How Datadog added security specialists to a bottom-up sales motion
Outbound teardowns by
October 2026
- Company
- Datadog sells a cloud monitoring and security platform, priced on usage, to engineering, operations and security teams. Visit Datadog ↗
- Security sales
- A specialist pilot, sales engineers and a security channel, alongside the AEs
- CEO
- Olivier Pomel
TL;DR
Datadog grew through engineers who used its products, but security had a different buyer, the CISO, and an engineer couldn’t close that deal alone. Once its security product could win, Datadog kept the engineer-led motion and added security specialists on the same accounts.
The lesson
When a new product sells to a different buyer, keep the motion that got you in and add specialists on the same accounts once the product can win the deal.
For your team
Keep the champion path. Add the one layer the new buyer needs next, and judge it by the opportunities it creates.
What Datadog did
The starting point
Security first reached customers through the same sales force, and the same engineer users, as everything else Datadog sold.
In February 2022, CEO Olivier Pomel said Datadog still had one sales force that sold everything and still landed mostly with infrastructure teams. A large finance customer had bought its security products through that same land-and-expand motion, he said.1
In late 2023 Datadog bundled security into its core packages to bring it into more conversations. In February 2024 Prashant Prahlad, who led cloud security product, said “our Datadog champions, the users of Datadog have actually introduced us to security teams.”2,3
Datadog’s own example shows how far that went. A travel customer of about four years added security one product at a time until it was 23% of its ARR. The last was Cloud SIEM, Datadog’s security information and event management (SIEM) product, replacing the SIEM the customer ran on its own servers.4a
One Datadog customer added security a product at a time
Redrawn from Datadog’s Investor Day 2026, “Security customer example” slide
The problem
Security had a different buyer, the CISO, and Datadog’s champions were engineers.
CFO David Obstler said in September 2024 that security had a different buying center in the CISO, which had been more of a challenge.5 A year later he described the CISO as a gatekeeper who buys through channels and from the top down, while Datadog had come from the bottom.6
The travel customer’s last step fits that picture. Replacing a SIEM is the kind of centralized purchase Obstler described the CISO controlling, and by June 2026 he said selling that way wasn’t Datadog’s DNA, but it was investing behind it.7
The decision
Morgan Stanley technology conference, March 5, 2024
Asked if Datadog needed a specialist security sales overlay, its CEO said no.
Less than two years later, Datadog hired a director to build a specialist security sales team.
Pomel said Datadog had tested such setups and done better making security available through the whole sales force.8
The product had changed.
In August 2025 Obstler said expanding go-to-market does little good until the product can win, and in March 2026 he said Cloud SIEM had got there.9,10 On October 30, 2025, Keith Peckman announced he would start on November 3 as Datadog’s Director of Enterprise Security Sales.11b
… This newly created role will focus on building an enterprise security sales specialist team focused on large, complex customers …
The redesign
Datadog added each layer on the same accounts.
At Investor Day in February 2026, CRO Sean Walters walked through a slide titled “Security GTM investments.”4 He said security started in the usual bottom-up motion, where observability users champion the products. Datadog added a few security sales engineers about two years earlier, began building a security channel about a year earlier, and had just started a pilot of security-focused sales teams.12
Each layer sits on the motion that was already there
Redrawn from Datadog’s Investor Day 2026, “Security GTM investments” slide
The specialists work inside accounts the AEs already own. Datadog’s Enterprise Security Sales Specialist job record, first published in August 2025, says the role will “partner with Enterprise Account Executives,” own the security sales cycle “from discovery to technical close,” and co-sell with partners to CISOs, security architects and security operations teams.13 In May 2026, Pomel called them overlays for selling to the CISO, a muscle Datadog didn’t have before.14
The result
Security kept growing, but Datadog hasn’t credited the new layers with it.
Datadog said security passed $100 million in ARR in 2025, with growth rising from the mid-40s to the mid-50s percent year over year by the third quarter.15,16 In March 2026, Obstler credited the progress mainly to the existing go-to-market and cross-selling into enterprise logs customers, with the specialists only just starting.10
The next target is the same installed base. In June 2026 Obstler named attaching Cloud SIEM to traditional companies with strong observability logs as one of two targeting rules.7c
What it took
It took leaders hired for the new buyer, and five years from the first mention of a different buyer to the first specialists.17,18
Peckman was the first of several. In February 2026, Kevin Anderson posted a search for an Area Vice President of Enterprise Security Sales to work closely with Peckman and Al Saisi, calling security one of Datadog’s fastest-growing product areas.19 In July 2026, Peckman promoted a Security Channel Director opening himself, for someone to “work every day with my team.”20
Datadog’s job board shows the other layers filling out: a senior security sales engineer role first published in January 2026, a Director of Security Channels for North America in June 2026, and security channel managers in São Paulo, Singapore and Sydney.21,22,23d
What to borrow
- Keep the champion path. The engineers who already ran Datadog carried security into their accounts, so the specialist joins the AE where the champion can’t complete the purchase.
- Add one layer per gap. Sales engineers came first, to give security teams technical answers. The channel followed because CISOs buy through partners, and specialists with a quota came last.
- Wait until the product can win. Datadog’s CFO tied the channel and the specialists to Cloud SIEM becoming competitive.
How to build a version of this in Unify
Build it in Unify
Keep the AE on every account, and bring the specialist in when a security signal appears.
Unify combines your CRM, warehouse and product usage data with enrichment from 40+ sources. A version of Datadog’s approach starts from one installed-base Audience. The AE’s champion Play runs on every account, and when a security signal appears, a specialist’s Play adds the specialist to the same account while the AE stays owner. Your team keeps the readiness decision, comp plans and partner deals outside Unify.
One account, from signal to next step
- Account
- Corran Freight, a logistics customer on your first productIn the installed-base Audience: uses logs above your threshold and doesn’t own the SIEM.
- Signal
- Dana Okafor started as CISO three weeks agoFrom a New Hires Signal.
- Why it matters
- A SOC analyst post asks for on-prem SIEM experience, so a replacement may be on her listFrom an AI Agent question on public job posts.
- Next step
- Marcus Hale, the specialist, calls Dana. Priya Nair stays account owner and keeps working the champion.From the specialist’s Play: Slack alert, people found, a call-led Sequence.
outbound motionRun the champion Play first, and switch on the specialist Play once the second product is winning real deals.