Datadog Cloud Security Management: Vulnerability and Misconfiguration Scanning for SOC 2 and ISO 27001

Datadog Cloud Security Management checks hosts, containers, and cloud accounts for software vulnerabilities and insecure settings. It uses the same Agent and cloud connections your team already uses for monitoring. For SOC 2 or ISO 27001, it can support two areas auditors check: finding vulnerabilities and keeping systems securely configured.

We often meet teams that use Datadog every day for metrics, traces, and logs and then start shopping for a vulnerability scanner and a cloud posture tool when the audit requirement arrives. Before that purchase, check what Datadog already covers.

What Datadog Cloud Security Management Includes

Datadog groups four posture and vulnerability capabilities under the Cloud Security Management name:

Workload Protection (runtime threat detection and file integrity monitoring) and Cloud SIEM (log-based detection) are separate products. They address SOC 2 CC7.2 monitoring; see the SOC 2 CC7.2 security monitoring guide and the Datadog Cloud SIEM guide.

Datadog Vulnerability Scanning: Agentless Covers Cloud Accounts, the Agent Covers Hosts That Have It

Datadog vulnerability management offers two scanning methods, and they differ most in which assets they reach.

Agentless coverage follows the cloud account. Datadog scans the hosts, container images, and serverless functions in each connected AWS, Azure, or GCP account, with nothing installed on them. The audit question is whether every in-scope cloud account is connected.

Agent-based coverage follows the Agent. Monitored hosts get scanned through the existing deployment, with no separate scanner or credentialed scan accounts, on-premises included. Hosts without the Agent, such as a legacy database server, a jump host, or a proof-of-concept server, need the Agent or another tool. The audit question is which in-scope hosts are missing the Agent.

Many companies use both: agentless for cloud breadth, the Agent for on-premises servers and hourly, runtime-aware results. Agentless scanning skips hosts that already have the Agent.

One enterprise team we worked with found their vulnerability count wrong in both directions: the scanner reported devices that no longer existed and missed systems still running. The fix was a recurring reconciliation of the asset inventory against scanner coverage. CIS Controls v8.1 lists asset inventory as Control 1, ahead of vulnerability management at Control 7. With Datadog, the reconciliation compares the inventory with connected cloud accounts and the host list.

The SOC 2 CC7.1 vulnerability management guide covers auditor expectations for cadence, severity ratings, and remediation timelines.

Datadog CSPM Checks Cloud Accounts Against Frameworks and Hosts Against CIS Benchmarks

Datadog CSPM evaluates resources against more than 1,000 out-of-the-box rules, each mapped to framework controls. A public S3 bucket, for example, fails the relevant SOC 2 and ISO 27001 controls at once. Supported frameworks include:

• Compliance frameworks: AICPA SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, GDPR, NIST 800-53, NIST 800-171, NIST Cybersecurity Framework, CMMC, FedRAMP Low/Moderate/High, DORA, and NIS2
• Cloud benchmarks: CIS AWS, Azure, and GCP Foundations, plus AWS Foundational Security Best Practices
• Infrastructure benchmarks: CIS Docker, CIS Kubernetes, and CIS benchmarks for Ubuntu 20.04/22.04/24.04, Red Hat 7/8/9, Amazon Linux 2 and 2023, and AlmaLinux 9

Custom frameworks measure compliance against an internal hardening baseline (ISO 27001 A.8.9, configuration management) where it differs from CIS defaults.

Datadog labels each framework by the resources it applies to. SOC 2, ISO 27001, HIPAA, and PCI DSS mappings apply to cloud resources. The CIS Linux, Docker, and Kubernetes benchmarks apply to infrastructure, meaning hosts evaluated by the Agent.

An on-premises Ubuntu server, for example, appears in the CIS Ubuntu benchmark report, apart from the SOC 2 report for an AWS account. In our experience, auditors accept CIS results as configuration evidence when the control narrative maps them to SOC 2 criteria. The configuration baselines guide for bare-metal environments covers how to document that hardening standard.

Turning Datadog Findings Into SOC 2 and ISO 27001 Evidence

Datadog compliance reports show pass and fail counts per control and the top high-severity failures. The findings become audit evidence with three additions:

1. A written policy the findings prove. It sets scan frequency, severity definitions, and remediation timelines (for example, critical internet-facing findings fixed within 14 days).
2. A remediation record. Auditors test fix times, so findings flow into a ticketing system and each ticket closes when its finding clears. The vulnerability and incident SLA ticketing guide covers that workflow.
3. Evidence across the observation period. A SOC 2 Type II audit covers months; one export before fieldwork shows one day. Scheduled exports or a GRC platform integration provide the timeline.

Datadog produces the findings; a GRC platform such as Vanta, Drata, or Secureframe, and the program around it, handles policies, access reviews, vendor risk, and auditor workflow. The overview of what Vanta and Drata leave to the security team covers that boundary.

Datadog Cloud Security Management Pricing and When It Fits

Datadog lists Cloud Security Management Pro at $10 and Enterprise at $25 per host per month on annual billing ($12 and $30 month-to-month). Pro covers misconfigurations, framework mapping, host and container vulnerabilities, and CIEM. Enterprise adds Workload Protection ($15 per host per month standalone). Confirm tier contents on Datadog's pricing page before a rollout.

Datadog Cloud Security Management tends to fit when:

• Datadog already covers most in-scope hosts. The Agent becomes the scanner.
• The environment is mostly AWS, Azure, or GCP. Framework reports and agentless scanning both cover cloud resources.
• Engineers want findings next to operational data. A vulnerable package appears on the host page beside CPU and error rate.

A separate tool may still be needed for:

• External and network-level testing. Customers, PCI DSS, and some auditors expect network scans and penetration tests.
• Devices the Agent doesn't support. Network appliances, storage controllers, and hypervisors typically need a network scanner or a manual version check.

For hybrid environments, the Datadog hybrid cloud security monitoring guide covers which features work on-premises, and the Datadog vs Wazuh vs Nessus scanner comparison covers when to add a network scan. The on-prem vulnerability scanning guide sets out a tiered cadence: weekly for internet-facing and management systems, quarterly for internal systems, annually for low-risk device interfaces.

How to Evaluate Datadog Cloud Security Management in One Week

A company on Datadog can test coverage of its SOC 2 or ISO 27001 scanning controls in about a week of part-time work.

1. List the in-scope systems: cloud accounts, hosts, container registries, and serverless functions.
2. Map each system to a scanning method. Cloud accounts need agentless scanning connected; hosts outside AWS, Azure, and GCP need the Agent. Anything left over needs another tool.
3. Turn on agentless scanning for one cloud account and Agent-based scanning on a representative group of hosts, then review the first findings.
4. Turn on misconfiguration checks (the Agent's compliance_config setting for host CIS benchmarks) and open the SOC 2 or ISO 27001 report for the cloud account.
5. Check the findings against the vulnerability management policy. Match severity ratings to remediation timelines and route findings to ticketing.
6. Assign what stays outside Datadog. External scans, penetration tests, and unsupported devices need an owner and a cadence written into the policy.

Frequently Asked Questions About Datadog Cloud Security Management

Does Datadog do vulnerability scanning?

Yes. Datadog Cloud Security scans hosts, host images, container images, and serverless functions for known vulnerabilities, through agentless scanning in AWS, Azure, and GCP or the Datadog Agent on Linux and Windows hosts.

What is the difference between Datadog agentless and Agent-based scanning?

Agentless scanning covers workloads in connected AWS, Azure, and GCP accounts with nothing installed, every 12 hours. Agent-based scanning covers only hosts with the Datadog Agent, including on-premises servers, every hour, with runtime context.

Does Datadog have CSPM?

Yes. Datadog Cloud Security Posture Management evaluates cloud resources against more than 1,000 out-of-the-box rules mapped to frameworks such as SOC 2, ISO 27001, PCI DSS, HIPAA, and the CIS cloud benchmarks.

Can Datadog scan on-premises servers for vulnerabilities?

Yes, with the Datadog Agent on Linux and Windows hosts. Agentless scanning is limited to AWS, Azure, and GCP.

Is Datadog enough for SOC 2 vulnerability management?

Datadog can cover the internal scanning part of SOC 2 CC7.1 for connected cloud accounts and hosts with the Agent. A complete program also needs a written policy, remediation tracking, coverage for remaining assets, and usually external scans and a penetration test.

Does Datadog replace Vanta or Drata?

Datadog works alongside them. Datadog finds vulnerabilities and misconfigurations; GRC platforms such as Vanta, Drata, and Secureframe manage policies, evidence, access reviews, vendor risk, and auditor workflow.

Datadog May Already Cover Your SOC 2 Scanning Controls

For many companies on Datadog, scanning tooling is already deployed. Turning it into audit evidence takes a policy, a remediation workflow, and a coverage check. The SOC 2 consulting for Datadog users page covers how Truvo Cyber builds that program alongside Datadog and your GRC platform.