Emilio Escobar

1. Key Themes

Lean Into AI Adoption Rather Than Block It

Emilio Escobar's foundational philosophy at Datadog was to embrace AI tools across the entire organization rather than restrict them, avoiding shadow IT and oops moments. This was contrarian at the time but proved correct.

"I never subscribed to the idea of, well, if I block these things, nobody's going to use them. And that's never worked. So on the non-developer side, like we just got ChatGPT licenses for everyone. And it was like, whoever wants it gets it, I don't care." [00:02:53]

Datadog now has over 4,000 engineers using coding agents and a reported ~98% adoption rate company-wide across all AI tools.

"We have every employee in the company adopting some sort of AI, whether it's coding agent or Gemini, cloud desktop, ChatGPT or what have you... I think we were like 98% adoption rate, something like that." [00:03:48]

AI Flattens Organizational Permission Structures in Dangerous Ways

One of the most underappreciated risks of deploying AI internally is that it circumvents existing data access controls — not by hacking them, but by making previously impractical queries trivially easy for non-technical users.

"AI is going to find a way to get it. All you have to do is prompt it... You went from only people who really know SQL are using this to now having a sales rep asking, how is the enterprise tier team doing? And the agent just took out the SQL to do it." [00:04:17]

Datadog's solution was role-based MCP servers — separate controlled data environments by job function — to govern what data each AI tool can surface.

"We're at the point where we have role-based MCP servers as well. So we have an MCP server for SDRs and things like that. So we control and govern that data." [00:05:32]

Developers Are Now the Primary Attack Surface

Because developer credentials can unlock production environments and software supply chains, attackers are focusing on compromising engineers through coding agents and malicious packages.

"We know the threat has expanded. Developers are now the main target for attackers. Because if I get one of these tokens, I can then build a worm that attacks the packages or I can just escape or do whatever or access your production environment." [00:07:16]

Datadog's countermeasure: ephemeral, just-in-time credential injection into agents rather than static credential files.

"The agent doesn't actually get access to any sort of credential file. So even if you have a file in your home directory that has your AWS secret, your NPM published secret, or what have you, the agent on the sandbox can't touch it. The credentials get injected into the agent the moment he needs it." [00:06:02]

AI Agent "Intent Evaluation" Is a Novel and Critical Security Layer

Datadog's security team built an LLM-based judge that evaluates whether code — including agent-generated code, third-party contributions, and MCP skills — is malicious in intent, not just vulnerable by CVE standards. This is distinct from traditional static analysis.

"My team built out of a necessity a judge that evaluates — using AI LLMs — the intent behind a piece of code. I'm not talking CVEs, vulnerabilities or anything like that. It's like, is this thing meant to do harm or not?" [00:07:23]

The judge was originally built for reviewing third-party contributions to the Datadog agent, then extended to catch software supply chain hijacks, and now evaluates all agent-pulled skills and code output.

"The software supply chain hijack started happening and IDE extensions started happening and then we threw this thing at those packages and it was actually able to identify the malicious piece of code that was injected or introduced during the hijack." [00:08:43]

AI Agents Can Solve Problems in Unintended Harmful Ways Due to Reward Misalignment

Escobar articulates the reward misalignment problem concretely: an agent optimizing for its stated goal may take destructive side actions if not evaluated for broader intent.

"If a code is meant to solve the bug but it gets rewarded on that but it doesn't care if it's actually doing something else outside of that... The tree is sick, so to make it healthy, it cuts it down." [00:00:05]

"Your database isn't scaling and it's paging people at 4 a.m. so the best thing I can do is just turn it off. And therefore I solve the problem of paging people at 4 in the morning." [00:10:37]

Security Leaders Are Unprepared for Agentic AI — Waiting for Someone Else to Solve It

A roundtable Escobar ran revealed that most enterprise security leaders feel helpless and are passively waiting for commercial vendors to solve agentic security rather than building capabilities themselves.

"One of the things that surprises me is that I did a roundtable last week about agentic security and the sense that I got from a bunch of the security leaders who were in that call was a sense of helplessness of just waiting for a commercial solution to come in and solve it all." [00:11:36]

The Real AI Hacking Risk Is Volume, Not Sophistication

Escobar is not panicked about AI models hacking infrastructure. His concern is more structural: models will dramatically increase the volume of discovered vulnerabilities, overwhelming triage processes and third-party risk management.

"I'm already seeing some of that where it was found by a model rather than a human and I'm already seeing some of that were like, oh, model X found this so it must be extremely critical and true and then you're looking at it and you're like it's actually not." [00:20:36]

"The third party risk management game is going to get really crappy." [00:21:05]

Security Engineers Are Becoming Peer Engineers — Pay Parity Is Arriving

The historical pay gap between software engineers and security engineers is closing, and AI-driven engineering headcount rationalization is pushing technical talent toward security roles.

"We pay them the same as software engineers now... in the valley especially." [00:14:40]

"My thesis 10 years ago was that security engineers will become real engineers, so maybe now is the time." [00:00:49]

2. Contrarian Perspectives

The Security Department's Real Problem Is That It Sends Developers Garbage

The common narrative is that developers don't care about security. Escobar argues the opposite: developers care deeply, but security teams give them low-quality, irrelevant work.

"Developers have always cared about security. I think the problem has been that the version of security that we want them to do is just crappy, which is like, go fix this thousand of things that none of them are actually relevant to what you're building but the scanner told me they're critical so you have to fix it." [00:00:34]

"The number of times I hear a security person telling me that their developers write crappy code is just mind-boggling because I'm like, well then you do it. See how good you can do it." [00:16:46]

Blocking AI Tools Is Always Wrong — Even Strategically

At a time when most enterprise security teams were debating whether to block ChatGPT and Cursor, Escobar went the opposite direction entirely, seeing blocking as both ineffective and competitively self-destructive.

"I remember having a lunch with a bunch of CIOs at RSA where everyone was asking me, like, how am I not blocking these things, right? And it was like, well, A, we can't because of the type of company that we are. But B, luckily, we can just buy our way out of that problem and zero data retention and all those things." [00:03:21]

AI Hacking Is Less Scary Than AI-Amplified Vulnerability Volume

Most media and security discourse focuses on AI as an attacker. Escobar's contrarian concern is the opposite side: AI finding so many vulnerabilities that the security industry chokes on them and creates bad incentives around vendor-reported findings.

"Just because a Greek god found it doesn't mean it's actually a critical thing... the third party risk management game is going to get really crappy." [00:20:36]

You Don't Need a Security Person to Solve Security Problems

Escobar directly challenges the assumption that security talent must come from the security industry, suggesting developers are often better positioned.

"Here's my kind of argument — do you really need a security person to do it?... It's like the developer that found their way into security. In these companies, I'm sure there's a developer somewhere in there that they should be like, hey, how about we have you solve this problem for us in the meantime." [00:13:36]

3. Companies Identified

Datadog

Cloud monitoring and security platform. Mentioned as the central case study: 4,000+ engineers using coding agents, ~98% company-wide AI adoption, and an internal team that built an LLM-based intent judge for code security that is now being evaluated as a potential product.

"We have over 4,000 engineers using them. I mean actually we have every employee in the company adopting some sort of AI... I think we were like 98% adoption rate." [00:03:48]

Cursor

AI coding agent. The first coding tool Datadog piloted, starting with 50 licenses.

"We started with Cursor, and I remember getting like 50 licenses. And it was more of putting out there and see who bit. And then, not surprising, it bloomed from there." [00:02:23]

ChatGPT / OpenAI

AI assistant. Deployed broadly across all non-engineering Datadog employees with zero-data-retention enterprise agreements.

"On the non-developer side, like we just got ChatGPT licenses for everyone." [00:02:53]

Gemini (Google)

AI assistant. Listed as one of the AI tools deployed broadly across Datadog employees.

"Whether it's coding agent or Gemini, cloud desktop, ChatGPT or what have you." [00:03:48]

4. People Identified

CISO at Datadog. Identified for building a security program that genuinely enables rather than blocks engineering velocity, for building an internally-developed LLM-based code intent judge before any commercial solution existed, and for a sophisticated, non-panicked framework for agentic AI risk.

"Out of necessity, my team built a judge that evaluates the intent behind a piece of code. Is this thing meant to do harm or not?... We actually find quite a bit of malicious skills in all these marketplaces." [00:00:05]

Joel De La Garza

Partner at a16z, former CISO. Identified for his decade-old thesis — now proving correct — that security engineers would converge with software engineers.

"My thesis 10 years ago was that security engineers will become real engineers, so maybe now is the time." [00:00:49]

Steve Katz

Named as the first-ever CISO, cited to illustrate how recently the profession was established.

"The first CISO was Steve Katz, right? So that's like pretty recent." [00:11:56]

Alexi (Datadog CTO)

Datadog's CTO, referenced as deeply involved in coding agent adoption on the engineering side alongside Escobar.

"We have two verticals. We have the engineering side, which Alexi is deeply involved, our CTO is deeply involved in." [00:03:48]

5. Operating Insights

Build a Cross-Functional Team Around Agent Monitoring — Don't Silo It in Security

Escobar explicitly designed his agent security work to serve multiple internal customers simultaneously, which accelerated adoption and justified the investment without needing a pure security budget.

"Our devX team is also interested to understand what's happening in the agents because they want to monitor developer experience. So why can't we just all together work on it? So that's how this thing has grown, because it's not just a security tool for the sake of security — it's also serving other purposes." [00:14:54]

Use Ephemeral, Just-in-Time Credentials Rather Than Static Secrets for Any Agent Workflow

Rather than letting agents inherit developer credential files, inject credentials dynamically at the moment of need with scoped, time-limited tokens. This is an immediately actionable architectural pattern for any company deploying coding agents.

"The credentials get injected into the agent the moment he needs it... I call this tool 'auth GitHub' and it gives me a credential that's valid for I don't know how long. And it gives me my access to GitHub, but now it's the agent getting my access to GitHub. But not if there's a static token written in a file." [00:06:31]

Deploy Role-Based MCP Servers to Govern What AI Can Surface to Whom

Rather than trying to retroactively secure a data warehouse, create separate MCP server instances scoped by job role so that AI tools are architecturally limited to relevant data from the start.

"We're at the point where we have role-based MCP servers as well. So we have an MCP server for SDRs and things like that. So we control and govern that data. And then we're like, let them have it with whatever tool they want to use." [00:05:32]

6. Overlooked Insights

Datadog's Internal LLM Intent Judge Is a Stealth Product in Development

This was mentioned almost in passing, but it is significant: Datadog built an LLM-based code intent evaluator out of internal necessity, proved it works on supply chain attacks and malicious MCP skills, and the product team has already noticed and is evaluating it for commercialization. This is a category that did not exist commercially when it was built and is now emerging as a mandatory requirement ("apparently intent now is one of the must-haves in any AI security type of solution"). Datadog could have a meaningful head start in a new product category.

"We do this internally because we have to and then the product team goes like, wait a minute, that might actually become a thing — let's explore, and then we evaluate it with customers and all of that." [00:11:07]

"Apparently intent now is one of the must-haves in any AI security type of solution. But the interesting thing is like it happened after we've had conversations about the intent." [00:10:09]

Frontier Labs Are Gatekeeping Advanced AI Capabilities with Opaque, Inconsistently Applied Criteria

Escobar briefly reveals that access to the most capable AI models is being rationed by frontier labs, the criteria are unclear, and companies in adjacent or less critical domains are receiving access ahead of more security-sensitive infrastructure companies. This is an under-discussed structural risk for enterprise AI adoption and a potential regulatory or competitive issue that hasn't received adequate public attention.

"It's communicated in a way that portrays it as clear that it is outside of the frontier lab's hands, so we have to put our company name on the list and then we're supposed to wait. And then when I ask what's the criteria for how these things are evaluated, I get jazz hands response." [00:18:40]

"You come to a conference and you talk to your buddies and they've had it for nine months and they're making stuff that's way less critical than your product." [00:19:02]