runtime protection

Datadog ASM

Datadog ASM is a runtime protection product that watches services for exploit attempts. This profile covers what it does, how it is priced, and where it stops being the right choice.

What the product actually does

Datadog Application Security Monitoring instruments running applications and watches requests for attack patterns at runtime. The value over a web application firewall is context: because the agent is inside the process, it can tell you that a suspicious request reached a vulnerable code path with a specific parameter, rather than merely that a request matched a signature.

The second capability is vulnerability detection from the inside — flagging when a library your code actually calls is invoked with attacker-controlled input. That distinction between a dependency being present and a dependency being reachable is the thing most scanners cannot tell you.

How pricing works once you are inside

ASM is priced per host per month on top of the base Datadog platform cost, and the base cost is usually the larger number. Datadog's overall model is per-host for infrastructure plus per-gigabyte for logs plus per-seat for some products, and the combined bill is frequently the largest line in an engineering budget.

The specific trap with ASM is that it requires the APM agent, so adopting it means adopting APM's per-host pricing too. Teams that price ASM in isolation and then discover the APM requirement are the ones who cancel.

Where it breaks down

Runtime instrumentation has a performance cost, and it is not zero. The overhead is modest on a typical service and noticeable on a latency-sensitive one, and there is no configuration that removes it entirely.

Coverage depends on language support. The major runtimes are covered; a service written in something unusual may have partial or no instrumentation, which means the security picture has holes exactly where the least-reviewed code lives.

What switching costs

High. The agent is easy to install and the dashboards, alerts and historical data are Datadog-specific. Leaving means losing the history that makes the tool useful.

Who should not use it

Small teams. The combined platform cost is difficult to justify below a certain scale, and a narrower tool at a tenth the price covers most of the need.

Sources

Datadog public documentation and pricing page, read October 2026.