The CISO Playbook for AI Agents | Datadog

The number one story on Bloomberg right now is that AI has gone wild. You seem remarkably calm.

The way I see it is, if it's not an AI model, it's gonna be somebody or something with actual malicious intent doing it. I do worry about what can the agents do, what tools can they call, what binaries can they pull, and also how do they get access to credentials? So if a code is meant to solve the bug, but it gets rewarded on that, but it doesn't care if it's actually doing something else, the tree or

is sick, so to make it healthy, it cuts it down.

out of a necessity, my team built a judge that evaluates the intent behind a piece of code, like, is this thing meant to do harm or not? And we actually find quite a bit of malicious skills in all these marketplaces.

Engineers now, security is very much front of mind for them.

Developers have always cared about security. The problem has been that the version of security that we want them to do is just crappy,

My thesis ten years ago was that security engineers have become real engineers, so maybe now is the time.

AI is changing the security landscape on both sides. Attackers have more capable tools, but security teams are also figuring out how to use those same capabilities to their advantage. In this episode, a16z's Joel de la Garza sits down with Datadog's Ciso, Emilio Escobar, to talk about what he's seeing as AI adoption spreads across the enterprise, including thousands of engineers working with coding agents. They discuss how AI changes assumptions around permissions, credentials and software supply chains, why simply blocking new tools doesn't work, and how security teams can adapt without becoming the department of no.

And as models get better at finding vulnerabilities, Emilio explains why he's less worried about AI hackers themselves than a more practical problem. What happens when the number of vulnerabilities we can find suddenly explodes?

Thank you so much for joining us. I know you're not here to see us, you're here to go to Black Hat, and it's good to catch up. And it's been a really crazy week. So you are a CISO at a public company, tech company, one of the House of Innovation, driven a lot of really cool technology out of it. And we've been talking to everyone about these models escaping, these models hacking. And I know you've been central to kind of the adoption of AI at Datadog.

And would love to maybe talk a little bit about how are you thinking through the risks? How are you deploying this stuff? And I know you're very close to the product team and you're kind of enabling it. So would maybe start off there and and and go around.

For us, it was like, we have to do it like any other software company. If we're not, we're going to be in the medieval ages real quick. And I like being a CISO, I don't like having my own goat farm. And we started real small. I remember our 1st install, we started with Cursor, and I remember getting like 50 licenses. And it was more of put it out there and see who bit, and then, not surprisingly, it bloomed from there.

So now we use every other coding agent that's out there. And some of the things that we're worried about as we deploy well, 1st, you start with the data, what do we worry about the data? And I never subscribed to the idea of, well, if I block these things, nobody's going to use them.

That's how it worked.

Uh, so on the non developer side, like, we just got Chatgpt licenses for everyone, and it was like, whoever wants it, gets it. I don't care. And use sure, use it to find a recipe for pot roast. I don't give a crap. And cause then I avoided the whole oops moment. And it was this was back, ironically, this wasn't that long ago, this was two years ago, and it feels like things have moved 20 years since.

But I remember having a lunch with a bunch of CIOs at RSA, where everyone was asking me like, how am I not blocking these things, right? And and I was like, Well, a, we can't, cause we the type of company that we are, but b, luckily, we can just buy our way out of that problem. And zero data retention and all those things well, and and probably was

the inverse of Haylett's block. It turned out to be correct, which is the people leaning into it the earliest and the most are the ones that you actually want to reward in a way, right? Yeah,

yeah, yeah, yeah. So now we have over four zero engineers using them. I mean, actually, we have every employee in the company adopting some sort of AI, whether it's coding agent or Gemini, Claude, desktop, chatgpt or what have you. And so I have two, we have two, two verticals. We have the engineering side, which Alexi is deeply involved, our CTO is deeply involved in, and then I'm involved on the non engineering side. For how do we get marketing, sales and everyone else to use AI?

And the adoption is, I think we're at like 98 adoption rate, something like that. It's one ver- one version of AI or the other everyone is using. On that side, on the it corporate side, the data becomes more the paramount issue, permissioning and all those things. One thing that AI is gonna do is you think you have proper controls of who get access to what Google file or what have you. AI is gonna find a way to get it.

All you have to do is prompt it. flattens the organization, It flattens the organization quite a bit. So we actually had a moment where internally we built this business intelligence tool. It's really neat. And it was starting to show some data that I was like, it wasn't anything like a f- a fire alarm, but it was like, should we?

And the data was probably always available to everyone. They just never took the time So to look. so, yes, um, so Yeah,

so it's data that is in a data warehouse, and we thought we had the right table and row permissioning and all of that. But there was always a way to get access to the data if you knew the SQL well enough. Well, then what happened is that you went from only people who really know SQL are using this to now having a sales rep telling, asking like, Hey, what are? what is? I'm a commercial sales rep?

I'm just coming up with an example, I'm a commercial sales rep. How is the enterprise deal enterprise tier team doing? Which normally you wanna keep those things separate, and what have you? And the agent just figured out the SQL to do it. yeah, yeah, yeah. And Uh, but it's

then it tells them what the comp plan is and they can go do it.

so, but it's not always find a way around the permissioning and all that. It's like we had the right permissioning for the right time and then the age. So we've been obviously improving all of that, and then, luckily, my IT group is what we've done is now we're at the point where we have role-based MCP servers as well, so we have an MCP server for SDRs and things like that, so we control and govern that data.

And then we're like, let them have it with whatever tool they wanna use. On the engineering side, obviously, the coding agent, like, one, my security team is worried about. Similar to what you were just talking about is on. What can the agents do, what tools can they call, what binaries can they pull, what dependencies can they use, and also how do they get access to credentials? So for that, we have a few things going on where we've contributed to these open source sandbox and expanding on that.

Where the agent doesn't actually get access to the any sort of credential file. So even if you have a file in your home directory that has your AWS secret, your NPM publish secret or what have you, the agent on the sandbox can't touch it. The S credentials get injected into the agent the moment it needs it. And the beauty of it is we already have a CLI tool that will give you these ephemeral tokens to these things.

We just have the agent not know how to call it. So it's like, Oh, I'm Emilio, I'm an engineer on this team. I want to authenticate to GitHub, for example. I call this tool off GitHub and it gives me a credential that's valid for, I don't know how long, and it gives me my access to GitHub. But now it's the agent getting my access to GitHub, but not it. There's a static token written in a file.

The 2nd thing is, we know thing the the threat has expanded. Developers are now the main target for attackers. Because if I get one of these tokens, I can then build a worm that attacks a bunch of packages, or I can just escape or do whatever, or access your production environment. The other ways that we see how these agents can do it is via skills. We track a few of these marketplaces

yeah. How do you control the skills? That's a really hard problem, so right?

we actually have built hooks into the agents. And then one of the things that which we can talk about is my team built out of a necessity. A judge that evaluates using AI LLMs, that evaluates the intent behind a piece of code. I'm not talking CVEs, vulnerabilities or anything like that. Is like, is this thing meant to do harm or not? Harm being a vague term on purpose, it's actually does really well at scanning markdown files as well.

So we built it because for the longest time, Datadog for those who don't know, we have a Datadog agent. We take 3rd party code contributions to it, things like integrations and what have you, so code written by other people. We had this process for the longest time that required a security engineer and an engineer on that agent team to reevaluate the code and then approve it and then merge it. Someone like, Well, this thing can't scale, so then we built this judge by we, I mean, my team.

I don't do anything that got really good at it. And then the software supply chain hijack started happening, and IDE extensions started happening, and then we threw this thing at those packages. And it was able, actually able to identify the malicious piece of code that was injected or introduced during the hijack. So we're like, huh, I wonder how it would do with markdown files, and it actually does pretty well. So then internally, what that means is we have hooks into the agents, we know what skills they're getting pulled.

I've never believed in a security program that just restricts everything, cause it the pain, innovation and all that

It's the empire of no, is the empire of yeah,

no. But also, it's like, we don't wanna be free, willy either. So what we do is now we put this judge in front of every skill that wants to get introduced. We actually find quite a bit of malicious skills in all these marketplaces. We're working with a few of them, partnering to see if they wanna use this judge. But also, like, hey, giving a heads up of, hey, we found this one, we found that one, we found that one.

And they do a pretty good job at taking those down. The other thing we worry about is what dependencies it can pull, what binaries it can pull. So I think it's plenty of that out there right now. I don't think we have to justify it, but the judge does a good job at it and then evaluating the code output of the agents against malicious intent. I think intent, and it's funny how things, how this industry works.

And this is maybe like, where I can get a little cheeky here, if you allow me, is,

I have no control. You can say whatever you want.

apparently, intent now is one of the must have in any AI security type of solution. But it the the interesting thing is like, it happened after we've had conversations about intent anyways. Um, but apparently that's a big deal, right? It's, it's, it's like the fact that these agents, obviously, they're trained on existing data, on existing code,

And they have a reward structure.

and they have a reward structure. Um, so if a code is meant to solve the bug, but it gets rewarded on that, but it doesn't care if it's actually doing something else insi- uh, uh, outside of that. So we were the tree wor-

is sick, so to make it healthy, it cuts it down, right? yeah, um, so Yeah,

we were worried about, like, um, the, you know, the typical thing that we read about of an agent producing code that either would have, oh, you know, your database is in scaling s, and it's paging people at four am. So the best thing I can do is just turn it off. And therefore I solve the problem of paging people at four zero in the morning, right? So you have to be careful how you prompt these things, but also how it actually interprets your prompt and executes on that.

So we have this judge now evaluating the code output of of the agents to then make sure that we're we're doing this. So, uh, the cool thing is that we do this internally, cause we have to. And then the product team goes like, wait a minute, that might actually become a thing. Uh, let's explore, and then we evaluate it with customers and all of that. Um, but I I mean, I get to say I'm lucky that the team can do it.

Um, one of the things that surprises me. I sat in at a round table last week about agentic security, and the sense that I got from a bunch of the security leaders who were in that call was a sense of helplessness of just waiting for a commercial solution to come in and solve it all.

well, you're, yes. I think that the profession is interesting in that there are a number of different CISO profiles. And I think, you know, I, I say this as someone who is relatively technical for a CISO. Like before, before, maybe just the generation above us, like, there were no tech. I mean, well, for CISO, it was Steve Katz, right? So that's like, pretty recent. Um, you know, and I think that there was just a lot of like, sort of like, CFOs becoming CISOs or CTOs that have not really or CIO.

Yeah, security. People, right? So, like, I think, and then, and then what happened, I think, is that security teams got quite big and you needed a manager, right? Not necessarily a a leader or a thought leader. And so I think there's just a lot of that right now in the industry, where there's very much a, you know, if you're, if you're a large industrial company and software is not your competitive advantage, you're probably gonna buy most of your product.

Versus like, Datadog, which we're like, you better but it's, and be the best and he's totally at that. That's

fine, right? But I still believe, even in those scenarios, you may have one or two people on that team that if you give them creative license, they could do something. Um, but the fact that that wasn't even a thought process worries me a little bit because this thing is moving really, really fast. Naturally, like a lot of the companies that are solving this are new companies, you know, I think it's really the

hard, and this is, this is, I mean, I think the talent shortage is still a problem, and I'm generally bullish on security jobs because of it. But like, I think, I think for some of the bigger programs, like, it's really hard to get technologists in there because they are but. But here's shopped. my counterargument Yeah,

Do you really need a security person to do it?

no, and I think some of the best security people didn't start as security people. Like, you know what I mean, it's like the developer that found their way into security, right? Yeah,

but also in this, in these companies, like, I'm sure there's a developer somewhere in there that they can be like, Hey, how about we have you solve this problem for us? In the meantime,

I think that a realignment is kinda happening. So I was talking to, uh, a family member at a big, big American corporation, and they were saying that. Sort of like with AI tool adoption, they don't need to write as much code manually anymore. They still need engineers and like that, but like, they're seeing, they're basically saying, like, hey, look, we don't need this many tier one engineers and the security team needs them. And so I think maybe you're starting to see some of that cross pollination, where you'll see that talent find their way into security.

Cause it was always the case that if you're a developer and engineer like you, just you would just make more money on on the software development side. And so, like, I think those are equalizing, and maybe, I mean, my my thesis ten years ago was that security engineers will become real engineers, so maybe maybe now is the time

yeah yeah. I mean, we pay them the same as software engineers.

now we do. Yeah, yeah, yeah, I mean, in the Valley, especially, like, like, during I think, the same I think it's, job band, I think it's narrowing in large corporates. I think I think it's still software engineers have the advantage there, but that that'll probably narrow over time.

Yeah, so that's how we've been thinking about agentic security is like, what are the things that we actually worry about, and then what do we? What can we build, what can we, what can we use, um, and then where do we find more synergies there? And I know that's a very buzzy term, but what that I mean is like, our dev, our DevEx team is also interested to understand what's happening in the agents, cause they wanna monitor developer experience.

So why can't we just all together work on it? So that's, that's how we, that's how this thing has grown. Cause it's not just a security tool for the sake of security, it's also well, and serving other purposes.

and I've noticed with engineers, especially over the last decade, like engineers now, security is very much front of mind for them. Um, if, if, only because they don't wanna have to keep fixing things. And so, like, I've noticed that there is this, this front of mind security thing for engineers, which is great. It's like, I think, I think we've made a lot of progress in that regard.

yeah, and I, I, well, I actually have a a little bit more of a uh, of a, um, maybe fire a take on that. I think developers have always cared about security. I think the problem has been that the version of security that we want them to do is just crappy, which is like, go fix this thousand of things that none of them are actually relevant to what you're building. But the scanner told me there's they're critical, so you have to fix them.

yeah, there is a lot of like, the you guys have sent me so much junk, And and you've lost all credibility.

and so one of the things that I get to do at Datadog is actually I get to meet a lot of the engineering side of the equation. Talking to us about our security platform and products, and how do we get their security team to use it? And um, and they told me s the same stories that, yeah, I'm sure you've heard of, like, I get a thousand tickets, none of them are relevant. Security doesn't know what we're doing, there's no intent to even understand the systems.

Um, and the number of times I hear a security person telling me that their developers write crappy d code, it's just mind boggling to me. I'm like, Well, then you do it, see how good you can do it. Um, but probably know better. Yeah, yeah, exactly, uh. Or maybe it's good code, but they're not fixing your noise vulnerabilities, and therefore you think it's crappy code, yeah, I mean, oftentimes, right,

right, with codebases, this was the learning experience for me. Was that like, you'll find these in in in isolation, you'll find these issues in code. But then, like, up, there's there's a framework, a layer up that's actually mitigating any potential fallout. And so it's like, whatever, it doesn't matter. Um, and I just think, I think, yeah, security people tend to have an issue, a blind spot around some of that stuff. I, I guess in, I, I guess, sort of like, as we sit here, you know, the the the number one story on Bloomberg right now is that AI has gone wild.

Um, and and the the world is over and everything is getting hacked. You seem remarkably calm, so maybe maybe before we go, like, would love to get your take just on sort of like, you know, supposedly there's this great white shark cruising out there just eating people without them knowing. Um, but in general, like, I just haven't noticed a sense of panic from CISOs like, what's your take on all of this?

I mean, the way I see it is, it's it's, uh, if it's not an AI model, it's gonna be something with somebody or something with actual malicious intent doing it. Uh, so therefore I don't panic. Um, I do. I do worry about our access to those same capabilities. Um, I do worry about the lack of regulatory framework that's deciding who gets access to these capabilities. Um, what?

I feel you on that. It's sort of like, it's really interesting who's getting access to this stuff, and it's sort of like, Hm, what's at play here?

but then, and and then it's clear that it's or or communicated in a way that makes it or s portrays it as clear that it's outside of the frontier. Laps, hands and uh, so, like, we have to put our company name on the list and then we're supposed to wait, uh. And then when I ask, what's the criteria for how these things are evaluated? I get jazz hands response.

yeah. But then you come to a conference and you talk to your buddies and they've had it for nine months and they're making stuff that's way less critical than what your product. yeah, yeah. Cause our Yeah,

argument was like, hey, s. Some of these companies are using our stuff. Wouldn't it make sense for us to get access so we can protect the stuff that you're using? Um,

I'm sure there's a lot of government agencies running Datadog software and uh, well, we and vice have, versa, right? Like,

we, we have a lot of uh uh. Also companies that provide services to the government. You know,

yeah, of course.

Datadog, um, so yeah. So I'm not worried necessarily about the models escaping sandboxes and finding old days. Like, I think, actually, I actually think inherently it makes things better for us. Because guess what, we're talking about it, Bloomberg is talking about it, you just said, right? So before it was like, well, nobody's talking about it, so who cares? Uh, but am I worried about one of those things hitting Datadog and something happening? Where it's like, well, it's either a model or somebody else, right?

Like, if we have a gap, we have a gap at some point, it's gonna get discovered. Um, so I'm not too worried about that. What I worry about is the volume of things that are gonna get discovered and the things that are telling us how to handle that volume are not up to par. So the you must fix every CVE that's in your environment to now you're gonna get a thousand x more CVEs in your environment.

Well, those things, two things, don't necessarily align well, so I'm hoping that side also changes to the current day of things. That's what I worry, and then the sorry, and lastly, like, the other thing that I worry is the hypersensitivity to the security of these findings. Because of the fact that it was found by a model rather than a human, and I'm already seeing some of that where, like, oh, uh, model X found this, so it must be extremely critical and true.

And then you're looking at it and you're like, Eh, it's actually not, um, but I. It's kinda hard to argue that. He's also arguing against, uh, you know, this thing, uh, because just because a Greek God found it doesn't mean it's actually a critical thing. Um, but it, that's, I think, the the the third party risk management game is gonna get really crappy, even more so than it is because of this thing. So I hope eventually, though, so those things I do worry about.

But a model escaping and hacking companies and all that is like, Well, I mean, they were gonna get hacked. No matter

Yeah. There's always been hackers, there's two more now, whatever,

yeah, yeah, yeah. There are two honestly, really good ones, but hopefully they make us better rather than, like, making us worse,

well, and I think I think the lesson that I have learned throughout my entire career is that any attempt to gatekeep security fails, and it only makes things worse. And that an open and free discourse on these things is the only way to get better. So thank you for joining us and having

yeah, that's right. that discourse, I mean, yeah,

man, it's been awesome. yeah, thanks, Enjoy your time at the conference.

thank you.

Thanks for listening to this episode of the A16Z podcast. If you like this episode, be sure to like, comment, subscribe, leave us a rating or a review, and share it with your friends and family. For more episodes, go to YouTube, Apple Podcasts and Spotify. Follow us on X at a16z and subscribe to our Substack at a16z.substack.com. Thanks again for listening, and I'll see you in the next episode. As a reminder, the content here is for informational purposes only, should not be taken as legal, business, tax or investment advice, or be used to evaluate any investment or security.

And is not directed at any investors or potential investors in any a16z fund. Please note that a16z and its affiliates may also maintain investments in the companies discussed in this podcast. For more details, including a link to our investments, please see a16z.com forward slash disclosures.