Datadog is planning to expand the scope of the security and observability services it provides following the acquisitions of Sqreen, an application security platform provider, and Timber Technologies, a provider of a tool, called Vector, for collecting and normalizing log data.

Ilan Rabinovitch, vice president of product and community for Datadog, said Vector makes it possible to collect, enrich and transform logs and other observability data from both on-premises and in-cloud environments in a way that makes it easier to route that data to wherever it is needed via a data pipeline.

Sqreen is a provider of a software-as-a-service (SaaS) platform that detects, blocks and responds to application-level attacks using runtime application self-protection (RASP) capabilities enabled by a web application firewall (WAF) embedded within an application.

Rabinovitch said as IT continues to evolve, it’s clear organizations are looking to embrace DevSecOps best practices in a way that will require security tools that can be embedded within an application, coupled with observability tools that provide more context about the overall IT environment. That context is especially critical, given the amount of data that needs to be analyzed to determine the potential scope of a security threat to an IT environment, Rabinovitch said.

The Datadog platform is already widely employed to monitor cloud computing environments. There is an industry wide effort to take monitoring to the next level by enabling observability, which applies analytics to provide more context. Surfacing that context, however, requires the ability to normalize data across a pipeline using Vector, Rabinovitch said.

Of course, the Vector tools are equally applicable to DevOps workflows that have yet to incorporate security technologies. The goal, now, is to make it easier for IT teams, made up of developers, IT operations teams and security specialists, to collaborate by breaking down the various data silos created by IT and security management tools.

It’s too early to tell what impact the rise of DevSecOps will have on roles within IT organizations. Most organizations will continue to employ a range of specialists that will be able to work more closely with IT generalists, Rabinovitch said. Managing IT is becoming the equivalent of a barn raising, in that it requires members of a community with different skills to come together for a certain amount of time to accomplish a specific task, Rabinovitch added.

It’s also not clear whether IT organizations view observability as a distinct capability separate from monitoring, or whether they will simply view observability as the next logical extension of existing tools. At the core of that issue is debate over whether observability platforms need to be acquired separately, as part of an effort to replace existing monitoring tools, or whether those tools will evolve over time to provide observability capabilities.

Regardless of the path forward, it’s apparent the increased complexity of modern IT environments – made up of microservices, containers and serverless computing frameworks – is about to force that issue.

Why Cloud WAF Matters for Modern Application Architectures

Web application attacks remain one of the most common vectors for data breaches. The Verizon 2019 Data Breach Investigations Report noted that web application attacks are frequently cited in breach data and that many organizations take months to discover a compromise. As attack surfaces expand across cloud services, containers, serverless functions, and APIs, security teams need protection that works across all of these environments without demanding weeks of configuration or ongoing signature tuning.

Signal Sciences positions Cloud WAF as a response to this challenge. By routing traffic through its cloud engine rather than deploying a module on every server or container, the product aims to lower the operational overhead traditionally associated with WAF deployments.

How Signal Sciences Cloud WAF Works

The deployment model is intentionally lightweight:

• DNS-based onboarding: Customers update their DNS records to point web traffic to the Signal Sciences Cloud Engine. No software installation on application servers is required.
• Centralized inspection: All incoming web requests pass through the Cloud Engine, which inspects, classifies, and either allows or blocks them before they reach the origin.
• SmartParse technology: Signal Sciences uses a patented parsing approach (SmartParse) to analyze requests without relying on traditional signature rules, reducing false positives and the need for continuous rule tuning.
• Single management dashboard: Regardless of deployment method—Cloud WAF, module-based, or reverse proxy—all signals, alerts, and metrics surface in one unified interface.

Key Features and Benefits

Signal Sciences highlighted the following capabilities at launch:

• No installation or maintenance overhead: Protection is enabled through a DNS change, removing the need to install or update agents across a fleet of servers or containers.
• Automated blocking in production: According to Signal Sciences, 95% of its customers run the platform in live production with automated blocking enabled—a figure the company attributes to low false-positive rates from SmartParse.
• Rapid deployment: The company states that average deployment time is under one hour, compared to legacy WAF solutions that can take weeks or months to fully configure.
• Broad environment coverage: Cloud WAF protects cloud-native, containerized, on-premises, hybrid, and serverless applications regardless of hosting provider.
• Full feature parity: Cloud WAF includes the same detection rules, reporting, actionable insights, and DevOps tool integrations available in Signal Sciences’ other deployment options, so teams do not lose capability by choosing the cloud-hosted path.
• Unified management: A single centralized dashboard replaces the need to log into multiple portals—a common pain point with legacy multi-vendor WAF setups.
• CI/CD compatibility: The product is designed to let development teams deploy quickly within existing CI/CD pipelines without requiring security team intervention at each release.

Industry Context and Analyst Perspective

Daniel Kennedy, research director at 451 Research, commented on the announcement: “Advanced web application attacks are on the rise. Application security solutions that provide superior detection and protection for all modern application architectures with minimal configuration, tuning, and management are highly appealing to enterprises. Signal Sciences fits this bill, and its Cloud WAF provides a powerful deployment option and the flexibility that many enterprises seek today.”

Darrell Arms, architect at Tevora, added: “With enterprise architectures coming in more shapes and sizes than ever, flexible deployment is critically important. Signal Sciences Cloud WAF is the only modern WAF that helps organizations operate more efficiently by allowing security teams to focus on higher value tasks, and enabling developers to deploy quickly within the CI/CD process, without constraints.”

Flexible Deployment Across Any Infrastructure

A differentiator Signal Sciences emphasizes is deployment flexibility with feature parity. Enterprises can choose from multiple deployment models—cloud engine (Cloud WAF), agent module, or reverse proxy—and switch between them as their infrastructure evolves, without losing access to any platform features. This is relevant for organizations running mixed environments: for example, containerized microservices on Kubernetes alongside legacy on-premises monoliths.

The unified management plane means that security and DevOps teams get a consistent operational experience regardless of which deployment model underlies a given application. This reduces training overhead and simplifies incident response when teams need to correlate events across multiple application environments.

Who Should Evaluate Signal Sciences Cloud WAF

Cloud WAF is particularly relevant for teams that:

• Need fast time-to-protection without a lengthy agent rollout across many hosts.
• Run applications on infrastructure they do not fully control (e.g., PaaS platforms where installing OS-level agents is not possible).
• Want to consolidate WAF management across cloud and on-premises environments into a single interface.
• Are integrating application security into CI/CD pipelines and need a low-friction deployment model for developers.
• Are replacing a legacy WAF and want to avoid weeks of signature tuning before going live in blocking mode.

Note: Signal Sciences was acquired by Fastly in 2020. Prospective customers should evaluate the current product under the Fastly Next-Gen WAF branding and verify that the features described in this 2019 announcement remain available and accurate as of their evaluation date.