Datadog Reports Median Cloud Vulnerabilities Jumped from 4 to 16 in Nine Months

Cloud posture is deteriorating faster than containment controls can compensate

Datadog's State of Cloud Security 2026 report, published November 10, documents a fourfold increase in serious cloud vulnerabilities across thousands of analyzed environments. The median number of high- or critical-severity findings rose from 4 in February 2026 to approximately 16 in November 2026 across AWS, Microsoft Azure, and Google Cloud deployments.

The trend matters because it occurred during a period when organizations strengthened their containment posture. Among AWS users in Datadog's data set, 55% had adopted data perimeters by November, up from 40% in 2025. Data perimeters restrict cross-account access and prevent accidental exfiltration, yet vulnerability exposure still worsened. That gap suggests misconfiguration discovery alone cannot keep pace with the expanding attack surface introduced by new services, dependencies, and workload deployments.

Datadog explicitly recommends dependency cooldowns — deliberate delays before adopting new open-source packages — to reduce the risk of hijacked libraries reaching production. The report positions software supply chain monitoring as a necessary CSPM capability, not an adjacent concern.

Buyer implication: CSPM purchases must now justify budget through remediation velocity and attack-path reduction

The Datadog finding shifts the CSPM category away from compliance dashboards toward continuous vulnerability prioritization, identity exposure analysis, and exploitable attack-path reduction. Enterprises evaluating CSPM platforms should request vendor-specific evidence for coverage across cloud services, workload vulnerabilities, dependency risk, and measured remediation time. Datadog's report does not disclose customer count, pricing, or a vendor-neutral benchmark of remediation performance, so those claims remain unquantified.

The competitive pressure now extends beyond dedicated CSPM vendors to integrated CNAPP platforms. Datadog competes with CrowdStrike, Palo Alto Networks, Wiz, Microsoft, Orca Security, and Sysdig across overlapping categories: CSPM, cloud workload protection, CNAPP, observability, and software supply chain security. Buyers should expect vendors to demonstrate not only asset discovery but also measurable reduction in exploitable exposure.

CrowdStrike expands Falcon Cloud Security to connect posture findings with runtime threat detection

CrowdStrike announced expanded Application Security Posture Management (ASPM) within Falcon Cloud Security, bringing containerized applications into Application Explorer with workload and cloud context. The update combines Cloud Indicators of Attack (IOAs) with posture insights, placing exposure context directly into threat detection.

This moves Falcon Cloud Security further toward a CNAPP model that links build-time application risk, cloud posture, software supply chain exposure, and runtime detection. The strategic shift puts CrowdStrike in direct competition with integrated platforms from Palo Alto Networks, Wiz, Orca Security, Microsoft, and Sysdig rather than only traditional CSPM products.

Enterprises evaluating CSPM should test whether a platform can connect a misconfiguration or vulnerable container to an active attack signal and business-critical workload. CrowdStrike's announcement supplies no public pricing, benchmark results, customer count, or remediation-time improvement, so the commercial and performance claims are thin. The substantive change is product convergence, not a quantified outcome.

Google Cloud ends DSPM access for new organizations, existing customers lose access February 1, 2027

Google Cloud's November 5 release notes state that Data Security Posture Management (DSPM) within Security Command Center is no longer available to new organizations. Existing organizations retain access until the scheduled shutdown on February 1, 2027.

The move creates displacement opportunities for DSPM and CNAPP vendors, including Wiz, Palo Alto Networks, Varonis, BigID, Securiti, Sentra, and Microsoft Purview, depending on the buyer's requirements for cloud data discovery, classification, entitlement analysis, and posture remediation.

Google Cloud customers using or planning DSPM must inventory dependencies, identify a replacement before February 2027, and account for migration, data classification, policy translation, and possible duplicate licensing. The release provides no replacement product pricing or migration-cost estimate, making the budget impact customer-specific but operationally material.

What to watch

The Datadog data establishes a quantified baseline: cloud vulnerability exposure worsened by 300% in nine months despite increased adoption of containment controls. That trend favors CSPM platforms that can connect posture findings to exploitable attack paths, identities, software dependencies, and runtime activity. CrowdStrike's ASPM expansion reinforces that convergence. Google Cloud's DSPM retirement creates a concrete replacement decision for affected customers with a hard February 1, 2027 deadline.

Buyers should request proof that a CSPM platform reduces the median time from vulnerability discovery to remediation, not merely the count of discovered issues. The Datadog finding suggests discovery velocity now outpaces remediation capacity in most organizations.