Datadog Pricing 2026: Ultimate Guide for Security Products

Datadog pricing starts at $0 on the Free tier, and the paid Infrastructure plans start at $15 per host per month for Pro and reach $34 for DevSecOps Enterprise, billed annually. The security products carry their own prices: Cloud SIEM starts at $5 per GB or million events analyzed, Cloud Security at $10 per host, Workload Protection at $15 per host, and App and API Protection at $31 per host, all per month on annual billing.

This guide shows what each Datadog plan and security product costs, how Datadog counts hosts, containers, and custom metrics, what support costs extra, and where you can cut the bill.

Disclaimer: the figures below come from Datadog’s pricing pages, price list, and billing documentation for its US site, read on October 20, 2026. Datadog changes prices and billing units, so confirm every figure in your quote.

Datadog shows you when something in your cloud looks wrong, and a Cloud SIEM signal at 2 a.m. still needs someone to decide whether it is an attack. UnderDefense Agentic AI SOC works on top of the security tools you already run: AI agents investigate each alert, and analysts on shift 24/7 decide what happens next, so your team starts the day with investigated incidents.

How Much Does Datadog Cost?

Datadog pricing has no single monthly fee. Each product has its own list price and billing unit, and your bill is the sum of the products you turn on. The table shows the starting list prices for the Infrastructure plans and the security products on Datadog’s price list.

Log Management, APM, and every other Datadog product add their own lines on top of these. Cloud SIEM is the only row with two units, and the next section explains why.

Datadog Security Products Pricing

Datadog sells five security product lines, each with its own price: Cloud SIEM, Cloud Security, Workload Protection, App and API Protection, and Code Security. Datadog’s documentation notes that App and API Protection was formerly known as Application Security Monitoring, the name many older pricing guides still use.

Cloud SIEM Pricing

Cloud SIEM starts at $5 per month on annual billing, $6 month-to-month, and $7.50 on-demand. Its pricing page labels that price per GB analyzed, while Datadog’s full price list and billing documentation meter it per million analyzed events. Ask Datadog which unit your quote uses before you size it against your log volume.

The price includes more than 800 out-of-the-box detection rules maintained by Datadog, 12 months of security log retention and indexing, 15 months of security signal retention, and unlimited user accounts. Custom detection rules cost nothing extra. Bits Security Analyst, Datadog’s AI investigation feature, comes with 100 free monthly investigations per 1 TB analyzed, with a minimum of 50.

Cloud SIEM only analyzes the logs you choose to send to it, so your security filters decide most of the bill. Workflows triggered from security signals are free, and workflows triggered by other events are billed separately.

Cloud Security Pricing: CSM Pro and CSM Enterprise

Cloud Security is Datadog’s posture and vulnerability product, sold as Cloud Security Management (CSM) Pro and CSM Enterprise. CSM Pro starts at $10 per host per month billed annually, or $12 on-demand. It covers Cloud Security Posture Management (CSPM), Kubernetes Security Posture Management (KSPM), vulnerability management for containers and hosts, Cloud Infrastructure Entitlement Management (CIEM), and mapping of your resources to compliance frameworks.

CSM Enterprise starts at $25 per host per month billed annually, or $30 on-demand. It adds file integrity monitoring and Workload Protection for Linux, Windows, Kubernetes, Docker, and AWS Fargate, and raises the container allotment from 5 to 20 per host license.

Three rules shape the quote. CSM Pro needs no Infrastructure Monitoring plan, your organization buys either CSM Pro or CSM Enterprise for all its hosts, and a billable host includes any instance scanned with agentless technology.

Datadog’s CSPM competes with standalone posture tools, and UnderDefense’s comparison of nine CSPM tools sets out what those tools cost in 2026.

Workload Protection Pricing

Workload Protection, Datadog’s runtime threat detection, starts at $15 per host per month billed annually, or $18 on-demand. It monitors file and process activity with eBPF-based analysis in the kernel and detects network anomalies, across most major Linux distributions, Windows Server, Docker, and Kubernetes.

Each host license includes 4 containers. Additional containers cost $0.002 per container per hour, or $1 per container per month prepaid, and AWS Fargate tasks cost $2.60 per task ($3.70 on-demand). You buy Workload Protection on top of Infrastructure Monitoring, and it is already included in CSM Enterprise.

App and API Protection Pricing

App and API Protection (AAP) starts at $31 per host per month billed annually, or $36 on-demand. It detects OWASP attacks in real time, blocks suspicious requests through an in-app WAF in Datadog’s tracing libraries, and keeps security signals for 15 months and suspicious requests for 90 days.

AAP requires Datadog Infrastructure Monitoring. A billable AAP host is one where the product is enabled and actively submitting spans, and you can turn it on for selected services only. AWS Fargate costs $2 per task ($2.90 on-demand), and serverless functions cost $10 per million traced invocations ($15 on-demand).

Code Security and Sensitive Data Scanner Pricing

Datadog prices most code security products per committer, per month on annual billing. Static Code Analysis (SAST) and Static Software Composition Analysis each cost $25, Infrastructure-as-Code (IaC) Security and Secret Scanning each cost $15, and the Code Security Bundle costs $40.

Runtime products are priced per host: Runtime Software Composition Analysis at $10 and Runtime Code Analysis (IAST) at $20. Sensitive Data Scanner, which finds sensitive data in logs and other telemetry, costs $0.30 per scanned GB.

Datadog Pricing Comparison Table

Choosing the right Datadog plan depends on how many hosts you run, how long you need your data, and whether you want security features bundled into the host price. The table compares the five Infrastructure plans as Datadog lists them in October 2026.

Datadog pricing scales with your infrastructure size. The Free plan’s 5-host limit and 1-day metric retention keep it out of production use.

What Datadog pricing does not include:

• Log Management, APM, Cloud SIEM, and the standalone security products are billed separately.
• Premier Support is a separate purchase on top of the Standard Support every customer gets.
• Implementation, training, and technical account management are separate Datadog services.
• Containers above your plan’s allotment are billed per container hour.
• Custom metrics above the allotment cost $5 per 100 custom metrics per month.
• The Free tier includes no security features.

Check each of these lines against your environment before you compare a Datadog quote with another vendor’s.

Datadog Products Overview

Datadog groups its products into observability, security, digital experience, software delivery, service management, and AI. You choose from Free, Pro, Enterprise, DevSecOps Pro, and DevSecOps Enterprise for infrastructure monitoring, and each tier adds capabilities for monitoring, administration, and security.

The plans scale from a single team to a large enterprise, and the right one depends on what you need to watch and secure:

• The Free and Pro tiers suit teams starting with infrastructure monitoring.
• Pro and DevSecOps Pro suit teams that want posture management bundled into the host price.
• Enterprise and DevSecOps Enterprise suit organizations that need advanced administrative controls and runtime threat detection.

The sections below take each plan in turn, starting with the Free tier.

Datadog Free Plan Pricing and Features

The Free plan provides core monitoring at no cost. It suits small teams or individual developers getting started with cloud monitoring and basic infrastructure tracking.

Key Features of Datadog Free Plan:

Datadog lists the following for the Free plan:

• Core collection and visualization features
• Up to 5 hosts
• 1-day metric retention
• 1,000+ integrations
• Out-of-the-box dashboards
• Host and Container Maps
• Unlimited user accounts

Alerts, container allotments, and custom metrics start with the Pro plan.

Pros of Datadog Free Plan:

The Free plan costs nothing to try:

• No financial commitment
• Easy onboarding
• Fundamental monitoring tools

The Free plan works best as a test bed before you commit to a paid plan.

Cons of Datadog Free Plan:

The limits show quickly in production:

• Significant feature limitations
• Limited data retention
• Restricted number of hosts

Most teams move to Pro once they monitor more than a handful of hosts.

Datadog Pro Plan Pricing and Features

Priced at $15 per host per month (billed annually or $18 on-demand), the Datadog Pro plan centralizes monitoring of systems, services, and serverless functions for growing teams. It includes unlimited alerts, 15-month metric retention, and Single Sign-On with SAML, which makes it a fit for teams that need real-time monitoring and automated issue detection. Log Management is billed separately.

Key Features of Datadog Pro Plan:

The Pro plan adds the following to the Free plan:

• 15-month metric retention
• Unlimited alerts
• Outlier Detection
• 5 containers per host allotment
• 100 custom metrics per host allotment
• 500 custom events per host allotment
• Single Sign-On with SAML
• SCIM provisioning
• Data Access Control (10 datasets)
• Cross-Org Visibility (5 connections)

Watchdog, Anomaly Detection, Forecast Monitoring, and the Governance Console sit in the Enterprise plan.

Pros of Datadog Pro Plan:

The Pro plan is where most production monitoring starts:

• Fits teams that need production monitoring with long retention
• Scalable monitoring
• Improved visibility across infrastructure

Its per-host price also makes the bill easy to forecast.

Cons of Datadog Pro Plan:

The per-host model has its own limits:

• Can become costly with multiple hosts
• Some advanced features require additional investment

The cost-optimization steps later in this guide address the first point.

Datadog Enterprise Plan Pricing and Features

The Enterprise plan, priced at $23 per host per month (billed annually or $27 on-demand), adds machine-learning alerts and advanced administrative controls for large organizations.

Key Features of Datadog Enterprise Plan:

The Enterprise plan includes everything in Pro, plus:

• Watchdog automated insights, Correlations, Anomaly Detection, and Forecast Monitoring
• Live Processes
• 15-month metric retention, customizable
• 200 custom metrics per host allotment
• 1,000 custom events per host allotment
• 10 containers per host allotment
• Governance Console
• Advanced administrative controls (Multiple SAML Providers, IP Allowlist, Email Domain Allowlist)
• Data Access Control (100 datasets)
• Cross-Org Visibility (100 connections)

None of these are security products, which come with the DevSecOps plans or as standalone purchases.

Pros of Datadog Enterprise Plan:

The Enterprise plan suits large teams with strict access rules:

• Enterprise-grade administrative controls
• Customizable dashboards
• Governance and data access features

Governance and access controls matter most when several teams share one Datadog organization.

Cons of Datadog Enterprise Plan:

The extra controls come at a cost:

• Higher price point
• Complexity might overwhelm smaller teams

Compare it with Pro plus the features you actually use before you upgrade.

Datadog DevSecOps Specialized Plans

Datadog’s DevSecOps plans bundle infrastructure monitoring and Cloud Security into one host price, so security posture data sits next to your monitoring data. They cover misconfigurations, vulnerabilities, and compliance across your cloud environments and Kubernetes clusters.

DevSecOps Pro costs $22 per host per month billed annually, or $27 on-demand. It includes every feature of Infrastructure Pro and CSM Pro: CSPM, KSPM, vulnerability management, CIEM, and compliance mapping. It suits teams that want posture management and compliance tracking without a separate security contract.

DevSecOps Enterprise costs $34 per host per month billed annually, or $41 on-demand. It includes every feature of Infrastructure Enterprise and CSM Enterprise, adding file integrity monitoring, Workload Protection, and anomalous workload profile detection, with 10 containers allotted per host license.

Both plans track conformance to more than 15 industry benchmarks, including CIS, PCI DSS, and SOC 2. A DevSecOps plan covers all your hosts and containers, and you cannot combine it with standalone Infrastructure or Cloud Security plans.

How Datadog Billing Works: The Core Model and Its Cost Dimensions

Datadog calculates fees from your usage of each product during each calendar month. The billing cycle starts on the first of the month (UTC), whatever your sign-up date, and your first month is prorated. Each product has its own billing unit, and these are the dimensions that add up to your bill:

• Hosts, for Infrastructure, APM, Cloud Security, Workload Protection, and App and API Protection.
• Containers above the allotment each host license includes.
• Custom metrics and custom events above the per-host allotment.
• Gigabytes ingested and millions of events indexed, for Log Management.
• Analyzed logs, for Cloud SIEM.
• Committers, for Code Security, and seats, for On-Call and Incident Response.

For a security buyer, the host count drives most of the bill, because Cloud Security, Workload Protection, and App and API Protection all bill per host.

Annual, Month-to-Month, and On-Demand Pricing

Datadog’s price list shows three rates for most products: billed annually, billed month-to-month, and billed on-demand. Infrastructure Pro costs $15 per host per month on an annual commitment and $18 month-to-month or on-demand, so committing saves $3 per host every month.

For Cloud SIEM, the three rates differ: $5 annual, $6 month-to-month, and $7.50 on-demand. Your Subscription Details page in Datadog lists the contract price and the on-demand price for every committed product, so you can see which rate applies to each line.

High-Water Mark and Hybrid Hourly Plans

Datadog offers two billing plans for host-based products. On the high watermark plan, Datadog meters your host count each hour and bills on the highest count in the lower 99% of those hourly readings, excluding the top 1% to soften short spikes. It suits environments with stable usage through the month.

On the hybrid monthly/hourly plan, you commit to a monthly minimum, and host hours above it are billed at an hourly rate. Datadog positions it for ephemeral environments such as autoscaling fleets and short-lived workloads.

What Counts as a Host, Container, and Custom Metric in Datadog

Three definitions from Datadog’s billing documentation decide most of an Infrastructure bill. Read them before you count your environment for a quote.

What Counts as a Host

A host is any physical or virtual OS instance you monitor with Datadog: a server, a VM, a Kubernetes node, an Azure App Service Plan instance, or a Heroku dyno. VMs monitored only through the AWS, Google Cloud, Azure, or vSphere integrations count too, and an instance with the Agent installed counts once.

Hosts that stop reporting, shown as INACTIVE in the Infrastructure List, do not count toward billing, although they can take up to 2 hours to drop out. For Cloud Security, a billable host also includes any instance you protect with agentless scanning.

What Counts as a Container

A container counts toward billing when Datadog monitors it, and Datadog records the number of unique containers every five minutes. Infrastructure Pro includes 5 containers per host license and Enterprise 10, averaged across your entire infrastructure. Additional containers cost $0.002 per container per hour, or $1 per container per month prepaid ($1.50 for DevSecOps containers).

Datadog excludes Kubernetes pause containers and its own Agent containers from the count. One detail changes the bill sharply: if you install the Agent inside each container, Datadog counts every container as a host.

What Counts as a Custom Metric

A custom metric is any metric that does not come from one of Datadog’s more than 1,000 integrations, such as a metric you send through DogStatsD or a custom Agent check. Datadog counts each unique combination of a metric name and its tag values, including the host tag, as one custom metric.

That makes tags the cost driver. In Datadog’s own example, a latency metric tagged by host, endpoint, and status code produces four custom metrics from one metric name. Datadog counts custom metrics hourly and averages them over the month across your whole account. Pro includes 100 per host and Enterprise 200, and extra custom metrics cost $5 per 100 per month on the price list.

Datadog Support Plans and Post-Sales Services

Every Datadog customer gets Standard Support, and Premier Support is a separate purchase. Datadog publishes no price for Premier Support or its post-sales services, so ask for each one as a line in your quote. Datadog’s support terms set these response times:

Premier Support also adds phone consultations, a designated team of support engineers, priority handling for escalations, an environmental run book, and a quarterly support ticket review. Standard Support runs through the support portal, email, and live chat from 10 a.m. to 7 p.m. Eastern time on weekdays.

Datadog’s Services and Enablement program covers four post-sales offerings: Implementation Services, where Datadog architects design and lead your rollout; Technical Enablement Services for training; Premier Support; and Technical Account Management, with a TAM who advises on adoption and optimization.

Datadog’s response times apply to Incidents, which Datadog’s support terms define as a failure of the Datadog service to perform as documented. A Cloud SIEM signal about activity in your own environment is a different kind of incident, and investigating it stays with your team.

How to Optimize Datadog Costs

Datadog’s own billing rules point to the levers that move the bill. Work through these steps before your next renewal:

1. Commit annually for the hosts you run all year, because annual rates are the lowest on Datadog’s price list.
2. Move autoscaling fleets to the hybrid monthly/hourly plan, so host hours above your commitment bill hourly.
3. Run one containerized Agent per host, because an Agent inside every container makes each container a billable host.
4. Remove high-cardinality tags from custom metrics, since each unique tag combination counts as a separate metric.
5. Send Cloud SIEM only the logs you need for detection, because it bills on the logs it analyzes.
6. Keep rarely searched logs in Flex Logs storage, which costs less per million events than standard indexing.
7. Price DevSecOps Pro at $22 per host against Infrastructure Pro and CSM Pro bought separately, at $25 per host combined.
8. Ask for a multi-year or volume discount once you approach the thresholds Datadog lists on its pricing pages.
9. Review hourly usage on the Plan and Usage page each month, so a spike shows up before the invoice.

Remember that a DevSecOps plan has to cover every host, so step 7 only pays off if you want posture management across the whole fleet.

How Can UnderDefense Help You Maximize Datadog Productivity?

Datadog is often the first place your team notices something is wrong: unusual traffic, a spike in failed logins, or a Cloud Security finding on a production cluster. Each Cloud SIEM signal, CSM finding, or Workload Protection alert still needs someone to decide whether it is misconfiguration, a performance issue, or an attacker.

If your security team is small and the signals arrive around the clock, the UnderDefense Agentic AI SOC can take the first pass on the alerts that reach the tools it connects to. It works on top of the SIEM, EDR, cloud, and identity tools you already run, AI agents investigate every alert, and UnderDefense analysts make the response decisions 24/7. In a demo, check which of your Datadog signals reach it through those tools.

Every investigative step is visible and auditable, so you can show your auditors and your board what happened to each alert. Expect detection tuning to your environment to take from a few weeks to a few months, as reviewers report.

Datadog alerts arriving at 2 a.m. with nobody on shift? Book a triage demo

Frequently Asked Questions