Deep dive: observability, security and AI

Observability, security and AI: what's real

My view as of October 2026: the convergence is real at two layers, the pipeline and the agent on the host, and weak at the revenue line, where security buyers still mostly buy from security vendors. AI investigation is improving but solves a minority of incidents on public benchmarks, and the AI layer is separating from the data store. If I were at an observability vendor, I'd treat the pipeline and the context (who owns what, what changed, how services connect) as what's worth defending, more than the raw data.

What's real in the security convergence

• Buying the data path: Palo Alto closed Chronosphere on January 29, 2026 and calls it "our next-generation observability platform"; its annual report now names Datadog, Dynatrace and Elastic as competitors. CrowdStrike and SentinelOne bought telemetry pipelines in 2025. Going the other way, Cribl bought detection-engineering and AI security-operations assets in mid-2026.
• Same meters: Datadog prices its SIEM at $5 per million events analyzed and cloud security at $10-25 per host, on the same agent and bill. On a company with the dispatch company's host count and about half its log volume, adding SIEM, cloud security and a sensitive-data scanner would run roughly 20-35% on top of the log bill. One of Datadog's mid-2026 wins was a bank adopting its SIEM for how it handles personal data.
• The host agent: Wiz, built agentless, now ships a runtime sensor on the workload, while Datadog sells workload security from its observability agent. Google closed Wiz for $32 billion on March 11, 2026, so a cloud provider now owns a cloud-security leader.

What's not there yet

• Scale: Datadog's security products passed $100 million of ARR in 2025. By their 2026 figures, Palo Alto's XSIAM and CrowdStrike's Next-Gen SIEM are each around $700 million, roughly seven times larger even allowing for the year's gap, and Datadog's security business is a few percent of its revenue by my estimate.
• Growth from owning both: Cisco owns Splunk on both sides, and in its fiscal 2026 Security grew 2% and Observability 4%.
• Different buyers: reliability teams measure time to recover, SLOs and cost per gigabyte; security teams measure detection coverage, how long an attacker goes unnoticed, and audit evidence. Security vendors stay ahead on detection rules and threat intelligence, and observability vendors win on consolidation and data handling.

What's real in AI SRE

AI SRE (site reliability engineering) products promise to turn an alert into a diagnosis, and sometimes a fix.

The benchmarks are sobering. On OpenRCA, a public root-cause benchmark presented in 2025, the best model solved about 11% of 335 failure cases, and ITBench put AI agents at 11-14% of its SRE scenarios. A 2026 follow-up, OpenRCA 2.0, found about 21% exact root causes across 11 frontier models. Scores are rising from one paper to the next, but I'd treat any claim of autonomous root-cause analysis as running ahead of the evidence.

Dynatrace shows the gap in its own messaging. Its CTO has talked about taking humans out of the loop while also saying nobody has moved from AI-assisted to autonomous operations yet, and Bluebox's documentation says it "never pushes a fix on its own": it opens an issue, a coding agent proposes the change, and a person merges it. That's a policy statement more than a technical guarantee, and the liability sits with whoever approved the change.

Practitioners want to see the reasoning: in Grafana's 2026 survey, 95% said AI must show how it reached its answer, and the top barrier was having to feed it context by hand.

Where the AI layer is heading

• Away from the store: Datadog separated its AI security analyst from its SIEM "so customers can use it with other SIEMs", AWS DevOps Agent investigates apps outside AWS, and the startups store little telemetry. If the AI works on anyone's data, the store is less of a lock.
• Into coding agents: Bluebox, Datadog's Bits Code and AWS's Kiro feed production data into the tools that write code. The bottleneck moves to reviewing changes before production, the theme of Becoming AI native.
• AI workloads as telemetry: Dynatrace says more than 1,000 customers monitor AI workloads with it, and LLM prompts make traces bigger. OpenTelemetry's AI conventions are still in development, so vendors fill the gap with their own SDKs; agent tracing and evaluation are in AI agents: orchestration platforms.
• Metered pricing: credits, agent-seconds and tokens are priced like telemetry, and Datadog's move from per-investigation bundles to credits in mid-2026 cut the list price per investigation by about three-quarters by my arithmetic.

Questions to ask about an AI investigation agent

1. On your last hundred real incidents, how often was the agent's initial answer the root cause, and who checked?
2. What data does it read, through which interface, and does it copy telemetry into tickets or chat outside our retention policy?
3. Can it change anything in production, and what's the approval step and the audit trail when it does?
4. Does it work on data stored with another vendor, or only yours?
5. How is it priced per investigation at our volume, including the query charges it triggers?