Instead of blocking generative AI tools, Datadog's CISO proactively provided ChatGPT licenses to every employee. This approach avoids the 'all oops moment' of employees using unapproved tools with personal accounts, which creates shadow IT. By providing an official, governed solution with data retention controls, the company enables innovation while managing risk.
Datadog's security team created a custom AI tool that evaluates the *intent* of code (e.g., is it meant to do harm?), rather than just scanning for known vulnerabilities. This 'judge' helps secure the software supply chain by vetting third-party code contributions, IDE extensions, skills for AI agents, and even markdown files.
To mitigate risks from AI coding agents, Datadog sandboxes them and prevents direct access to credential files. Instead of reading static tokens, the agent calls a tool that injects ephemeral, just-in-time credentials when needed for tasks like authenticating to GitHub. This drastically reduces the risk of credential theft.
Experienced CISOs are less concerned about AI models 'going wild' and becoming malicious hackers. The more practical and immediate problem is that AI will dramatically increase the volume of vulnerabilities discovered in codebases. Security teams will be overwhelmed not by sophisticated AI attacks, but by the sheer quantity of legitimate issues to triage and fix.
AI tools with natural language interfaces flatten organizations by giving non-technical staff, like sales reps, the power to perform complex data queries previously limited to SQL experts. This can inadvertently bypass poorly configured access controls, revealing sensitive data and forcing companies to re-evaluate their permissioning models for the AI era.
The friction between developers and security isn't due to developers' apathy. The issue is that security teams often provide 'crappy' tools that generate thousands of irrelevant alerts without context. Developers have always cared about security, but they resist processes that are inefficient and don't align with their workflows.