Datadog Code Security (IAST)

Datadog Code Security provides runtime code analysis (IAST ) that detects vulnerabilities in running applications using the same tracing libraries that power Datadog APM. It supports Java, .NET, Python, and Node.js.

The tool achieves 100% on the OWASP Benchmark with over twenty additional detection rules. Because it reuses your existing Datadog tracing setup, enabling IAST is a configuration flag away — no new agent to deploy.

Datadog IAST is part of the broader Code Security suite alongside Static Code Analysis (SAST), Software Composition Analysis (SCA), Infrastructure as Code security, and Secret Scanning.

What is Datadog Code Security (IAST)?

Datadog’s IAST monitors live applications by tracking how data flows through code at runtime. It instruments applications through the same tracing libraries used for APM.

As requests move through your application, the tracer monitors data sources (user input, external APIs) and sinks (database queries, file operations, system commands).

When untrusted data reaches a sink without proper validation, Datadog flags the vulnerability with the exact code location and data flow.

What are Datadog Code Security (IAST)’s key features?

Runtime Vulnerability Detection

IAST detects vulnerabilities that need runtime context to identify. For each finding, Datadog provides the specific file name, method name, and line number where the vulnerability exists, plus the complete data flow from source to sink.

Detected vulnerability types include:

• SQL Injection — tracks user input through string concatenation to database queries
• Command Injection — identifies external input reaching system command execution
• Path Traversal — detects unsanitized input in file system operations
• LDAP Injection — monitors input flowing to directory service queries
• XSS — tracks data from input to output rendering
• Insecure Deserialization — identifies dangerous deserialization of untrusted data

Code-Level Remediation

When a vulnerability is found, Datadog shows the affected file, method, and line number along with remediation guidance specific to your framework. You can view the vulnerable code directly in Datadog if you connect your GitHub repositories.

GitHub integration adds:

• Direct links to vulnerable code in your repository
• Git blame information showing who introduced the vulnerability
• The specific commit that introduced the issue
• One-click issue creation in the relevant repository
• Code owner identification

Severity Scoring

Datadog uses its own Severity Score that goes beyond static CVSS ratings. It factors in:

• Whether the vulnerable service is running in production
• Real-time threat activity and exploit availability
• The environment context (dev, staging, production)
• The relationship between vulnerable services, cloud workloads, and infrastructure

Hdiv lineage and single env-var deployment

The runtime dataflow engine that powers Datadog IAST traces back to Hdiv Detection , the Spanish IAST vendor Datadog acquired in May 2022. Hdiv’s source-to-sink taint tracking became the basis for Datadog’s runtime code analysis after a roughly 18-month integration into the existing APM tracing libraries. That lineage matters because it explains why IAST in Datadog is a tracer feature, not a separate agent — the work to instrument Java, .NET, Node.js, and Python runtimes was already done for performance monitoring.

Enabling IAST is a single environment variable: DD_IAST_ENABLED=true plus a compatible tracer version. There is no second agent to install, no separate console to wire up, and no extra Datadog Agent flag beyond the version requirement (7.41.1+). Findings appear in the same Datadog UI as APM traces, infrastructure metrics, and Application Security Management (ASM, the RASP-equivalent runtime defense product) alerts. The single-pane integration is the moat — for teams already paying Datadog, the marginal cost of turning on IAST is configuration, not deployment.

How do I get started with Datadog Code Security (IAST)?

When to Use Datadog Code Security (IAST)

Datadog IAST is the natural pick if you already run Datadog APM. Enabling it takes one environment variable, and findings show up alongside the performance and reliability data your team already monitors.

The 100% OWASP Benchmark accuracy means findings need investigation, not triage of false positives.

Consider alternatives if your applications use languages Datadog doesn’t support for IAST, or if you prefer standalone security tools not tied to an observability platform. Contrast Assess covers more languages (Java, .NET, Node.js, Python, Go, Ruby). Seeker IAST adds active verification and supports 14+ languages.

Datadog IAST alternatives

Datadog IAST is the natural pick if Datadog APM is already in the stack. For everyone else, three alternatives cover the most common buyer profiles.

• Pre-prod focus with the deepest QA workflow integration. Contrast Assess is the closest passive-IAST competitor. Where Datadog leans on its tracer install and APM correlation, Contrast leans on its always-on agent that runs alongside existing functional tests and offers a direct upgrade path to Contrast Protect (RASP) in production.
• Wider language coverage. Seeker IAST , now part of Black Duck Software after the late-2024 Synopsys spin-off, supports 10+ languages — including Groovy and JVM-side Scala/Kotlin — and adds active verification that confirms each finding is exploitable before reporting.
• Java enterprise hot-attach. HCL AppScan IAST attaches to JVM apps without a redeploy and is the regulated-industry pick for shops already running HCL SAST and DAST.
• DAST+IAST hybrid for non-Datadog stacks. Invicti Shark is the IAST sensor inside Invicti’s DAST scanner — a different shape than standalone IAST, useful if proof-based DAST findings are the headline need.

For a side-by-side, see Contrast Security alternatives and the IAST tools hub.

Frequently Asked Questions