Datadog AI Guard
Product · SaaS / cloud software · Finance & accounting by Datadog
Scale AI agents without scaling risk
Datadog AI Guard is a runtime security platform that protects AI agents by blocking prompt injections and masking sensitive data in real-time. It provides businesses with inline threat prevention and automated agent discovery to scale AI operations safely.
- Languages
- English
Category: Cloud Security
- Deployment
- Cloud-based inline proxy or SDK-based integration
- APIs and SDKs
- Datadog SDK and tracer integration for enforcement
- Limits
- Redacts 400+ types of secrets and credentials
- Secret Types Masked
- 400+
- Deployment Method
- Inline / SDK-based
- Framework Support
- Any model provider and framework
- Inline protection against prompt injection and tool misuse
- Redacts 400+ types of secrets and credentials in real time
- Maps protections to OWASP Agentic Top 10 and MITRE ATLAS
- One-click enforcement using existing Datadog tracers
Overview
Datadog AI Guard is a runtime security solution designed for businesses to scale AI agents safely in production. It operates as an inline proxy between orchestrators and Large Language Models (LLMs), intercepting interactions in real-time to prevent threats such as prompt injection, tool misuse, and data exfiltration. The platform provides automated discovery of agents and maps them to connected services and datastores without requiring code changes for those already using Datadog tracers. AI Guard features sensitive data masking for over 400 types of secrets and credentials, including PII and financial data. It allows security teams to set custom policies, simulate them against real data, and export audit evidence for compliance. By unifying security and observability, it enables teams to investigate blocked calls within their full application traces.
Runtime Security
- Inline Protection: The platform sits inline between orchestrators and LLMs to intercept and block harmful actions in real time.
- Threat Prevention: AI Guard prevents prompt injection, tool misuse, data exfiltration, and other runtime threats.
- Customizable Thresholds: Users can set sensitivity thresholds per environment and service to flag threats based on confidence scores.
- Behavioral Analysis: The system evaluates each action against the agent's behavioral baseline and session history to catch slow-build attacks.
Data Protection & Governance
- Sensitive Data Masking: AI Guard redacts over 400 types of secrets and credentials, including email addresses, phone numbers, and API keys.
- Data Classification: The tool identifies PII and financial data moving through prompts, responses, tool calls, and tool results.
- Framework Mapping: The system maps protections to the OWASP Agentic Top 10 and MITRE ATLAS frameworks.
Operations & Response
- Policy Simulator: Users can preview the verdict of any policy change in the Policy Simulator before it reaches production.
- Audit Evidence: The platform exports audit records, including evaluation details and access logs for every verdict.
- Prioritized Signaling: Signals are tagged by severity, attack categories, and tools involved for prioritized triage.
- One-Click Enforcement: Enforcement can be turned on with a single click using the existing Datadog tracer.
Use cases
- Security teams block prompt injection and tool misuse inline to prevent agents from taking unsafe actions.
- Developers mask PII and credentials in model prompts and responses to maintain data privacy.
- Compliance officers export audit evidence of agent sessions to demonstrate adherence to security policies.
- Platform engineers discover unauthorized AI applications operating outside of approved infrastructure.
Specifications
- Deployment
- Cloud-based inline proxy or SDK-based integration
- Platforms
- Web-based dashboard with support for any model provider and framework
- Integrations
- AI Gateways, Cloud SIEM, Jira, SOAR workflows, and third-party SIEMs
- APIs and SDKs
- Datadog SDK and tracer integration for enforcement
- Limits
- Redacts 400+ types of secrets and credentials
- Secret Types Masked
- 400+
- Deployment Method
- Inline / SDK-based
- Framework Support
- Any model provider and framework
- Security Mappings
- OWASP Agentic Top 10, MITRE ATLAS
How it works
- Discover Agents: The system automatically identifies AI applications and agents operating in the environment using the Datadog tracer.
- Configure Policies: Users define global or per-service policies for tool use, sensitive data management, and threat thresholds.
- Simulate and Validate: The Policy Simulator is used to test rules against real prompts and tool calls to ensure accuracy.
- Enforce in Real-Time: AI Guard sits inline to intercept interactions, blocking unsafe actions and masking sensitive data mid-loop.
FAQ
What types of sensitive data can AI Guard mask?
It redacts over 400 types of secrets and credentials, including email addresses, phone numbers, banking data, and API keys.
Can I test security policies before deploying them?
Yes, the Policy Simulator allows you to preview AI Guard’s verdict on any policy change before it reaches production.
Added by AntSpace from public sources (datadoghq.com).