The CISO Playbook for AI Agents | Datadog

Episode Summary

Executive Summary: Datadog CISO Emilio Escobar argues AI is reshaping enterprise security less through “AI hackers” than through broader access, permission, and supply-chain risk. He says companies should embrace AI, govern it with data controls and sandboxing, and use intent-aware security tools to scale review of code and skills. His biggest concern is not model escape, but a surge in vulnerabilities and weak triage processes.

Main Topics: Enterprise AI adoption and pragmatic risk management (Priority: 5/5): Datadog rolled out AI tools broadly rather than blocking them, starting small with coding agents and then expanding to company-wide adoption. Escobar argues that blocking rarely works; the better approach is enabling use with governance. Data access, permissions, and organizational flattening (Priority: 5/5): AI agents can surface data that traditional role boundaries were meant to hide, especially in BI and warehouse environments. The transcript highlights how agents can bypass human friction and expose permissioning gaps. Securing coding agents, credentials, and tool access (Priority: 5/5): On the engineering side, the main worries are what tools agents can call, what binaries/dependencies they can pull, and how they access credentials. Datadog uses sandboxing and ephemeral credential injection to reduce exposure. Intent-based security and malicious skills detection (Priority: 5/5): Datadog built an AI judge to evaluate whether code or skills are intended to do harm, not just whether they contain traditional vulnerabilities. The tool is applied to third-party contributions, package hijacks, IDE extensions, and skill marketplaces. AI changes the security labor market and team composition (Priority: 4/5): Escobar suggests AI is narrowing the gap between software and security engineering and may push more technical talent into security roles. He sees some cross-pollination as engineers adopt security responsibilities. The real concern: vulnerability volume and weak triage (Priority: 5/5): Escobar is less worried about catastrophic AI agents than about a sudden explosion in vulnerabilities and the industry's inability to prioritize them. He also worries people will over-trust model-found findings without validating severity. Security culture: avoiding the 'Empire of No' (Priority: 4/5): Both speakers emphasize that developers do care about security, but often reject noisy, irrelevant security programs. The desired model is collaborative, intent-aware, and supportive of developer workflows rather than gatekeeping.

Key Arguments: Blocking AI tools is ineffective; adoption should be encouraged with controls, not prohibited. AI flattens organizational barriers, so permissioning and data governance must be redesigned for agentic access. Developers become higher-value attack targets because stealing credentials or tokens enables broader compromise. Sandboxes and ephemeral credential injection reduce the risk of agents accessing sensitive secrets on disk. Intent matters: security should assess whether code or a skill is meant to do harm, not only whether it has a known CVE. AI-assisted security should scale review of third-party code, marketplace skills, and supply-chain content. The biggest industry challenge is not AI models “escaping,” but handling an explosion in vulnerability discovery and prioritization. Security teams should be technical partners to engineering, not just ticket generators or gatekeepers. Many developers already care about security, but lose trust when security programs flood them with irrelevant findings. AI may help equalize compensation and status between software engineers and security engineers, improving security hiring.

Data Points: Datadog engineer adoption of AI tools: 4,000+ engineers - Escobar says more than 4,000 engineers at Datadog are using coding agents and other AI tools. Company-wide AI adoption: 98% adoption rate - He says nearly all employees use some form of AI, including ChatGPT, Gemini, Claude Desktop, and coding agents. Initial Cursor rollout: 50 licenses - Datadog’s early experiment with coding agents started with a small Cursor deployment to see who would adopt it. Timeline of enterprise AI rollout: 2 years ago - He references launching broad ChatGPT access for employees about two years prior. Security review process scaling issue: 2-person approval model - Third-party contributions to Datadog’s agent previously required review by both a security engineer and an engineer on the agent team before merge.

Pivotal Quotes: "If it's not an AI model, it's going to be somebody or something with actual malicious intent doing it." — Emilio Escobar: Explaining why he is not panicking about AI-specific threats. "The tree is sick, so to make it healthy, it cuts it down." — Emilio Escobar: Describing how AI reward structures can produce code that solves a narrow problem while causing harmful side effects. "I think developers have always cared about security. I think the problem has been that the version of security that we want them to do is just crappy." — Emilio Escobar: Arguing that security teams need to provide more relevant, usable guidance for engineers.

Implications: Security teams should prepare for agentic access, not just agentic attacks. The winners will combine strong identity/data controls, intent-aware review, and developer-friendly workflows while planning for far more findings than humans can manually triage.