Black Hat USA 2026 | Emilio Escobar, Datadog

Clips
More from Black Hat USA 2026

Emilio Escobar

CISO

Datadog

play_circle_outline Unified Production Telemetry: Bridging Security and Engineering for Prioritization and Troubleshooting

play_circle_outline Prioritizing vulnerabilities using business context and exposure

play_circle_outline Agentic AI with Stratus: Detecting Data Drift, Validating Rules, and Automating Triage and Remediation

play_circle_outline Next Year: Unifying Security and Engineering with Telemetry-Driven Threat Hunting and Retrospective Investigations

Info
Transcript

Emilio Escobar, Datadog

Emilio Escobar

CISO Datadog

In this interview from Black Hat 2026, Emilio Escobar, chief information security officer of Datadog, joins theCUBE's Krista Case to discuss why security and engineering teams must break down silos and share unified production context to keep pace with AI-driven attacks. Escobar explains that security and engineering historically operate on different data sets, leading to duplicated investigations when, for example, a crypto miner drains CPU resources. He details how shared runtime visibility lets both teams see the same incident through different lenses — ri... Read more

explore Keep Exploring

How has thinking changed specifically regarding the role that production data should play in security decision-making? add

How can security teams effectively prioritize vulnerabilities beyond just their rated severity? add

How should security teams prepare for evolving cloud attack vectors and ensure their detection rules and coverage remain effective—what practices and tools are needed now and over the next 12–24 months? add

What progress is expected over the next 12 months in enabling engineering and security to work more closely together? add

bolt Powered by CUBE AI

Emilio Escobar, Datadog

search

Krista Case

>> Welcome back to theCUBE. We are live here at Black Hat 2026, rolling through the afternoon. We've been talking a lot about how security teams need to compress their time to investigate, prioritize, and respond to vulnerabilities and alerts as adversaries are using AI. And part of that conversation is the fact that security and engineering can no longer operate in silos. We need to make sure that the pace of software delivery, the fact that that's increasing, and that security teams have the insights into what's happening in production to be able to make those decisions appropriately. They need that context from runtime to be able to troubleshoot applications while engineering teams need security insights that they can act on without slowing development. I have the pleasure of sitting down here with Emilio Escobar, who's the CISO of Datadog, to talk about this. Emilio, welcome to theCUBE. Thanks for joining us today.

Emilio Escobar

>> Thanks for having me.

Krista Case

>> Absolutely. So, Emilio, you have a really interesting vantage point. You're a practitioner, now a CISO, and you work for a company that's really built around operational telemetry. Can you talk about how your thinking has changed specifically when it comes to the role that production data should play in security decisions?

Emilio Escobar

>> Yeah, absolutely. So at Datadog, we think of it as it has to be a unified context for both teams, right? So historically you've had security operating with a different set of data. Most security teams normally don't understand the production environment while the engineering team or IT teams do. So security normally will see something, they would ask the engineering team to go fix something and the engineering team is saying, "But that's not even, we're not seeing this, like where are you getting this?" So, at Datadog, that's how we thought about it and how we got into security is if both people, both teams can see the same data, but from a different lens, 'cause a security person is looking more at threats and attacks and risk while an engineer is probably looking more at functionality, reliability, utilization. But if they're both looking at the same set of data, they can solve the problems faster. So, some examples there are a security team will see a threat happening on a server but they're looking at it from what actual attack happened there. What an engineering team is looking at it from is like, why is my CPU now being overutilized? What's going on there? So imagine that happening at a scale where both teams are now trying to solve what may seem as two separate problems, but the root cause of it is one thing. So say, oh, a crypto miner dropped on a server, it's taking up all the CPU, but that's actually impacting a customer experience upstream somewhere. This side is gonna focus on why do we not have enough resources to support the checkout function while security is thinking why, how did we get a crypto miner deployed? So imagine that and how much time gets spent to try to solve those two things independently when if they see the same data, they're like, oh, we know exactly what happened and within minutes you can just solve that as a problem in itself. So that's a basic example that kind of mimics, or explains why both data worlds make sense together.

Krista Case

>> Absolutely. So as you mentioned, Emilio, it's a different lens on the same piece of data. Now, operationally speaking for security and IT, once they have this visibility and context, I guess the question is operationally, what are the next steps? Do they need to collaborate together to solve it? What are the next steps for them to take once they have that insight to be able to address the risk?

Emilio Escobar

>> Yeah, so I think an inherent benefit of it is that they get to collaborate better. Because a lot of the friction that happens normally between security and the other team is, well, you're asking me to do work, a lot of noisy work that I don't understand, or simply I don't see it. So that creates a lot of friction and a lot of siloing. So by the fact of working on the same dataset makes the collaboration much better. So yes, that's needed after, but I think it's just an inherent benefit of it where you don't have to force it. Yeah, we've seen it happen naturally and organically with our customers and even internally for ourselves as well, where it just drives that collaboration better. So it's just a benefit of having access to the same data.

Krista Case

>> Sure, so they can work together, they can move faster like you say, Emilio. Another kind of macro level problem that we're seeing though is the fact that it's difficult to prioritize risk these days, and because of the pace that adversaries are moving at, we need to be able to prioritize that risk through the lens of kind of that business context. So especially given your role as a CISO, I'm sure you have some commentary firsthand on that, but can you talk through maybe why that's a challenge and how in your role in particular you're thinking about, being able to understand, how to prioritize those risks?

Emilio Escobar

>> Yeah, so we all know security teams have a very large backlog of items, say vulnerabilities that their scanners are finding in their environment, I believe that every security team understands that not every vulnerability should be treated the same.

Krista Case

>> Mm-hmm

Emilio Escobar

>> . However, where I think security teams lack is the context and the visibility to be able to understand why is one more important than the other.

Emilio Escobar

>> Mm-hmm.

Emilio Escobar

>> Other than just the rating and severity of the vulnerability. But for example, a vulnerability on a critical business function in a piece of infrastructure that is exposed to the internet and there is an exploit available for that vulnerability should probably take higher priority than a vulnerability way down in the infrastructure that has no exploit available. But for an attacker to get down they have to break through like 20 layers of security to get there. So those two things should be handled differently. Right now the problem is without the context or the joint context or data is that these two things are seen as equal. And then as we just discussed, imagine telling an engineering team, go patch these two things. And they're gonna be like, "Well, how come this one is more important than the feature I'm working on right now?"

Krista Case

>> AbsolutelyAnd I wanna put a pin in that and come back to it in just a second, but I wanted to make the connection that understanding what's happening in production is very important to understanding that risk, I think is what you're saying here.

Emilio Escobar

>> Yeah, exactly. Yeah, because we do see the production data, we understand whether something is taking traffic, is exposed to the internet, is it actually even being attacked at the moment? Because we get to see what's happening within the application, the infrastructure, or even the database itself.

Krista Case

>> Absolutely. And so we talked about prioritizing these detections. I also wanna talk about validating detections before an incident occurs. Should organizations be testing their detections and their responses to make sure they actually work? we're seeing that that's very important that we need to be prepared, But I'd love to get your take, especially given that you're living and breathing this.

Emilio Escobar

>> YeahNo, so absolutely. So we, a team, a security team, a security team's intellectual property is their set of rules, their set of detection rules that is supposed to tell them or alert them when something bad or questionable is happening. These rules can expand and grow with time. And some of them become stale, some of them become irrelevant, or some of them just stop working because say a data source changed and the field that this rule was looking for no longer exists. So I think the ability for security teams to be able to test the rules and the coverage of detection that they have is extremely important, which is why we actually contribute and have an open source project that is Stratus, that it's meant to mimic cloud attacks or attacks in cloud environments.

Krista Case

>> Okay

Emilio Escobar

>> . That— so you can actually test your rules that you have for detecting attacks in your cloud infrastructure. You can run these scripts or this tool and then you can say, okay, I ran this scenario, did this rule fire? And it's a problem that my teams have had historically where we don't know which rules are working or not. We don't know if we actually cover all the attack scenarios that are possible, which is another problem where you might have rules that you don't have, but you don't know of it, right? So it's like the lack of or the ineffectiveness of. So, continuously testing these things is very important. Yeah.

Krista Case

>> Well, and I'm sure, Emilio, that especially the pace at which these attack vectors are going to change with AI, it's going to become even more difficult to know that you have all of these attack vectors covered. Can you talk about what that looks like maybe over the next 12 to 24 months?

Emilio Escobar

>> So I think the way that we're seeing it is the future, or the— we say the future, but it's actually the present— is all of this can be very taxing. So the way that we see it is in the very near future is an agentic way of being able to actually test for this coverage, understand that, or give teams that ability to— you created a new rule, how do you actually know it's going to work? Or that drift detection that I mentioned of, for example, in a Datadog platform, because we see the data coming in, we can actually tell you, hey, by the way, this data format changed. Okay. That rule is no longer gonna work. So that's something that people can expect in the future where these capabilities are gonna have to be a must-have for them to be able to keep up with the scale and understand how they actually make sure they're covering all their environment.

Krista Case

>> Yeah, no, that makes sense, Emilio. And I'm curious, building on that, where do you think the biggest gaps in visibility exist in customers' environments these days?

Emilio Escobar

>> I think the biggest gap that we see is when these two worlds are separate. So it's going back to that topic, but that's the biggest gap that we normally see where the benefit of me being at Datadog is I actually get to talk to security teams, but I also get to talk to engineering teams. So I get to hear the pain points they both feel. And at the end of the day, it all points to we're just two separate worlds right now and they all want to do the right thing. And the intent is there. It's just that they're not using the same data platform or the same context to make decisions. And that usually is the biggest gap that we see.

Krista Case

>> Are those walls starting to break down a little bit? Are you seeing any progress on those two, engineering and security, working together? Excuse me, engineering and security. Right.

Emilio Escobar

>> Yeah, we do see it. Yeah, I think it's been recognized that what we've been trying to do for the last 20-plus years, it's worked to some extent. But as you said, now in the day and age where a vulnerability to exploit takes about 12 minutes, I believe I read a couple days ago. The need to be able to move faster and protect businesses is there, but also as everything needs to be accelerated because market demand is there, the need to move faster just because of that is there. So I think we're starting to see that breakdown happening when people are starting to realize what we're both trying to do— we both have the same goal, How can we just get together and work on it?

Krista Case

>> And Emilio, what level of progress do you think we're gonna make in that over the next 12 months in terms of allowing engineering and security to work more closely together?

Emilio Escobar

>> I think we're gonna continue down the path that we've been on, A, keep the message going, but also delivering that, continue to work on the platform that makes that connection a whole lot easier. In a way that makes sense, it's easy to use, giving teams the, here are the things that you really need to worry about, here's the backlog of things that maybe you should get to eventually, and here's the things that we don't think are actually malicious in your environment with a combination of a better use of the data, agentic triaging, agentic evaluations, investigations, while also then using that rich context to then be able to hunt for threats as well. Because one thing is good to understand what's happening in your environment right now, but say a new threat comes in, it'll be good to go back and understand has this actually happened in your environment before? So I think all of that is what people should expect from us that are gonna help break down the silos so that when we go to an engineering team and say, hey, we really think this is an issue that we have to work on, it's self-explanatory for why are we coming to them rather than it's coming out of nowhere. Going back to what we just discussed, we don't see it. So that's how we're thinking about making it simpler for both worlds and continue to expand on those.

Krista Case

>> Yeah, and the easier you can make it for them to collaborate, the more it's going to nurture that for sure. Absolutely. So Emilio, we've talked a lot about different pieces of context, right? Especially looking at that production data. Is there maybe one key piece of context, across the environment that you think, given that we're here at Black Hat, I'll ask through the lens of security teams, is there a key piece of context that you think security teams are missing today beyond the more broad discussion about production environments?

Emilio Escobar

>> I think a key piece of information that I think most security teams are missing is that deep runtime information. So a lot of security tooling is more at the surface level, either at the attack surface, so from an outside in, or mostly scan at an infrastructure level. But having an understanding of what's actually happening in there in the application or the runtime of where these applications are running is, I think, a key piece of information that teams are missing. But I don't mean in having that information in a way of just protect it. It's information to understand what's actually happening.

Krista Case

>> Right. And that's what makes it actionable at the end of the day, that context in terms of what's happening. Absolutely.

Emilio Escobar

>> Absolutely. Yeah.

Krista Case

>> So Emilio, maybe a final question, especially given your role as a CISO. As you've maybe walked the show floor, if you've had a minute, or just some of the conversations that you've had here at Black Hat this week. Is there anything that has sort of surprised you or anything that you think is particularly impactful, especially given the context of how AI is really upending this industry?

Emilio Escobar

>> Yeah. So I haven't had the chance to walk the floor.

Krista Case

>> Me either. Don't feel bad

Emilio Escobar

>> . But I've been having conversations with prospects and customers all week and other members of the community. I think the main message that I get, especially in the day and age of Agentic AI is, and what we're actually also offering to our customers is how can you do more with what you have? So the right agents for the right use cases, really actually helping them close the loop, as we say at Datadog, help close the loop, which is like remediate problems rather than just telling you all the problems you have. But everyone knows that finding talent is extremely hard. Everyone wants to really explore with AI, but at the end of the day how can we actually— how can it help us do more with what we have?

Krista Case

>> I agree, Emilio. I'm trying to really dig into what's just kind of AI-washed and what's actually kind of meeting the needs in terms of what folks like yourself are really struggling with that can actually move the needle.

Emilio Escobar

>> So agentic investigations, Agentic triaging, agentic remediation, threat hunting in an agentic way. These are things that I was actually quite surprised to see this week in my conversations where the aha moment is happening in the security teams of like, oh, actually this isn't just for a software developer. We can actually make use of this or even creating your own agents as well.

Krista Case

>> Yeah.

Emilio Escobar

>> Are things that I've been talking to people about, and it's really resonating. But it goes back to I have a team, my team is my team. How can we actually do more with what I

Krista Case

>> have?Yeah, absolutely. Yeah. I think their eyes are open that there's some— a lot of potential here in terms of using these AI tools as long as we're pretty cautious in how we learn to trust them and operate them.

Emilio Escobar

>> Exactly. Yeah.

Krista Case

>> Yeah. Well, Emilio, it's been a pleasure. We really appreciate you sitting down with us

Emilio Escobar

>> today.Thank you. Yeah, no problem. Thank

Krista Case

>> you.Absolutely. And thanks for joining. We'll be right back in just a few minutes with more coverage. Live here from Black Hat 2026.