% in 2023 when customers optimized, without any competitive loss.⁵ It is currently delivering 36%. The mechanism does not distinguish between directions.

Myth: switching costs mean pricing power. Reality: the two are different, and the second quarter of 2026 separated them cleanly. The largest customer signed a nine-figure renewal and cut usage in the same breath.² Retention is a floor on churn, not a floor on revenue.

The bull case, stated fairly. Datadog is the default instrumentation layer for cloud-native computing at a moment when the world is building an unprecedented amount of new, unusually complex, unusually failure-prone software. It converts that position into revenue automatically through consumption pricing, has three billion-dollar product lines and several credible new ones, generates real cash, carries $5.0 billion of cash against $1.0 billion of zero-coupon convertible notes due 2029, and is run by founders who have made mostly good long-horizon decisions.¹⁵ Management targets a long-term operating margin of 25% or more against 23% delivered in the second quarter.¹⁹¹

The bear case, stated fairly. The 36% growth rate is substantially borrowed from an AI infrastructure buildout that is itself financed by capital that may not be permanent, roughly eight points of it from a cohort dominated by one customer that just cut usage. GAAP operating income is essentially zero because a fifth of revenue goes to employees in stock. Net retention has compressed by 25 points over six years. The security business, five years in, is 2% of large-account spend. Well-capitalized platforms are converging on the category. And the governance structure has already been used once in 2026 to override what appears to have been majority Class A opposition.

The activist stress test

What would a well-prepared skeptical investor put on the slide?

They would start with capital allocation. Datadog holds $5.0 billion of cash and securities against $1.0 billion of zero-coupon convertible notes, generates close to a billion dollars of annual free cash flow, spends roughly $200 million a year on tuck-in acquisitions, and returns nothing to shareholders while issuing about 3% of the company annually to employees.¹⁵¹³⁸ There is a coherent argument for hoarding — optionality in a consolidating market — but management has not made it publicly in specific terms, and the cash balance keeps growing.

They would move to disclosure. Datadog reports as a single segment. Investors learn the size of the security business, Flex Logs, and RUM only when management chooses to mention them at an Investor Day or on a call. There is no recurring product-level revenue disclosure, which makes it impossible to independently verify whether the platform strategy is producing durable new franchises or a widening set of features that customers adopt but do not pay much for. For a company whose entire equity story rests on multi-product expansion, that is a meaningful gap.

They would then hit concentration and the derisking decision itself. Management's choice to fully derisk the largest customer in guidance is defensible and arguably admirable — but it also means the current full-year outlook embeds an assumption that a customer relationship management explicitly says it does not control.² If the reduction proves deeper or spreads to other AI labs building internal tooling, the guidance protects against one quarter of the problem, not the trend.

And they would finish on governance, where the material is strongest: a classified board, ten-to-one voting shares giving two executives roughly a third of the vote, and a redomiciliation to Nevada carried in April 2026 on totals that imply majority Class A opposition.⁷²²

The counter-arguments are respectable. The cash provides genuine strategic flexibility in a market where competitors are being acquired at multi-billion-dollar prices. The single-segment reporting is standard for a platform company and consistent with how the business is actually run. And approximately 96% say-on-pay support in 2025 indicates that institutional holders are not, on the whole, in revolt.⁷ But the governance package is the one item with no offsetting argument other than trust in the founders, and trust is not a control.

The risk radar

Three risks are material enough to name, and several commonly cited ones are not.

Customer and cycle concentration is the dominant risk, already covered: a high-single-digit share of growth from a cohort containing one enormous customer, in an industry financed by capital that may reprice.⁸

Cybersecurity is an underappreciated tail risk specific to this business. Datadog holds, in one place, the operational telemetry of tens of thousands of companies — including logs that can contain sensitive data, and, through its security products, threat-detection signals. It has achieved FedRAMP High authorization for its government offering, which is a meaningful compliance milestone.²⁵ But a material breach at Datadog would be a breach with unusually wide blast radius, and the trust required to sell this product is disproportionate to the contract value.

Gross-margin drift deserves monitoring rather than alarm. Margin moved from 80.9% to 79.6% year over year in the second quarter, with management attributing the variation to investment in new capabilities.² AI products — GPU monitoring, agent observability, and the Bits AI agents themselves — are computationally expensive in a way that traditional metric aggregation is not. If Datadog is running inference on customers' behalf as part of an included feature set, the cost of goods sold rises without a corresponding price increase. Watch whether the roughly-80% target holds.

What is not a first-order risk, despite frequently appearing on lists: the hyperscalers' native tools. AWS CloudWatch, Azure Monitor and Google Cloud Operations have been "about to commoditize monitoring" for a decade and have not, primarily because their structural advantage — being already present — is also their structural limitation. They monitor their own cloud well and other clouds badly, and multi-cloud is the norm in exactly the enterprise segment Datadog is targeting.

The synthesis is not a split-the-difference. It is this: Datadog's moat is real but is a retention moat rather than a pricing moat, and the investment case therefore depends less on whether customers stay — they do — than on whether the volume of digital activity they instrument keeps compounding faster than their willingness to optimize their bills. That is a bet on the direction of the world, not on the quality of the company.

The KPIs that matter. Three, and only three, are worth tracking closely. First, revenue growth excluding the AI-native cohort, which management now discloses on every call — this separates the durable business from the cyclical one, and five straight quarters of acceleration is the most encouraging fact in the entire story. Second, trailing-twelve-month dollar-based net retention, the direct measure of whether expansion is decaying further from its current low-120s level. Third, the count of customers with ARR of $1 million or more — 603 at the end of 2025, up 31% year over year — which is the cleanest single indicator of whether the platform is genuinely landing inside large enterprises or merely being sampled by them.¹⁴

↑ Back to Top

X. Epilogue & Lessons

Sixteen years after two engineers stopped arguing about whose fault the outage was and started building a shared screen, Datadog processes telemetry for a meaningful fraction of the internet. It employed approximately 8,100 people across 35 countries at the end of 2025, with 44% outside the United States and a third of those in France — the Paris research office that began as a founder's convenience is now a strategic asset.¹⁷ It joined the S&P 500 on July 9, 2025, replacing Juniper Networks after Hewlett Packard Enterprise acquired it.²⁶

It is worth pausing on how improbable the intervening span looks in aggregate. A company that struggled to raise a seed round because investors could not see the problem now serves, by management's account, all ten of the leading AI companies.² A company that could not afford a sales team now closes multi-year contracts worth more than $30 million.² A company that turned down $7 billion is worth roughly ten times that.¹⁰ Very few contrarian bets in technology survive contact with a decade of reality this well.

Four lessons, and the fourth is the uncomfortable one.

Solve a human problem, not just a technical one. Datadog's founding wedge was not a better time-series database. It was the observation that developers and operations engineers could not agree on reality, and that a shared vocabulary was worth more than any individual feature. The competitors who focused on being the best at one pillar lost to the company that made the pillars talk to each other. In enterprise software, the seams between tools are usually where the value is, because seams are where humans do manual work.

The data model is the moat. Everything durable about Datadog's position traces back to a single early architectural decision: one consistent tagging scheme across every data type. That decision is what made cross-product correlation automatic, which is what made the platform strategy work, which is what created the switching cost, which is what produces mid-90s gross retention. It is also why the company can launch a new product and reach $200 million in ARR — the new product inherits the entire tagging estate on day one. Boring architectural discipline compounds into commercial power more reliably than any go-to-market innovation.

Integrate, don't aggregate. Datadog's acquisition record over 2025 and the first half of 2026 totals roughly $370 million across six deals — genuinely small relative to nearly a billion dollars of annual free cash flow, and notably absent of large write-downs over the three most recent reported years.¹³⁸¹⁷ The philosophy is legible: buy teams and technology in adjacent categories, rebuild the product inside the platform, and never pay a market-leader price for revenue you can build. The caveat that belongs in the same breath: this strategy has never been stress-tested by a deal large enough to fail publicly, and the company funds a meaningful share of its acquisitions and its entire compensation model with equity while returning nothing to shareholders.

Founder control is a mechanism, not a virtue. The same super-voting structure that let Pomel and Lê-Quôc turn down Cisco in 2019 and build a company worth ten times that offer let them move the corporation to Nevada in April 2026 in a vote that the disclosed totals suggest a majority of participating Class A shares opposed.²² Investors who own Datadog own both outcomes. The correct posture is not to celebrate founder control or to condemn it, but to recognize that it removes the market's ability to correct a bad decision, and to price that accordingly.

There is a fifth lesson buried in the pricing model that generalizes usefully. Datadog chose, very early, to attach its revenue to a variable it did not control and could not forecast: how much computing its customers do. That decision produced spectacular upside in 2020-2022, a painful reversal in 2023, and spectacular upside again in 2025-2026. Consumption pricing is not a superior business model; it is a different one, with higher operating leverage in both directions than the seat-based subscriptions it is usually compared to. Investors who value it on the same multiples as a seat-based business are pricing an asset with materially higher variance as though it had lower variance. The 52-week trading range — from roughly $98 to roughly $293 — is the market's periodic rediscovery of that fact.

The final word on the business itself. Datadog is often described as the Bloomberg Terminal for engineers, and the analogy is useful but incomplete. Bloomberg's power is that everyone in finance is on it and cannot leave the network. Datadog's power is narrower and more mechanical: everyone's tags are in it and cannot easily come out. The first is a network effect and compounds forever. The second is a switching cost and decays with every improvement in open standards, every budget review, and every CFO who asks why the observability bill is growing faster than the cloud bill it observes.

Which is exactly the tension the next few years will resolve.

↑ Back to Top

XI. Outro

The story that began with an argument in a New York office has arrived at a genuinely open question. The company is the clear leader in its category, growing 36% at a $4.5 billion annual scale, generating close to a billion dollars of free cash flow, and building products faster than anyone it competes with.¹¹⁴ It is also more dependent on a single customer cohort than at any point in its history, earning almost nothing on a GAAP basis, and operating under a governance structure that has already demonstrated it can act over shareholder objection.

The next twelve months will produce the data that settles most of it. Whether the non-AI base keeps accelerating. Whether net retention stabilizes in the low 120s or keeps sliding. Whether the security line finally converts adoption into spend. And whether the largest customer's usage reduction was an idiosyncratic renewal event or the first visible instance of a pattern that repeats as every large AI company builds its own tooling.

Datadog's founders bet in 2010 that the world would get more complex and that someone would have to make sense of it. That bet has been right for sixteen straight years. The interesting question is no longer whether complexity wins — it plainly does — but whether the company that measures it can keep capturing an expanding share of the value it creates, or whether the instrumentation layer eventually becomes what all infrastructure becomes: essential, ubiquitous, and cheap.

Datadog

Table of Contents

🎙️ Listen to this story

Datadog: The "Single Pane of Glass" for the Cloud Age

I. Introduction & Episode Roadmap

II. Origins: The "Works on My Machine" Problem (2003–2010)

III. The First Inflection: Infrastructure & The Cloud Wave (2010–2016)

IV. The Second Inflection: The "Three Pillars" & Platform Expansion (2017–2019)

V. M&A Strategy: Build vs. Buy & Capital Deployment

VI. "Hidden" Businesses & The Security Pivot (2020–Present)

VII. Current Management & Incentives

VIII. The Next Act: AI & LLM Observability

IX. Analysis: Power & Moats

Myth versus reality

The activist stress test

The risk radar

X. Epilogue & Lessons

XI. Outro

References