Datadog · Cloud Security
Cloud security monitoring with Datadog, licensed and supported in Saudi Arabia
Cloud security monitoring means watching three things at once: how your cloud accounts are configured, who can do what in them, and what is actually running on your hosts and containers. Datadog Cloud Security does this on the same platform as your Datadog metrics, logs and traces, so a risky setting and the service it affects sit on one screen. Interkey, an official Datadog partner in Saudi Arabia, sells Datadog licences, implements and supports them.
In short, for executives
- The problem: most cloud incidents start with a setting nobody meant to leave open, an account with more rights than it needs, or an unpatched image, not with an exotic attack.
- What Datadog offers: Cloud Security covers misconfigurations, identity risks and vulnerabilities; Workload Protection watches activity on hosts and containers as it happens.
- Why one platform helps: a finding carries the same tags as the service, team and environment your engineers already use for operations.
- Compliance: findings and reports can serve as evidence for NCA Essential Cybersecurity Controls and Cloud Cybersecurity Controls work, once the mapping is agreed.
- What Interkey does: licences, account onboarding, rule review, control mapping, alert routing and technical support from Riyadh.
At a glance
| Question | Answer |
|---|---|
| Clouds covered | AWS, Azure and Google Cloud for posture, identity and agentless vulnerability scanning |
| Workloads covered | Hosts, containers and Kubernetes, plus serverless workloads, through the Datadog Agent |
| Deployment | Cloud integrations, the Datadog Agent, and agentless scanning that runs inside your cloud account |
| Compliance | Out-of-the-box rules mapped to standards such as PCI and SOC 2; NCA mapping is agreed with your team |
| Where data goes | Findings go to your Datadog site; as of November 2026 Datadog lists no site in the Middle East |
| From Interkey | Licences, implementation, control mapping and technical support in Saudi Arabia |
What cloud security monitoring has to cover
A useful cloud security monitoring set-up answers four questions, every day, without someone running a script by hand:
- Is anything configured unsafely? Public storage, open security groups, unencrypted volumes, logging switched off. This is cloud security posture management, or CSPM.
- Who can do what? Roles and users with lingering administrative rights, paths to escalate privileges, and permissions nobody uses.
- What is vulnerable? Known flaws in the packages inside host images and container images.
- What is happening right now? Unexpected processes, file changes and network connections on running workloads.
Read more
Each question has a different owner. Posture belongs to the platform team, identity to whoever runs access, vulnerabilities to the teams that build images, and live threats to security operations. A tool that puts every finding in one undifferentiated list helps none of them, so routing matters as much as detection.
How Datadog covers each part
Datadog splits the work into named features. Knowing the names helps when you read a quote or the documentation.
| Feature | What Datadog documents | Typical owner |
|---|---|---|
| Misconfigurations | Detects, prioritises and helps remediate misconfigurations across cloud resources, with compliance reports per control | Platform team |
| Identity Risks | Finds lingering administrative privileges, privilege escalations and permission gaps in AWS, Azure and Google Cloud | Access management |
| Vulnerabilities | Covers container images, host images and hosts, by Agent or agentless scanning | Build and image owners |
| Workload Protection | Monitors file, network and process activity on hosts, containers and serverless workloads as it happens | Security operations |
| Security Inbox | One prioritised list that gathers findings from these features | Security lead |
| Cloud SIEM and Audit Trail | Detection on security logs, and a record of who changed what in Datadog itself | Security operations, auditors |
Where teams start. A new cloud landing zone, with posture rules on from day one so drift shows before it becomes normal. An audit coming up, with compliance reports and misconfiguration history as evidence, plus Datadog Audit Trail for changes made inside Datadog. Kubernetes in production, with image vulnerabilities and live workload threats on clusters your engineers already monitor. Or too many accounts with admin rights, where Identity Risks gives a first clean-up list.
Cloud security posture management: misconfigurations
Datadog states that Misconfigurations ships with more than 1,000 out-of-the-box compliance rules, mapped to controls in frameworks such as PCI and SOC 2, and that it evaluates resources at intervals between 15 minutes and 4 hours depending on the resource type. Datadog also states that misconfiguration history is kept for 15 months, which matters when an auditor asks what a setting looked like last quarter.
Read more
A finding is only useful if someone fixes it. You can raise a ticket and assign it to a team, or trigger a workflow. For supported Terraform resources, Datadog documents that it can open a GitHub pull request with the code change that fixes the setting, and point to the file, line and code owner. That keeps the fix in your infrastructure code, so the next deployment does not quietly undo it.
Kubernetes security monitoring and workload threats
Posture checks tell you how things are set up; they do not tell you that a container has just started a shell it never runs. Workload Protection does. By Datadog's own description it monitors more than 40 event types across process, file, kernel and network activity on Linux and Windows, using eBPF on Linux, and it ships with over 350 Agent rules and 200 detection rules covering most MITRE ATT&CK tactics and techniques.
Read more
On Kubernetes the Agent runs on each node, so applications do not change. The Agent can also respond: Datadog documents terminating a process or container, or blocking network traffic, once enforcement is switched on. We recommend running in detection mode first, reviewing what would have been blocked, and only then enabling automatic responses for the rules your team trusts. If you already run Datadog on your clusters, our Kubernetes observability guide covers the Agent set-up this builds on.
AWS security monitoring and agentless scanning
For AWS, Azure and Google Cloud, Datadog can scan for vulnerabilities without installing anything on the instances. It deploys scanning infrastructure inside your own cloud account, snapshots the volumes in use, analyses them there and deletes the snapshots. Datadog states that only the resulting software bill of materials and host metadata are sent to it, and that disk contents and container images stay in your account. Resources that already run the Agent are scanned by the Agent instead.
Read more
Identity Risks reads the same accounts for permission problems: users, roles, groups and policies, and the instances and functions they can reach. On AWS this is often where the most urgent findings appear, because access tends to grow faster than anyone reviews it.
Framing NCA ECC and CCC controls, and data residency
The National Cybersecurity Authority (NCA) publishes the Essential Cybersecurity Controls (ECC) and, for cloud, the Cloud Cybersecurity Controls (CCC). Read the current texts on the NCA site; we do not quote control numbers here because they are revised, and your obligations depend on your sector and classification.
In general terms, both frameworks expect you to know your assets, manage configuration and vulnerabilities, control privileged access, and keep and review security logs. Datadog's documentation names PCI and SOC 2 among its built-in frameworks; it does not list NCA controls. So mapping is a piece of work: your compliance team and Interkey agree, control by control, which Datadog rule, report or log provides the evidence, and where Datadog does not help at all. Policies, training and governance are examples of the second kind. Our NCA ECC overview explains the framework itself.
Read more
Data residency. Datadog is a SaaS platform, and as of November 2026 its documented sites are in the US, Germany, Japan, Australia and the UK, none in the Middle East. Security findings name resources, accounts and sometimes people, so agree with your security team what may leave before onboarding. Agentless scanning helps here, because the disk analysis happens in your account. Our Datadog data residency guide sets out the options, and the Datadog Cloud SIEM page covers the same question for security logs.
RelatedNational Cybersecurity Authority (NCA)Datadog data residency guideDatadog Cloud SIEM page
What drives the cost and the timeline
Datadog prices most of its products per host or per unit, so the bill follows how many hosts, containers and cloud resources are in scope, and which security features are switched on. Our Datadog pricing guide explains the units; we quote for your inventory, not from a list.
The timeline depends less on the software than on your estate: how many accounts and subscriptions there are, whether Agents are already deployed, how many findings the first scan raises, and how quickly owners can be named for them. Connecting an account is a configuration task; agreeing who fixes what is the real work.
How Interkey runs a cloud security project
-
Inventory.
Cloud accounts, clusters, hosts and the teams that own them.
-
Quote the licences.
Datadog licences for the resources and features in scope, with implementation and technical support.
-
Agree residency.
What findings and metadata may leave your network, signed off by your security team.
-
Connect and scan.
Cloud integrations, agentless scanning and Agents, then a first baseline of findings.
-
Map and route.
Rules mapped to the NCA controls you report on, and each finding type routed to its owner.
-
Operate or hand over.
Interkey supports the platform from Riyadh, or hands it over with documentation and stays on as technical support.
Questions buyers ask
What is the difference between cloud security monitoring and a SIEM?
Cloud security monitoring checks how your cloud and workloads are configured and what runs on them. A SIEM analyses security logs for attacks. Datadog offers both on one platform, and many teams use both.
Does Datadog Cloud Security cover the NCA Essential Cybersecurity Controls?
Datadog does not ship an NCA framework. Its findings and reports can serve as evidence for the controls on configuration, vulnerabilities, privileged access and logging, once your team and Interkey agree the mapping control by control.
Does our security data leave Saudi Arabia when we use Datadog?
Findings and metadata go to your Datadog site, and as of November 2026 none is in the Middle East. Agentless scanning analyses disks inside your cloud account and sends only a software bill of materials and host metadata.
How is Datadog cloud security licensed, and what drives the cost?
Datadog prices most of its products per host or per unit, depending on the feature. The number of resources in scope and the features you switch on drive the cost. Interkey quotes the licences together with implementation and support.
How long does a cloud security posture management rollout take in KSA?
It depends on the number of accounts, whether Agents are already deployed and how many findings need an owner. Connecting accounts is quick; agreeing remediation owners takes longer. We give an estimate after the inventory.
Can we add Kubernetes security monitoring without changing our applications?
Yes. Workload Protection runs in the Datadog Agent on each node, and image vulnerabilities can be scanned by the Agent or agentlessly. Applications are not modified.
Next
Read next
Next step
Plan a cloud security review
Tell us which clouds and how many accounts you run, whether Datadog is already deployed, and which NCA controls you report on. We can quote the Datadog licences, the set-up and technical support together.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia