Datadog is a company that quietly appears every three months with earnings results that say: “Remember me?” We are looking to increase allocation to this LTBH position as this is a rare leader in the migration to the cloud and the observability that is required across increasingly complex architectures. If you want a simple thesis that you can share with your friends and family, it’s this: Datadog lets us directly participate in the growth of AWS, Azure and Google Cloud through a pureplay that cross-sells better than almost any other cloud company.

Product Overview:

Datadog’s management team was very early to address the issue of silos in a cloud-native environment. As systems moved from on-premise to the public cloud to include virtualized machines and containers, the number of applications to monitor grew. Virtualized machines create more data from many more applications. The next iteration of the cloud, which was containers, exponentially grew the number of applications. Now that there are serverless architectures where every function needs to be tracked individually – which means the complexity has grown yet again.

Here's a picture of what I mean:

Datadog is a company that solves the complexity associated with the cloud as the products are able to observe and monitor any environment no matter how large the tech stack scales.

The second thing to understand about Datadog is that it’s not only cloud native but it also works well in a multi-cloud environment. This means Datadog is downstream from Azure, AWS and Google Cloud – no matter who a customer goes with and at what percentages for the deployment. The fact that companies prefer to work with more than one cloud vendor is actually a driving force for Datadog as it’s observability and security products can scale across any deployment a customer chooses and is flexible if the customer makes changes down the line.

The trend of multi-cloud and hybrid cloud is only going to accelerate from here which we covered in detail in our Big Data and Analytics analysis. It’s worth a read if you haven’t read it yet.

The company uses the word “standardization” to describe how the multi-cloud trend is a main driver for Datadog. We covered this in our last analysis but it bears repeating here as to why multi-cloud and hybrid cloud are important drivers for Datadog and how standardization plays a key role.

Standardizing means interoperability between various cloud environments and integrated interfaces. This is especially important with multi-cloud or hybrid cloud where companies have more than one environment. This is becoming the new normal to prevent vendor lock-in. The word standardization/ standardize was mentioned 20 times on the Q2 Earnings Call, highlighting its importance to Datadog’s story going forward. If corporations continue to standardize on Datadog’s platform, then the company will continue to capture market share.

Here’s a quote from our previous analysis:

Since dealing with multiple cloud vendors quickly becomes cumbersome, there is a natural tendency to standardize in tech, especially with software. Moreover, cloud applications need to communicate, so having everything on one platform can make detecting and resolving issues less complex and costly. We believe that we are on the cusp of this standardization trend with cloud software vendors, with Datadog leading the way. We believe that Datadog is best positioned to benefit from both the rise in cloud usage and the standardization of cloud software.”Moreover, cloud applications need to communicate, so having everything on one platform can make detecting and resolving issues less complex and costly. We believe that we are on the cusp of this standardization trend with cloud software vendors, with Datadog leading the way. We believe that Datadog is best positioned to benefit from both the rise in cloud usage and the standardization of cloud software.”

Datadog eliminates the need to work with many different vendors and pulls the entire DevOpsSec stack into one platform. This not only breaks down silos in terms of the observability framework yet also breaks down silos within the company.

Infrastructure Monitoring

At the point that companies migrate to the cloud from on-premise servers, how they monitor their infrastructure fundamentally changes. On-premise servers have fixed IP addresses and there are static servers and virtualized machines. Once you move to the cloud, this changes as servers are spun-up in the cloud and are not on-site and components are hosted across many regions.

At the start, Datadog helped monitor the hardware in cloud-native environments, the operating systems, and the application servers. Infrastructure monitoring is essential if there is a problem with the functionality of a cloud-native company on the back-end. It offers tools, such as CPU utilization, to determine if there’s sufficient processing capacity, memory utilization to determine if there’s memory capacity, and storage use which indicates the amount of disk that the host is using to store files and other content.

The goal of infrastructure monitoring is to prevent or troubleshoot performance issues and to lower costs. We’ve covered in the Big Data and ML analysis here the costs associated with cloud environments and why this is coming under pressure with more companies choosing hybrid architectures, including a mix of cloud and on-premise servers.

Datadog set out to disrupt on-premise solutions that monitored servers and virtualized machines. This is called “host-centric.” The primary issues with former infrastructure monitoring tools are that they do not scale for the cloud and it creates silos between departments. In the cloud, infrastructure monitoring uses an API for cloud-based metrics. Datadog’s products also remove the need for Secure Shell, or SSH, to log onto remote servers. As architectures evolved to serverless, legacy monitoring tools were even more outdated as there isn’t a server to run the code and install a monitoring agent.

One key thing about Datadog is the company allows for metadata to be tagged on backend components for better monitoring. These tags inform alerts and visualization tools. The company tags both the zones and the applications. Unified tagging limits the need for reconfiguration as a company scales. This is one of Datadog’s core competencies and their unique method approach to tagging is what they launched with in 2010. This aggregates and contextualizes the data no matter where the data comes from.

Another main selling point to many of Datadog’s features is a unified platform rather than many disparate tools or vendors. This is how Datadog has disrupted its competitors and crept into larger addressable markets. The unified platform works across all environments – on-premise, hybrid and cloud – and spans infrastructure monitoring, application monitoring, log management, observability and now security. By being so strong in the area of observability, Datadog can knock down its competitors by cross-selling 13 products from the key critical piece in the stack, which is monitoring and observability. With 450 integrations, Datadog leaves little reason to leave the platform and the dashboard for other tools.

The unified platform for complex architectures is also partly why Datadog is able to lead its competitors in standardization. The dashboard also offers AI to help customers move through the dashboard by recommending the next monitoring step. Here’s a direct quote from an analyst on the call that sums up Datadog’s positioning:

“Congrats on the solid quarter as well for me. But Oli, you’re already bigger than all your near-term or nearest competitors growing faster than all of them by a couple of magnitude. You talked about enterprise standardization trend that led to your largest deal in the company’s history.”

Application Performance Monitoring

As discussed, the number of applications that need monitoring began to exponentially grow with virtualized machines and containers. Infrastructure monitoring is incomplete in these architectures without application performance monitoring to assure applications and websites run as expected with optimal speeds across mobile platforms, cloud-native infrastructures, virtualized and containerized servers. Distributed application environments can cause numerous bottlenecks and it can be challenging to figure where the bottleneck is coming from. Meanwhile, slow speeds can cause customer drop-off.  

APM also assures that the application is performing as it should and backend processes are executing as they should, including transaction processing, and detects bug or errors in the application code.

APM performs the following functions: 

• Digital user experience monitoring: determines if there are errors or downtime that could lead to a loss of revenue 
• Transaction profiling: analyzes the transaction flow to isolate the cause 
• Code-level diagnostics: According to DZone, 43% of application performance issues come from code. Diagnostics help to identify the line of code or query causing the issue. 
• Deep-dive analysis: Looks beyond code at the server and application infrastructure for problems such as insufficient memory or long wait times 
• Infrastructure monitoring: similar to deep drive analysis, ideally infrastructure monitoring is part of the APM package to monitor slow network connections or virtualization bottlenecks.

Datadog’s APM also comes with network performance monitoring to verify if the network is slowing down traffic or if there is a low connectivity issue. The 360-degree view of infrastructure, applications and networks helps diagnose issues more quickly and with more accuracy.

According to Gartner, the number of applications monitored with APM tools has increased from 5% in 2018 to 20% in 2021. Machine learning is also used to forecast usage patterns and to detect anomalies outside of manual alerts.

Observability

Where observability differs from APM is that it monitors external data across metrics, events, logging and tracing (MELT). It’s called observability because it provides visibility as the issue is occurring and ideally before there is a performance issue.

Observability tools work with telemetry data, which is this combination of logs, metrics and traces. Metrics are numerical measurements, such a transactions per second. Events are individual actions. Logs are application-specific structured and unstructured data. Tracing tracks how many requests flow through a system. This is achieved through APIs, such as the Tracer API or the Metric API.

An observability framework allows you to work with telemetry data with fast retrieval and good visualization. In this specific area, Datadog competes yet is also compatible with the open-source framework called OpenTelemetry. You could also argue the project erodes some of Datadog’s moat as it reduces vendor lock-in but it’s the end-to-end tools that draws customers to Datadog rather than only the telemetry data. We covered this here in Q2.

Because Datadog is an end-to-end tool, it can be compatible with OpenTelemetry by allowing the open-sourced SDK to connect to the platform for telemetry data. The company also supports other open-source projects under the OpenTelemetry umbrella, such as OpenTracing, OpenCensus and OpenMetrics. This has created a standard set of APIs and libraries for observability and allows for the telemetry data to be easily migrated between vendors. Datadog has contributed to the project with its auto-instrumentation libraries.

Kubernetes and the rise of microservice-based architectures increase application reliability and efficiency; however, developers need the ability to monitor these architectures. Microservices benefit from Observability as it helps understand how microservices communicate. This keeps track of metadata for performance purposes and also distributed traces or requests. Observability allows for a more holistic picture so developers can connect data to monitoring tools and solve issues quickly.

Datadog has a new product that offers observability before code goes to production called CI Visibility. The launch of the CI Visibility product follows the acquisition of Undefined Labs. Datadog talks about “shifting left” which means moving more into the development phase prior to production.

Continuous integration and continuous delivery (CI/CD) provide a shared repository of code for an automated build process with regular intervals. This helps speed up development by deploying smaller batches of code. In data science machine learning models, projects are based on code and also the data used to train the model. The CI/CD data pipelines help to deliver machine learning models and this is another opportunity for Datadog’s observability tools to serve a growing demand.

Security Platform

Datadog’s core product is observability and security is an additional catalyst (or an accelerant). Datadog’s positioning with observability puts the products into the right place in the tech stack for threat detection. Cloud environments have an increased attack surface across infrastructure, containers and applications. As teams seek simplified operations, there are more third-party managed services being deployed which reduces visibility. Datadog offers a few security products to allow teams to detect real-time threats to applications and infrastructure, track compliance posture, and also workload security across infrastructure or workloads, such as Kubernetes clusters. With security monitoring, engineering teams have end-to-end analytics coverage from a unified dashboard. This increases time to resolution and also means you can find threats buried deep in the architecture.

As we covered in our previous write-up, the Sqreen acquisition helps Datadog take advantage of the trend towards microservices and Kubernetes rather than monolithic architectures. Generally speaking, Kubernetes can introduce vulnerable clusters due to default configurations. In the past, demonstrations at BlackHat, the annual security conference held in Las Vegas, have exploited features in Kubernetes default attack surface rather than bugs. Sqreen specializes in protecting code-level risks across distributed applications by protecting application logic. Sqreen’s main goal is to deliver security solutions to developers and the operations teams, as well, i.e., to “democratize” and emphasize security testing and implementation during the development process, often called DevSecOps. These are the two main points on this acquisition – more market share across security for microservices and more stakeholders at a company who can buy and deploy Datadog products outside of the security team.

The breakdown between developers, operations and security called DevSecOps is a transition that Datadog plans to capture similar to how the company captured DevOps. Applications and infrastructure security is new to Datadog yet management has hinted towards it becoming as big as the observability market, which is at $38 billion in 2021.

Datadog’s Financials

Datadog accelerated revenue growth during a year of tough covid comps. This shows remarkable product strength. The company’s revenue is up 75% year-over-year to $270 million, an acceleration from 66.81% last quarter, and 61.35% revenue growth in the year-ago quarter. The revenue comfortably beat estimates by 10% and was up 16% QoQ.

The company has an adjusted operating margin of 16% and adjusted EPS of $0.13. The company also had free cash flow of $57.1 million which is an increase from last quarter’s $52 million. This proves the company can grow the top line and invest heavily in R&D but not at the expense of the bottom line. The company has $1.5 billion in cash and cash equivalents.

The company issued guidance of $291 million in revenue, or 52.3% growth in the fourth quarter and EPS of $0.11. For the full year, the company is guiding for $994 million, at the midpoint, and adjusted EPS of $0.39-$0.40. According to the company, usage is down for them seasonally in Q4 as employees and businesses take holiday breaks.

It’s the underlying key metrics on customer growth that help forecast strength for Datadog as we move into 2022. The company has 17,500 total customers of which 1,800 have a ARR of $100K or more, up 66%. These accounts make up 80% of ARR, so growth in the <$100K segment is key. The other key driver of growth for Datadog is the cross-selling of products. The company is unusually strong here with 77% of customers using two or more products, up from 71% a year ago. The number of customers who use four or more products is at 31%, up from 20% a year-ago. The company also stated that net dollar retention rate is above 130 for the 17th consecutive quarter.

Annual recurring revenue helps gauge what level of revenue a company is expecting. According to management, “We also had a record quarter of ARR adds, including record ARR adds in all of our major products. And we saw strong growth across geographical regions, with all regions accelerated on a year-over-year basis compared to Q2.”

Although billings contract terms have fluctuated due to Covid with shorter terms in 2020 that are slowly returning to a more normal length. This helped drive Billings growth of 98% year-over-year. Increased contract duration to annual and multi-year partly contributed to remaining performance obligations (RPO) growth of 127%. On a more normalized basis, the company mentioned current RPO growth was closer to 100%. Revenue still remains the primary way to value Datadog, however, this under-the-hood growth certainly helps understand the strength of the company and how customers view the products as we move into 2022.

The company is investing “significantly in R&D” and plans to spend on travel and conferences in the coming year. The R&D expenses were up 80% in Q3 which management explained by saying, “It’s important to go fast when scaling those teams because there’s quite a bit of a lead time between the time when you hire engineers and the time when you get new products on the other hand. I’ve mentioned in other calls like maybe hiring now is a good predictor of output two years from now on the engineering side. So we should get started. That’s why we’re doing it.”

Notably, we like companies that invest in their engineering teams. Datadog points towards pricing power and cross-selling as to why they’re able to invest heavily in R&D and still remain profitable.

Conclusion:

As someone had said on the forum following the stellar earnings report: “Who let the Dog out?!”

To be literal, it’s AWS, Azure and Google Cloud that let the dog out. Our simplified thesis as we rounded the corner into tough Q2 covid comps was specifically, “If the tech giants are communicating that cloud infrastructure-as-a-service is one of the most critical markets in the future, then who are we to argue with this by not investing in the leader across cloud monitoring products?”

Observability is not exactly the most conversational topic, but hopefully it’s understood that architectures are becoming more complex in terms of monitoring and observability. I’m also hoping it’s clear from this analysis that Datadog has additional tailwinds from the trend towards hybrid and multi-cloud. Lastly, the management has not only executed before, during, and after Covid, yet has also grown its product suite to leverage its key positioning at the observability layer. Many companies will begin here and remain with Datadog for other products.

Valuation is high at 43X forward P/S. We rarely buy above 50 forward P/S and much prefer under 40. However, you’ll get buy alerts as we go along to help communicate when the risk/reward looks favorable as we continue to build this position.