Datadog interviews

“Even after the original compromised credentials are discovered and revoked, threat actors can maintain access by sending external HTTP requests to the API Gateway endpoint.”

“Datadog recommends that you audit cron jobs, /etc/ld.so.preload, and memory-backed execution artifacts to detect Mimo’s activity.”

“Traditional static analysis tools are a critical part of the puzzle, helping prevent security and quality regressions at scale—but they mainly catch known bad patterns.”

“But interactive search finds only what you already know to look for.”

“For a large enterprise, scoring every security-relevant event with a frontier LLM could cost tens of millions of dollars a day.”