Datadog finds cloud flaws quadrupled this year, and the whole jump came in June

The industry's "vulnpocalypse" is real, and Datadog's▲+0.35% — Datadog, up 0.35 percent today own telemetry says it arrived as a step, not a slope. The median cloud service in its State of Cloud Security 2026↗, published November 10, carried four times as many open high or critical vulnerabilities in November as in February ¹, and the month-by-month counts Infosecurity Magazine extracted↗ show the entire jump landing in June ². Since then the count has barely moved. That distinction bears directly on the fight over what Datadog is worth after last week's selloff.

AI models found the flaws, and adoption speed delivered them

The report's mechanism runs from model to workload. Since May 2026, security-capable models such as Anthropic'sPVT$350B — Anthropic, private, latest valuation $350B Claude Mythos, GLM-5.2 and Kimi K3 have multiplied the volume of vulnerabilities being reported, and Datadog's analysis of thousands of customer applications shows those flaws reaching real cloud workloads rather than sitting in the CVE database ¹. The same pace shows in the supply chain: 60 percent of organizations run package versions released within the previous day ¹.

Stolen keys do the damage, not stolen models

The blast radius now includes AI itself. More than one in five organizations use cloud-hosted AI inference services ¹, and nearly half of the organizations using Google's Gemini hold long-lived API keys that stay valid until revoked ¹. "Attackers don't need to use their own AI model if they can steal the key used to access yours," said Andrew Krug, Datadog's head of security advocacy ³. Chief Information Security Officer Emilio Escobar closed the chain the whole report argues: in the AI era, security becomes an observability problem ³.

The AI cohort that drives growth also sets the price

That is Datadog's pitch, and the quarter behind the selloff shows both its power and its concentration. Revenue grew 35 percent in the third quarter↗ ⁴. Growth excluding AI customers accelerated for a fifth straight quarter ⁴. The AI cohort passed 850 customers, and 39 of them now spend more than $1 million a year ⁴.

But the largest customer cut its usage while staying above its contractual minimum, and fourth-quarter guidance books that account only at the minimum ⁴. Several large AI customers renewed early, trading better prices for bigger commitments, which management called a short-term revenue headwind ⁴. The stock fell 17 percent in the week through November 9↗ ⁵.

February's first 2027 guidance is the test

A flaw count that steps once and then flattens describes a permanently higher plateau of risk, not security demand that compounds every quarter; the compounding has to come from volume. The renegotiated contracts are commitments to spend more over time at lower unit prices, and whether that volume arrives is what February's first 2027 guidance will show ⁵.

In the gap between the risk and the workflow, the work is already being done: Deployment Gates, now generally available↗, watches production health and pauses a faulty release automatically ⁶, and dependency cooldowns are the report's own prescription ¹. The toll on AI-era software is real and permanent. What February prices is who keeps the margin on collecting it.