Datadog Announces Mambark: Two-Stage AI Pipeline for Enterprise Security Detection at Scale
Key Takeaways
- ▸Frontier LLMs cost prohibitively for scoring every security event—potentially tens of millions of dollars daily for large enterprises
- ▸Mambark, a 96.9M-parameter state-space model, enables fast, unsupervised anomaly detection using negative log-likelihood as an anomaly score
- ▸Two-stage architecture filters high-volume events through Mambark before forwarding suspicious events to AI agents for investigation
Summary
Datadog has unveiled a novel approach to security event investigation that addresses a fundamental trade-off in AI-driven security: the prohibitive cost of running frontier LLMs on every security event. The company built a two-stage detection pipeline combining Mambark, a small state-space model with 96.9 million parameters, with AI agents to enable efficient security detection across enterprise environments.
Mambark, based on the Mamba selective state-space model architecture, scores every incoming security event using unsupervised anomaly detection based on next-token prediction. Events with the lowest log-likelihood scores—the most surprising and potentially threatening—are forwarded to AI agents for deeper reasoning and investigation. This approach eliminates the need to apply expensive LLM reasoning to every event while maintaining high recall on genuine threats.
The model was pretrained on hundreds of billions of security events and can handle extremely long event sequences spanning tens of thousands of events, enabling it to detect slow-unfolding attacks that unfold over time. Datadog is currently testing this detection mode with select partners in its Cloud SIEM product. The company positions this as a practical solution for fleet-scale security detection that balances both cost efficiency and precision.
- State-space model architecture runs in linear time vs. quadratic for transformers, enabling conditioning on tens of thousands of security events
- Datadog Cloud SIEM is testing this detection pipeline with design partners
Editorial Opinion
Datadog's two-stage approach represents a pragmatic recognition of an emerging challenge in enterprise AI: not all problems benefit from frontier-model reasoning, and attempting to apply expensive systems uniformly creates economic barriers to adoption. By combining a specialized smaller model for high-recall filtering with LLM agents for precise reasoning, the company demonstrates a scalable template other security vendors will likely follow. The use of unsupervised anomaly detection sidesteps labeling challenges entirely, making this particularly promising for emerging threat detection.
