Datadog (DDOG) Q1 2021 Update

Datadog reported Q1 2021 results on May 6th. Overall performance was strong and the market rewarded the stock with a 8.3% boost the next day. Datadog is demonstrating a return to high revenue growth coming out of the one-time, COVID-impacted engagement dip in Q2 2020. This provides a favorable set up for the remainder of 2021, as the customer expansion flywheel keeps spinning and revenue growth re-accelerates. The stock has largely consolidated for almost a year, with the current price below the peak reached in June 2020. As with all growth stocks so far in 2021, valuation multiple compression is limiting price appreciation. Even taking this into account, my end of year price target is higher than current levels and I have increased my portfolio allocation to DDOG.

I’ll list the most significant take-aways from the quarter below, with more details provided in the sections that follow. Additionally, readers can review my Datadog recap from Q4, which sets the foundation for my optimistic view for 2021 and supplements this Q1 update.

• Revenue growth will re-accelerate. Applying a proportional beat to Q2 estimates implies annualized revenue growth of 60%, up from 51% in Q1 and 56% in Q4.
• This momentum is further underscored by the large increase in the full year revenue estimate, raising annualized growth from 37.5% to 46.6% (over 9% in one quarter). The CEO called this out as emblematic of their confidence. It also silences analyst concerns with the Q4 print for 38% growth in 2021.
• Billings, total RPO and current RPO growth rates were higher than revenue, further supporting future revenue growth looking forward.
• Operating leverage at scale is kicking in, as FCF margin reached 22% and Non-GAAP operating margin remained in range at 10%.
• Total customer growth of 32% combined with DBNRR over 130% provide another tailwind to revenue growth. Datadog is continuing a high pace of new customer additions and then growing their spend over time.
• Customer adoption across multiple product offerings progresses unabated. In addition to significant increases in percent of customers using 2 and 4 or more products, management shared a new metric that “hundreds” of customers are now using 6 or more of their 9 products.
• Gartner moved Datadog’s APM solution into the leader’s quadrant, with the most positive velocity of any competitor.

Financial Summary

Top Line Growth

Q1 revenue was up 51.3% annually and 11.8% sequentially. This beat analyst estimates for 42.2% growth and the company’s estimate from Q4 for 41.8%. Q1 revenue growth was down from 56% in Q4, but this appears to represent a low point as we clear the Q2 2020 overhang.

Looking forward, the results are more exciting. For Q2, Datadog leadership projects revenue of $212M at the midpoint for annualized growth of 51.4% and sequential growth of 6.8%. If we apply the $12M or 9.5% annualized beat from Q1 to Q2, we would land at $224M in revenue, up 60% annually or 12.8% sequentially. This represents a re-acceleration of annualized revenue above both Q1 and Q4. As investors will recall, Q2 2020 represented a one-time reset in usage growth for many of Datadog’s large customers, which was largely attributable to COVID. Now that we have lapsed that event, annualized revenue growth should return to its more predictable cadence in the 60% range for the remainder of 2021. This isn’t a stretch, as Datadog would need to continue its sequential revenue growth of about 12% a quarter, which has been consistent with the last couple of quarters.

This bias towards higher revenue growth looking forward is further supported by other sales metrics. Billings was up 59% year/year in Q1, roughly inline with the adjusted billings growth rate of 61% in Q4, and higher than revenue growth. Similarly, RPO grew 81% year/year in Q1, slightly above the 78% growth in Q4. And current RPO was up 60% in Q1. On the Q1 earnings call, management called out an important milestone, as Datadog added over $100 million of ARR in a single quarter for the first time. This represented a record ARR quarter, after Q4 was a record. And Q1 is usually a seasonally slower quarter.

Reflecting management’s confidence in the forward outlook for revenue growth, they significantly increased the full year revenue projection. In response to an analyst question on the earnings call, Datadog’s CEO called this out. For the full year, Datadog raised their revenue target by $55M to $885M at the midpoint. This increased the revenue growth target to 46.6% from their initial 2021 estimate for 37.5% growth. This represents a major improvement, particularly given that many analysts called out significant revenue “deceleration” for the full year following the Q4 report. If we assume subsequent raises of just 5% in Q2 – Q4, full year revenue growth should approach 60%.

Profitability

While revenue growth was impressive, Datadog continues to demonstrate operational leverage. For Q1, Non-GAAP gross margin was 77%, down from 80% a year ago and 78% in Q4. Management attributed this decline to investments in platform innovation and the activation of new cloud data centers. Operating income was $19.6M, doubling their prior estimate for $8-10M. This translated into a Non-GAAP operating margin of about 10%. This compares to $16.3M of income a year ago and 12% operating margin. As noted in Q4’s report, Datadog increased headcount by 56% over the course of 2020. The long term operating margin target over 20% is still intact.

Operating cash flow was $51.7M in Q1, generating free cash flow of $44.5M. FCF margin was 22.4%. These metrics were up significantly year/year. In Q1 2020, operating cash flow was $24.2M and free cash flow was $19.3M, yielding a FCF margin of 14.7%. This puts Datadog’s rule of 40 value in a range of 61 (op margin) to 73 (FCF margin).

For Q2, management estimated non-GAAP operating income between $9-11M, slightly above the estimate for Q1 (which they beat handily). For the full year, management raised the operating income target by $10M at the midpoint.

In terms of functional areas, what is most interesting is Datadog’s continued ramp of R&D spend and leverage in S&M spend. S&M spend (Non-GAAP) increased 33% year/year in Q1. R&D spend increased 76%. On a GAAP basis (including stock based comp), R&D spend nearly doubled year/year. These were the specific values on a Non-GAAP basis in Q1 and their historical comparables.

• R&D = 31% (versus 27% in Q1 2020 and 30% in Q4)
• S&M = 28% (versus 32% in Q1 2020 and 30% in Q4)
• G&A = 8% (versus 9% in Q1 2020 and 8% in Q4)

The fact that Datadog can maintain high revenue growth, while slowly reducing relative spend in S&M indicates increasing operating leverage. The outsized R&D spend growth reflects their continued investment in building out the product suite. As of Q1, Datadog had 9 monetized product offerings (10 if you separate APM and Continuous Profiler), after adding 4 new ones in each of the past two years. I think we can expect this pace of product expansion to continue, which is a critical driver of the underlying revenue growth story. Not only does this create more distance between Datadog and competitive offerings, it also offers more upsell opportunity as we will see in the next section.

Customer Activity

Datadog continued its strong pace of customer expansion activity in Q1. This “land and expand” motion is a significant driver of Datadog’s growth and provides evidence of sustainability, as the formula appears very repeatable. Like other SaaS providers, customer expansion takes two forms for Datadog. First, they continue to add new customers to the platform. This is driven by sales outreach, customer events and marketing. Customer segments are enterprise, mid-market and SMB, with revenue roughly split evenly between them. Datadog is investing heavily in sales headcount to keep landing new customers.

Second, after customers get familiar with the platform, they expand their usage of individual products. This involves applying existing products to more application use cases and more hosts, as their software infrastructure footprint grows. Customers also adopt more of Datadog’s 9 monetized products over time. They may start with infrastructure or logging and later add APM, NPM, RUM and Synthetics. Datadog management has provided evidence that product adoption scales with time in market, reflecting intuitive market fit in determining which new product offerings to release.

The combination of these factors drives high revenue growth. As total annualized customer growth remains above 30% and DBNRR (dollar based net retention rate) remains over 130%, I think we can expect total revenue growth to continue over 50% a year. Conceptually, this makes sense. Datadog is adding more than 30% total new customers each year and existing customers increase their spend by an average of over 30%. Like the Rule of 40, this customer expansion formula can provide a reasonable indicator of expected revenue growth.

Datadog ended Q1 with 15,200 total paying customers. This was up 1,000 from Q4 or 7.0% sequentially. The absolute number of sequential customer adds has been pretty consistent for the last several quarters (and even longer if we disregard Q2 2020) at about 1,000 adds per quarter. This represents a reassuring pace of customer acquisition expansion, reinforcing management’s view that the opportunity is still largely greenfield.

On the other hand, the larger total customer count is causing this consistent number of customer adds to represent a smaller percentage increase as time goes on. This trend is evidenced in declining sequential and annual growth rates. These rates are worth monitoring. Going forward, we should expect the absolute number of sequential adds to start increasing, lest the annual growth rate drop below 30%. As we fully emerge from any COVID overhang and new sales hires ramp up, it’s likely these customer growth rates will pick back up.

In parallel, Datadog reports on growth in large customer counts. Large customers are defined as representing more than $100k in ARR. It is measured during the last month of the associated quarter, where that month’s committed spend is multiplied by 12. So, new customers with a high spend would be included as well as any prior customers that increased spend in that quarter to pass the threshold. According to management, total spend from these large customers makes up more than 75% of total ARR.

Due to the size of their contribution, examining the change in large customer spend over time is constructive and representative of committed product consumers. These larger customers provide sales leverage and can be expected to continue increasing spend over time, as they consume more product lines (more on that below). The large customer growth chart above shows additions scaling with overall counts, with both Q4 and Q1 delivering new highs in sequential adds. Sequential growth rates exhibit a re-acceleration over the past 4 quarters.

This growth in large customer spend is being driven by customer expansion, applying Datadog products to more use cases and adopting additional product lines. This expansion is reflected by the DBNRR (dollar-based net retention rate), which once again was above 130%. This metric means that existing Datadog customers increased their spend year/year by at least 30%. As investors know, Datadog management doesn’t report the exact value, but it has been over 130% for the past 15 quarters.

Customer spend expansion is driven by few factors. First, as customers increase their digital footprint, they generally have more data and infrastructure to monitor. Datadog’s product pricing is structured around usage. As customers add more hosts, logs or users onto the system, their spend will increase.

Second, and probably more significant, is the adoption of additional products. Datadog now has 9 individual products with pricing offered as part of their platform. Because Datadog makes it easy for customers to activate additional products, customers often start with a couple and then gradually add more modules over time. Datadog management has been reporting values for the percent of customers that have adopted two or more and four or more products for the last two years.

If we examine these values and extrapolate to total number of customers, the high growth in product add-ons becomes apparent. Not only are the percentages of customers using multiple products increasing, but also the total customer count grows, which magnifies the absolute number of customers in each category and the rate of change annually.

For example, in Q1, the number of customers using two or more products increased by 57% annually, while the total number of customers increased by 32%. For customers using four or more products, the number of customers almost tripled year/year. On the Q1 earnings call, management shared a new metric for the first time that “hundreds” of customers are now using 6 or more products. I imagine we will start getting percentages for this level of adoption soon.

While this customer expansion to multiple products over time is impressive, the number of products adopted by new customers is increasing as well. Datadog management has reported that over 75% of first-time customer logos onboarded with two or more products. This metric has been reported for several quarters. It is important because it implies that revenue contribution for first-time customers will be higher.

The growth in multiple product adoption is enabled by Datadog’s platform strategy and rapid product development cadence. They continue to add new products to the platform suite, each of which addresses unique use cases and adds value incrementally. Their pace of product development has been accelerating over the years, at least as measured by the number of released offerings that currently or will contribute to revenue. While 2017-2018 added one new product each year, 2019-2020 added 3-4 per year.

For 2021, we haven’t seen significant new product additions yet, but these are normally held for the annual Dash conference. In 2020, Dash was held virtually in August and introduced a number of new product enhancements and stand-alone offerings. I think we can expect a similar cadence for this year, given the outsized investment in R&D. If Datadog maintains the pace of releases similar to 2019-2020, then it’s likely the number of monetized product offerings will increase by another 3-4, representing an increase of 30-40% of product footprint.

Other Metrics

Datadog has been adding headcount aggressively. While this is capping profitability in the new term, I think it is worthwhile to maintain their high level of growth and market share absorption. In Q4, Datadog reported that they had increased headcount by 56% in 2020. This was inline with revenue growth for Q4 and slightly below the full year revenue growth of 66%. It seems that Datadog leadership has keyed on the correlation between headcount growth and revenue growth, which generally makes sense. They mentioned that relationship in Q4’s report.

For Q1, they provided similar updates. R&D headcount grew slightly higher than revenue, presumably on an annualized basis. This would imply at least 51% growth. For S&M, they stated that revenue growth has outpaced growth in S&M spend. However, the removal of in-person events and associated marketing for Q1 2021 would depress the year/year comparison. The growth in R&D reinforces Datadog’s heavy investment in building out their product offering.

We continue to invest significantly in R&D, including a high growth in our engineering head count. Engineering head count continues to grow slightly ahead of the pace of revenue growth and we have been able to attract talent and are successfully executing on our hiring and onboarding plans, despite COVID.

Datadog Q1 2021 EArnings call, May 6, 2021

With the Q1 report, Datadog announced the hiring of Adam Blitzer as Chief Operating Officer. Prior to Datadog, Blitzer was at Salesforce for eight years, responsible for the Digital business unit (Marketing Cloud, Commerce Cloud, and Experience Cloud). He landed at Salesforce after founding Pardot, a B2B marketing automation platform that Salesforce acquired. 

The intent of the new COO role is to help scale the organization and support growth. The Datadog CEO commented that they specifically hired this candidate from Salesforce because he could help Datadog scale into a much larger software provider. Again, Datadog leadership is constructing a deliberate operational framework to support rapid growth.

Product Development

To fully appreciate the sustained growth opportunity for Datadog, we need to examine how they drive new ARR over time. This is commonly referred to as their “land and expand” model, with shared characteristics with other SaaS companies. Datadog appears to have really dialed in the mechanics of their expansion model and refined the inputs to make their results very repeatable. When business performance lags (like in Q2 2020), they can easily identify the cause and predict when results will get back on track.

Datadog increases revenue by driving expansion in three dimensions. These are landing new customers, building new products for customers to adopt and growing customer usage of each product. ARR growth is powered by the combination of these three contributors. As long as Datadog continues to expand along each dimension, investors can expect a high rate of revenue growth to continue.

Customer Additions

The first dimension is simply adding customers. Datadog has been increasing its total customer counts by over 30% annually for the last 2 years. Incremental additions in total customer counts have averaged around 1,000 customer per quarter over the last few quarters. As the total customer count has been increasing, the sequential and annual growth rates have been coming down. While some of this is expected, we will want to monitor the rate of customer additions as 2021 progresses. In Q1, Datadog added 1,000 new customers, which was roughly inline with Q3 and Q4 2020. Yet, Q1 is a seasonally slower quarter. This implies that total customer additions could ramp up in later quarters in 2021.

To help this, Datadog has been investing heavily in Sales and Marketing headcount. As investors will recall, our last view of headcount numbers came with the Q4 2020 report. Datadog ended the year with 2,185 employees, which represents a 56% increase over the end of 2019. The highest growth was in R&D and S&M teams. Both the CEO and CFO have discussed how Datadog is intentionally hiring more sales people at a rate close to revenue growth. This is also being done in new markets as part of international expansion.

Product Suite Expansion

The second vector of growth revolves around adding more products to the Datadog platform. Datadog maintains separate pricing for each product offering. Cost increases with usage by product, scaling based on the number of hosts, amount of data processed or user counts. This allows each customer to optimize their total spend through thoughtful selection and usage of each product line. This is opposed to a bundled pricing model, in which the customer pays a single cost for access to all products and will be charged based on volume of data or number of users.

Datadog’s “ala carte” pricing model appears to be resonating with customers, even though it is counter to recent moves by some competitors. In Datadog’s case, the customer has the benefit of full control over their spend, by only opting for those product lines that they intend to use and controlling usage for each at a granular level. Having made observability product purchase decisions for engineering organizations, I can appreciate the optionality this provides. You can think of it like the difference between a cable bundle and subscribing to only the channels you want. There are arguments for both approaches, but Datadog appears to be sticking to individual pricing for now.

Because of this ala carte pricing, new product additions can drive incremental revenue more directly for Datadog. Like other rapidly growing software stack companies, Datadog is maintaining a rapid pace of product development. The number of product offerings launched each year has been accelerating. As noted in the diagram above, Datadog started with a single product in Infrastructure. This was the only product for several years. Then, they added APM in 2017 and logging in 2018. The pace accelerated in 2019 with four new products added and three more products with pricing in 2020, with Marketplace and Compliance Monitoring on deck.

For Datadog, product development drives TAM expansion.  While some product releases provide necessary feature additions within existing product offerings, other releases create entirely new product lines that provide an incremental source of revenue.  Datadog embraces this product line expansion approach and refers to it as its “platform” strategy. The idea is generally that customers would prefer to work with fewer vendors. If one platform can address all use cases in DevSecOps for a customer, then they are comfortable spending more with a vendor.

On the earnings call, Datadog’s CEO expressed excitement for continuing this pace in 2021 and still feels like Datadog is just getting started. They are rapidly rolling out new product offerings that expand their product footprint through all aspects of observability and more importantly into new revenue streams, like security, incident management, developer workflows and pre-production environments.

Datadog’s annual product release cycle generally lines up with their user conference Dash. Normally, this is usually held in July – August of each year. For 2021, it is currently scheduled in October. Dash 2020 last August included a number of major releases:

• Incident Management
• Continuous Profiler
• Error Tracking
• Compliance Monitoring
• Application Marketplace

Dash 2019 was held in July and similarly included announcements for several new products and a number of enhancements.

This is all to say that while 2021 product announcements have been slow thus far, we should expect some major items coming in second half of the year. Given that Datadog has 9 monetized products currently (technically 10 if you separate APM and Continuous Profiler), then the addition of 3-4 new products this year would effectively expand their product footprint by 30-40%.

Customer Usage Expansion

The third dimension of growth is the increase in spend by each customer. Customers will grow their spend in two ways. First, as a result of Datadog’s usage based pricing model, the expansion of their business and application footprint will increase usage. This could be done by adding more hosts to APM, ingesting more data into logs or adding more users to Incident Management. Also, applying monitoring to more applications will accomplish the same. Forrester recently estimated that 5% of all enterprise applications are monitored currently, implying a long ramp towards broader coverage.

Second, Datadog customers will generally start with 1-2 products and add more over time. These growth rates into 2 or more, 4 or more and now 6 or more products are substantial and pretty consistent.

• More than 75% of new customers land with 2 or more products now.
• The percent of customers using 2 or more products increased from 63% to 75% in the last year.
• The percent of customers using 4 or more products increased from 12% to 25% in the last year.
• Datadog just reported that “hundreds” of customers are now using 6 or more products.

Customer expansion is generally scaling based on the amount of time a product has been in the market, which is what we would expect. In other words, the amount of ARR per product is roughly ordered by its release data from oldest to newest. This is a good sign, as it indicates that Datadog is tuned into product/market fit and responsive to the needs of their customers. They are launching new products that customers consistently adopt.

While Datadog management doesn’t break out revenue per product line, they have provided some anecdotal evidence around these trends. In the Q1 earnings call as an example, they reported growth for a few product lines. NPM and RUM were brought to GA a little more than a year ago. Both are generating over $10M (8 figures) of ARR. Synthetics, launched about the same time, is also growing rapidly.

Infrastructure, APM and logs all added record ARR in Q1. The CEO described APM and Logs as being in “hypergrowth” mode, while Infrastructure continues at a “healthy” rate. APM and Logs together added more ARR in Q1 2021 than the business as a whole in Q1 2020.

The Combination

The combination of these 3 expansion vectors powers the engine for Datadog’s future growth. Individually, they provide Datadog management with separate levers to control. A simple way to model this is to consider that each vector is growing at about 30% or more. Q1 2021 total customers expanded by 32% annually. DBNRR was over 130%. We can expect at least 30% more product lines to be added this year. While not an exact science, the length of a (30, 30, 30) vector in 3D space would be about 52 (3D hypotenuse). This roughly implies that a revenue growth rate of at least 50% is sustainable through the combination of these factors.

Product Releases

In the three months since their Q4 earnings report (mid-February), Datadog had a few product announcements. These were primarily enhancements and extensions to existing products. A light release schedule for the first two quarters of the year is normal for Datadog. As an example, by reviewing press releases for 2020, we can see that most major product announcements occurred in the second half of the year.

While we can expect more activity later in 2021, there were several items worth covering briefly. I will highlight some of the enhancements from the quarter below.

First, Datadog announced in late March that its NPM product had been extended to include monitoring for Windows server hosts. While a lot of server infrastructure for digital-native companies is hosted on Linux variants, traditional enterprises utilize large amounts of Windows hosts. This additional capability enables customers to monitor network activity across their entire footprint. Customers can use these tools to monitor for network bottlenecks that can impact application performance or identify oversubscribed connections to optimize costs. As part of the announcement, Datadog claimed they were “the first company to offer monitoring of live traffic between Windows Server hosts.”

Datadog also passed 450 integrations with external systems in Q1. New additions included AWS CloudWatch Metrics Stream, Red Hat Cluster Storage, Azure App Services extension, Juniper, SonarQube, and VoltDB. Integrations with outside systems provide the data source for all Datadog products, so having as much integration breadth as possible is critical for full customer adoption. These integrations are already set up, requiring minimal configuration for a customer to activate them.

Other Q1 product enhancements included:

• Logs Outliers powered by Watchdog Insights
• New detection rules for Security Monitoring for Okta, Kubernetes, and Azure
• Added Core Web Vitals to Browser Tests
• A new user interface for Log Explorer
• Enhanced AWS serverless tracing
• Ability to monitor .NET runtime metrics

Datadog also continues to extend ML/AI support in the platform. Originally launched in 2018, their AI-driven automation capability is called Watchdog. It monitors all performance data and uses machine learning to identify anomalous behavior. Anomalies are surfaced to DevOps personnel, along with indications of probable cause. This helps identifies issues before they might affect service availability. They also lower the burden on human operators to continuously watch dashboards for issues.

In March, Datadog launched Watchdog Insights, which is a recommendation engine that draws the operator’s attention to parts of the system and applications that display an outsized proportion of warning signs. An example might be to surface a log with a high number of error messages. In January, they launched Watchdog RCA (Root Cause Analysis). RCA automatically identifies relationships between different symptoms across a customer’s applications and infrastructure and then pinpoints the root cause. This can speed up time to resolve system issues by highlighting the likely source of the problem for the operator.

Finally, Datadog completed the official launch of their GovCloud instance. This allows government agencies to monitor their AWS GovCloud (US) infrastructure and visualize key application, network and server performance data. This is integrated with all AWS services and works across both AWS GovCloud regions. This addition should further streamline the onboarding of government agency customers.

Future Development

Given Datadog’s large investment in R&D, I suspect that they are working on a few major new product releases for later this year. Additionally, capabilities from past acquisitions have likely been recast into new product offerings within the Datadog platform. I’ll speculate on some of the new product opportunities below. These would all drive an expansion of TAM and represent logical extensions for Datadog across the spectrum of DevSecOps.

When asked about product direction and competitive landscape, leadership continually reinforces their focus on addressing the problems created by the silo-ization of development, security and operations teams. Datadog started by creating products that facilitated the cooperation of development and operations teams (DevOps). As security teams increasingly are pulled into this collaboration, the realm expanded to DevSecOps. This development in modern IT departments is the guiding force behind Datadog’s addition of security products to the platform.

At the same time, leadership is clear about what their focus does not include, at least currently. DevSecOps is applied to the customer-facing applications built and operated by enterprises. It has its foundation in the activities performed to develop, deploy, scale and secure modern software applications. In this context, these are primarily the applications that service end customers, versus employees. The security footprint includes the application’s code, runtime and hosting environment. Datadog has no plans to address traditional enterprise security use cases, like employee devices, office locations, endpoints, etc. This narrows the context of security and provides direction for Datadog’s competitive positioning in the broader security market.

Besides continuing their expansion into variants of application security monitoring and protection, there are other logical extensions into pre-production development activities that Datadog could pursue. These might leverage Datadog’s 2020 acquisition of Undefined Labs and capitalize on industry trends towards “shift left” testing, which essentially attempts to uncover potential production issues during development cycles.

The “operations” label in DevSecOps could also cover a lot of ground. Datadog’s traditional offering in this context has been to provide operations personnel with tooling to monitor software applications and infrastructure for customer-impacting issues. However, once a product issue surfaces, operations teams need to coordinate issue communication, investigation and resolution. This was the genesis behind Datadog’s launch of Incident Management in 2020. There are likely more opportunities to expand into other areas of business operations that extend from the requirements of running the software applications at the core of modern businesses.

Application Security

One of the more clearly telegraphed product moves for Datadog is further into application security. This would leverage the capabilities gained through the acquisition of Sqreen, announced in February and closed in April.  Datadog management has confirmed their intent to expand into application security on the earnings call and preceding analyst events.

Sqreen is a SaaS-based security platform that enables enterprises to detect, block and respond to application level attacks. To do this, they provide a solution for runtime application protection (RASP). In addition to RASP, Sqreen’s solution includes a web application firewall (WAF). Security issues in the application layer are challenging to manage, as the owner needs to allow legitimate traffic, while blocking nefarious activity. Sqreen offers a popular solution for this and claimed to have over 800 customers (which presumably offers some cross-sell opportunity for Datadog).

These capabilities would shift Datadog into application protection, versus monitoring. By having a monitoring agent on every infrastructure host that observes activity at a granular level, Datadog can easily turn on these new capabilities without requiring additional deployment by their customers. Having the agent on every device allows for more active monitoring of security-related context and the ability to take action to prevent further damage once malicious behavior is detected.

It is worth noting that Sqreen is very similar in capabilities and market position to Signal Sciences, which investors will recognize as an acquisition of Fastly from 2020. Signal Sciences is powering the foundation for Fastly’s Secure@Edge product offering. Both Sqreen and Signal Sciences provide a RASP and WAF solution.

Sqreen is an application security solution that actively detects attacks and can track trace them down to the impacted function call. It prevents application security exploits and enables response across development, security and upstream. We are very excited at the combination of Sqreen with our APM and security offerings, as we expect it to allow our customers to protect APM submitted applications with very little additional friction.

DAtadog Earnings Call, Q1 2021

For Datadog, Sqreen provides the ability to offer application-level protection to their customers of observability and security monitoring. This is an important market expansion for investors to note, as it further shifts Datadog into active versus passive application security. I suspect that we will see a new offering for RASP/WAF forthcoming later this year. This should be large enough of an offering to represent a stand-alone, monetized product.

Developer Pipeline and CI/CD

In August 2020, Datadog announced that they had acquired Undefined Labs, which provides testing and observability capabilities for developer workflows before pushing to production. As Datadog’s products have traditionally been focused on the production environment, this acquisition extends their visibility into pre-production development and test cycles (shift left). Undefined Labs’ Scope tool is integrated into CI/CD platforms, like CircleCI and Jenkins, to enable developers to automatically take advantage of monitoring and testing capabilities within their existing workflows. Scope allows developers to execute unit tests, measure performance, tie test failures back to source code and view summarized results in a consolidated dashboard.

This acquisition aligns Datadog more closely with developers during the design and test phases of software development, as opposed to the DevOps teams responsible for managing the production environment. Undefined Labs tools are leveraged by developers when they are creating the first pass of their code and testing it locally on their own machines. This is often before the developer even merges their code with the main branch in their team’s central repository. Because of this, Datadog will have access to all code changes and application behaviors from initial code creation to the finalized form for deployment. This will yield a higher level of insight into the full development process for an engineering team and could provide a launching pad for other developer productivity offerings in the future. This tie-in between progressive code changes through the development and test processes to the final form of the code in production will represent a unique data input for the future Datadog platform. Combined with production code performance, profiling tools will yield valuable insights that Datadog could share with developers early in the code design process.

Datadog’s plan back in 2020 for absorbing the Undefined Labs product set was to sunset their existing products and rebuild them on the Datadog platform, so that full integration is realized off the bat. The engineering team has been actively engaged in this work. This will be another obvious source of new product offerings for 2021.

Datadog’s move in this arena is primarily focused on extending performance monitoring, test execution and compliance into the pre-production environment. They have made it clear they don’t intend to roll a code repository or CI/CD toolset. Connecting pre-production with production represents a smart strategy by Datadog and provides significant value for engineering teams, as it combines DevOps with developer activities. Not only will this yield another source of product revenue streams, but it would represent a significant advantage over other observability and security vendors by addressing a broader set of DevSecOps use cases by adding code-level insights.

Operations Continuity

Incident Management streamlines on-call response workflows for DevOps teams by unifying alerting data, documentation, and collaboration into a centralized view. Incident response benefits from being accessed alongside the actual observability data associated with the service issue, as in Datadog’s interface. This allows DevOps personnel to initiate an incident from signals or events surfaced in an observability tool. An example would be Synthetic Monitoring indicating a time-out for a web page request. To facilitate on-call communications, Datadog’s incident management solution includes an integration with their mobile app and a dedicated issue response Slack channel.

This product was launched in beta as part of Datadog’s annual Dash conference in August 2020 and was moved to GA in February 2021. Incident Management is billed starting at $20/month/user. A user is defined as someone who contributes comments or signals (graphs, links, etc.) to an incident. Anyone who only opens/closes an incident or simply views the incident is not counted as an active user. This makes sense and would follow a typical incident response workflow, where there would be a few primary responders working the incident and a lot of other interested parties viewing or tracking the work.

I think adding incident management to the Datadog product set is a very natural extension of their offering. The audience for observability tools and incident management is largely the same (DevOps). For applications delivered over the Internet, incidents are usually initiated in response to a signal noted in an observability system. Even if the issue is first raised by customer service, DevOps personnel usually quickly associate it with data in their monitoring system, like a time-out on a web page or API request. Investigation is also driven through observability systems, as DevOps personnel dig through logs, graphs, APM, security data, etc. to identify root cause. Having the incident management tool deeply integrated with the observability platform makes it very easy to assemble and share troubleshooting data. All of this information could be attached to the incident management ticket that is then used by DevOps personnel to address the issue.

From an addressable market perspective, Datadog’s Incident Management product overlaps with aspects of PagerDuty’s Incident Response offering. While Datadog’s Incident Management product description includes reference to integration with other on-call notification services like PagerDuty and OpsGenie, that service integration only refers to PagerDuty’s core on-call management and notifications product. As PagerDuty investors may know, the company started in on-call notifications, and layered additional workflow and visibility products around this over time to grow their reach. Incident Response has been a source of incremental revenue for PagerDuty beyond basic on-call management. Datadog’s move into this space is a logical extension for them, as most of the incidents for a customer organization would be associated with an event surfaced by one of Datadog’s observability tools. Given that Datadog already has the context for the incident in its interface, including incident management in the same toolset provides greater efficiency for the DevOps team that responds.

Now that Datadog has Incident Management in GA, they may be working on further capabilities to facilitate the measurement, monitoring and communication of business operations. Given that most digital-native enterprises have a software application at the core of the business, this is a natural extension. At a recent analyst event, the CFO discussed future product opportunities. He mentioned BI and data visualization as possibilities, as well as operational analytics and intelligence. These insights could extend to teams both within the DevSecOps sphere and operational groups that need access to near real-time updates on business activity.

Competitive Landscape

I have covered Datadog’s competitive position fairly extensively in past blog posts. These included my original write-up on Datadog and subsequent quarterly updates. Additionally, my coverage of Elastic has included competitive commentary as well. In the interest of brevity, I won’t repeat all of that here. Rather, I will provide some broad observations relative to competitive positioning and highlight notable activities.

The observability market as a whole is large. Datadog leadership recently estimated it to be in the low $40B range, and that didn’t include some of their latest product additions. This has attracted many entrants, ranging from publicly traded companies to start-ups. At the same time, we are witnessing consolidation, with some smaller companies getting acquired by larger ones recently. Examples include ServiceNow and Lightstep, IBM and Instana, and Crowdstrike and Humio. This consolidation is an indication of market maturity and solidification of the positions of the leaders. Arguably, these smaller, private observability providers needed to combine with a larger company in order to grow in a crowded market.

Additionally, we could consider the observability market as becoming a bit commoditized. I think the notion of a commodity product as represented by feature parity between providers has emerged in observability. While differences in usability of individual product offerings is important, providers have been rapidly filling out their checklist of features. Initially, this meant addressing the “3 pillars of observability”, which translated into offering a product for log analysis, APM and infrastructure monitoring. Datadog was first to achieve this, quickly followed by Splunk, New Relic and Dynatrace. Providers, including Datadog, have been expanding into other areas as well, like network monitoring, security, and variants of end user performance (RUM, Synthetics, etc.).

What this has resulted in is a situation in which observability vendors are being evaluated on the breadth of their platform offering. Point solutions that address just log analysis, APM, network monitoring or synthetics are no longer tenable. This explains some of the recent acquisitions, where the acquired company addressed a couple of use cases. Since most point offerings look the same, vendors are judged based on the number of feature solutions they support, with the broadest offering generally winning. This development has favored the larger vendors, with the R&D budget or balance sheet to support adding all features through internal development or acquisition.

Going forward, I expect this to persist. The leading vendors will continue to expand their offerings to check more of the boxes in a CTO/CIO observability checklist. Given that most observability solutions have some set up cost (agent installation, data collection, operator training, alert configuration, etc.), reduction of providers is more efficient where features are similar. Also, it simplifies issue investigation by reducing the number of monitoring systems to check. Toggling between multiple monitoring tools is not efficient for DevSecOps personnel. These trends further support the hegemony of the largest vendors and creates a formidable barrier of entry for new entrants (hard to win market share with just a couple of point solutions).

In this regard, then, while observability can be considered to be commoditized, the commodity feature sets are expected to be complete. This means that a broad platform offering that includes every possible monitor (RUM, synthetics, networking, serverless, etc.) will more likely win out over one that doesn’t. If nothing else, feature inclusion provides customers with future optionality. In the 2010’s, engineering teams (mine included) accepted the idea of having a separate vendor for logs (Splunk, Elastic), APM (New Relic, Dynatrace) and infrastructure (Datadog, open source). Now, it is reasonable and more efficient to expect one vendor to address all of these.

This explains why Datadog (and its competitors) have been rushing to build out so many new offerings. For Datadog, this has been accomplished largely through internal R&D. For others like Splunk, acquisitions filled in large gaps, like APM. Product development velocity and feature delivery will continue to be critical and justifies Datadog’s outsized investment in R&D.

The other implication of product commoditization, namely price compression, appears to be emerging in part. This is evidenced by some vendors in the space consolidating their pricing models into a single bundled usage fee, that scales based on data ingestion or user accounts. They even promote substantial discounts up front and try to differentiate themselves based on lower price.

This trend doesn’t appear to have affected Datadog, at least up to this point. They still maintain separate pricing for each product offering, which scales individually based on usage. When asked on the Q1 earnings call about collapsing pricing models and heavy discounting from competitors, Datadog leadership replied that they haven’t been impacted. Granted, they admitted offering volume discounts for their largest $10M+ customers (and even mention this on the pricing page), but volume discounts would be expected for any type of IT spend and isn’t reflective of price commoditization.

I think this pricing model will be sustainable for Datadog, primarily due to the value that observability provides. A CTO/CIO expects to spend some percentage (usually 5-10%) of their overall IT budget on observability. Given the importance of monitoring and issue resolution to deliver a positive user experience, this spend can be justified. Customers will likely continue to expect more functionality for their spend each year, but observability budgets can increase proportionally to their IT budget. As more business is conducted over digital channels, observability budgets should continue to expand.

This puts Datadog in a favorable position. Datadog is emerging as a leader in the observability space. This is now primarily an execution game. They are expanding their platform faster than any of the major competitors. They are also growing revenue faster. And they continue to improve their competitive position in each category.

Gartner APM Magic Quadrant

To illustrate Datadog’s continued improvement in the product landscape, we received a useful data point when Gartner released their annual Magic Quadrant report for APM in April. For those not familiar with Gartner’s Magic Quadrant, they publish a researched report annually for various IT categories which attempts to rank vendors across a number of criteria. The quadrant has two axes – ability to execute and completeness of vision. Ability to execute reflects go-to-market and relative penetration in the space. Completeness of vision represents the breadth of the product offering and strategic direction.

The Quadrant is divided into four sections, with “Leaders” consisting of the subset of providers that have the highest ratings across both axes. Moving between quadrants is a significant achievement. While these industry analyst reports can be viewed with some skepticism, they can influence buying decisions, particularly for more traditional enterprises that lean on consultants to make IT purchase decisions and drive implementations.

For me, the most telling outcome of the Gartner reports is not the absolute position of a vendor. There is certainly some inertia once a large, long-time provider is placed in the leader’s quadrant. Rather, the relative change in position from one year to the next is more revealing. If a vendor makes a substantial change in position, that is worth recognizing. This is because that vendor needed to have such a significant improvement that it overcomes all the jockeying from competitors and their product marketing departments.

In this regard, Datadog made the most substantial improvement from 2020 to 2021 in APM. To make it clear, I provide the Magic Quadrant for APM from 2020 and draw the relative change in position for each vendor between 2020 and 2021. Green lines represent a positive change, red lines are negative. Dynatrace maintained roughly the same relative position.

I think this view highlights the significance of Datadog’s improvement in competitive position and their commitment to rapid product development across all fronts. APM is a critical component of an overall observability solution – I would even call it the most important, given its direct relationship with user experience. While one data point, I think this helps illustrate the ascendancy of Datadog as the leading observability provider in the space and explains their continued accelerated growth. As a sidenote, Elastic made an appearance on this year’s Magic Quadrant. I will address that in a separate update on ESTC.

Competitor Activity Highlights

At a basic level, the easiest way to evaluate Datadog’s competitive position objectively is to compare its execution against the recognized competitors in the observability space. While side-by-side product comparisons might yield some insights (and I have done this in past blog posts), at this point, we can consider Datadog and their competitors to have executed their product development roadmaps and go-to-market strategies at scale over the last year. Therefore, differences between competitors can be judged based on their financial results, versus subjective product quality.

Given that the market is still expanding, relatively greenfield and that most companies are in growth mode, sales growth provides a reasonable comparison. For this, we can use revenue primarily. Also, the total amount of revenue provides a sense for scale (it’s easier to grow quickly on smaller numbers). Let’s take a look at the most recent quarter for the public providers.

Company	Total Revenue	Annual Growth	Other Indicator
DDOG	$199M	51%
ESTC	$157M	39%
DT	$197M	31%
SUMO	$54M	22%
NEWR	$173M	8%
SPLK	$745M	-6%	ARR up 41%

Parsing through these results at a high level, it is noteworthy that Datadog has now passed Dynatrace in total revenue generation, as well as New Relic. Given Datadog’s continued high revenue growth rates, I don’t see how Dynatrace, New Relic or even Sumo Logic will catch up to them going forward. Elastic was able to sustain high revenue growth rates above 50% before 2020, but those have decelerated in the last year. They may stabilize in the 40% range as 2021 progresses, but Datadog is now larger and growing more quickly. I cover Elastic separately, as they have some other interesting capabilities outside of observability.

This leaves Splunk, which is undergoing a major transformation from a hosted to cloud delivery model. This has impacted revenue recognition during the transition period, causing actual revenue growth to appear flat. Splunk leadership highlights ARR growth as a proxy and calls out growth in cloud specific revenue. Along these lines, Splunk is executing well. In their recent quarter, they reported total ARR up 41% year/year and cloud specific ARR (about one-fourth of the total) up 83%. Similarly, while overall revenue was down year/year, revenue for their new cloud offerings was up 72% year/year at a run rate of $171M.

While Splunk’s cloud migration appears to be executing well, sustained high growth is far from guaranteed. Cloud revenue and ARR growth will likely slow down as customers complete the migration. Additionally, Splunk has been exhibiting other execution challenges. The stock took a hit back in April with the surprise departure of their long-time CTO. Also, much of their product expansion has been through acquisitions, like SignalFx for APM. They appear to have been struggling to create a cohesive platform that includes a comparable set of observability offerings powered from a single data set. And acquisitions don’t seem to have resulted in improved relative quality of each product offering, at least as evidenced by the Gartner report on APM.

In early May, Splunk announced the Observability Cloud, which represents a consolidated platform offering that appears to include a full feature set. This may provide a better foundation for future growth. My concern is with the time it required to complete this. Datadog has had a similar offering in market for a year or more, and is continuing to press forward. This is where the pace of organic product development creates competitive advantage. Regardless, given Splunk’s scale and enterprise customer penetration, I plan to monitor their progress closely and acknowledge their success could impact Datadog’s competitive position in the future.

Crowdstrike and Humio

On February 18th, Crowdstrike announced the acquisition of Humio for $400M. Humio provides a highly scalable streaming log management platform, which has applications for security monitoring and observability. The platform can ingest any type of log data, like system logs, metrics, traces, etc. and rapidly aggregate them for visualization. They list about 50 supported integrations with common infrastructure services. Humio has accumulated a number of active customers, including Bloomberg, HPE, Lunar and Michigan State University. I covered this acquisition in more detail in my Datadog Q4 Recap.

Since then, Crowdstrike discussed Humio briefly on their Q4 earnings call and Investor Briefing. Near term, Humio enhances Crowdstrike’s back-end data processing and provides more data sources to inform the effectiveness of their security solution. Humio brings log management technology to allow Crowdstrike to rapidly ingest logs from many sources and surface insights for security monitoring. The initial planned application is to enhance the performance and reach of Crowdstrike’s EDR product to address what the industry is now calling eXtended Detection and Response (XDR). XDR essentially builds on the same capabilities enabled by EDR, but casts a wider net of data collection across a customer’s infrastructure.

Longer term, Crowdstrike has voiced aspirations to move outside of security and into adjacent data processing applications, like generalized log management, SIEM and observability. On the Q4 Earnings call, they hint at Humio providing the foundation for a new business unit that will disrupt the log management and observability markets. They also disclosed that Humio will contribute about $2M to ARR in Q1. The deal closed on March 5th, implying that a full quarter of ARR would be about $3-4M (Crowdstrike Q1 is Feb – April).

We believe that combining Humio’s data ingestion and analysis engine with the CrowdStrike agent technology which provides OS- and application process-level telemetry, introspection capabilities, and smart filtering, will create a powerful data platform with a new level of speed and efficiency. This can be transformative and provide a fundamental advantage that has the potential to disrupt the log management and observability markets. Humio builds on the momentum we have already achieved with Falcon Spotlight and Falcon Discover to grow our total addressable market by solving broader use cases outside of traditional security. On day 1, Humio broadens our reach into the log management market.

This market alone is forecasted to be $4.9 billion in 2023 based upon IDC estimates. And that does not include any potential adjacencies, such as the massive observability market. Looking forward, we have even greater plans for this new CrowdStrike business unit. While it will take some time and investment to deliver this powerful combination to the market, we believe it has the potential to open up massive new TAM for CrowdStrike, provide a runway for growth well into the future, and ultimately create another line of business on par with our security business.

Crowdstrike Q4 EArnings Call, Mar 2021

This will be a development to watch. Crowdstrike is a leader in security and has demonstrated near flawless execution in dominating that space. I think they will continue to lead the security market and increase their share. However, I am skeptical of how easy it will be for them to gain substantial traction in the traditional observability market. As a sidenote, I am a CRWD investor and expect significant growth from them in general.

For one, the customer for observability is different. Enterprise security tends to sell into the security group led by a CISO or CIO. Observability products are sold to the DevOps team, generally as part of an Engineering organization led by a CTO or VP Engineering. This would require a different sales motion and go-to market team. Conceptually, it would require some adjustment to purchase an APM solution from Crowdstrike.

Second, as we discussed above, full observability is moving away from point solutions to complete product suites. In order to win attention from large customers, a provider should be able to address all use cases for customer application observability. These range from Infrastructure, Logs, APM and network monitoring at the core to RUM, Synthetics and profiling at the customer edge. Humio is largely a log analysis solution currently. It will require substantial development to expand into a full observability suite.

Just as Datadog has plans to address some, but not all, security use cases, Crowdstrike will likely peel off some observability ones. On the earnings call, Datadog made it clear they aren’t pursuing enterprise security and endpoint protection. It’s likely Crowdstrike will focus their observability solutions on specific market segments as well, possibly within security operations. In the near term, these markets have enormous TAM’s and both companies have plenty of room to grow. Long term, investors will want to watch for further encroachment and competitive positioning between these two leaders.

Hyperscalers

It is worth mentioning the relationship between Datadog (and other observability providers) and the hyperscalers. The key observation is that the hyperscalers have generally not deployed a full observability solution that competes in the space. Rather, they have formed partnerships with leading observability providers to make monitoring services available to their customers.

This is an important distinction for the observability vendors’ competitive position and market opportunity. In other software sectors, like data storage, identity, analytics, machine learning, etc., the hyperscalers have deployed their own products and services. For observability, they have largely conceded the landscape to the specialists. As an example, AWS just launched their new App Runner service (fully managed container service for delivering web apps). In parallel, Datadog announced that they are an AWS launch partner to provide resource monitoring and error tracking capabilities for the new service. These types of relationships effectively expand the market opportunity for the independent observability providers.

Datadog has relationships with all three of the largest cloud providers – AWS, Azure and GCP. These generally involve a listing in the cloud vendor’s marketplace, consolidated billing, and some co-development, like integrations between Datadog and cloud infrastructure services. The idea is to make it easy for customers of the cloud providers to sign up with Datadog and utilize the service. The cloud provider presumably gets a cut of sales, just like other distribution partners. These relationships between Datadog and the cloud vendors are not exclusive – Datadog maintains them with any hyperscaler, and the cloud vendors forge similar relationships with other observability providers.

Final Thoughts and Investment Plan

The headline story for Datadog is the re-acceleration of revenue growth going into the back half of 2021. This is evidenced by their Q2 guidance and the full year raise from 38% to 47% growth. In Datadog fashion, this is likely conservative and they expect to beat these estimates. Full year revenue guidance is now for $885M at the midpoint, up $55M from their initial 2021 estimate of $830M set in February. If this trend continues, Datadog could exit 2021 approaching $1B in revenue and 60% year/year growth.

This trajectory is supported by underlying metrics. Billings, RPO and current RPO all grew faster than revenue in Q1. The ARR increase was a record (in a slow quarter), crossing $100M for the first time. This wasn’t at the expense of profitability either. Operating margin remained around 10% and FCF margin hit 22%. This is after accelerated headcount growth of 56% in 2020 and continued outsized investment in R&D and S&M this year.

Customer metrics demonstrate that Datadog’s expansion flywheel is continuing to spin. Total customer adds in Q1 were on par with prior quarters and up 32% year/year. Expansion of existing customer spend maintained its momentum, with DBNRR above 130% for the 15th straight quarter. The number of customers with more than $100k in ARR surged past 1,000 and was up 50% year/year. This is being driven by rapid growth in multiple product line adoption, with a new metric revealed of “hundreds of customers” now using 6 or more products.

The pace of product delivery is not slowing down and is following the heavy investment in R&D. Datadog brought two more products to GA status so far this year and we can expect more in the second half, coinciding with the Dash user conference in October. Datadog now has 9 (technically 10) monetized product offerings as part of the platform suite. New product development will likely pursue opportunities in application security, pre-production tooling and business operations. We should expect repackaging of capabilities gained from prior acquisitions like Sqreen (RASP) and Undefined Labs (CI/CD support).

All of this provides a favorable set up for Datadog for the remainder of 2021 and even the next couple of years. Analyst revenue estimates looking forward are beatable. Datadog leadership appears to have engineered a repeatable formula for customer adds, usage expansion and new product releases that drives sustained high growth in a predictably controllable way. Following Datadog’s Q1 results, analysts raised their revenue targets for 2022 and 2023 by $100M each. These still appear conservative to me.

• 2021: Revenue estimate for $888.7M (up 47.3%)
• 2022: $1.188B (up 33.6%)
• 2023: $1.392B (up 25.6%)

My target for 2021 revenue is $965M representing nearly 60% growth. Further, I think Datadog can grow north of 40% over the next two years. I think the flywheel of customer adds, usage expansion and new product offerings will allow Datadog to grow comfortably into its projected $40B TAM. While the competitive landscape is mature, Datadog is emerging as a leading provider and still claims that most of their new deals are replacements for open source DIY efforts. Smaller players are being absorbed into larger software companies and opportunities for new entrants at this point are limited. Compared to their traditional publicly-traded competitors, Datadog is growing total revenue faster and has passed most in run rate.

With this in mind, I have increased the allocation to DDOG in my personal portfolio. It is now one of my largest holdings, as I think the end of year stock price could reclaim $120 (about a 50% gain from current prices) and possibly go even higher. This all depends on how the market treats valuation multiples for high growth stocks in the second half of the year. If we maintain the current multiples (which are down from 2020), the stock should end the year at the lower end of that range, with some upside possible if multiples expand again.

I understand that some investors consider valuation multiples to still be elevated and that a reversion to mean will continue in 2021. Of course, the opposite could happen as well. The key for me is that once multiples do bottom out, then future stock price appreciation will scale roughly with revenue growth. I seek companies for which I think a high rate of revenue growth is sustainable for several years, outperforming analyst estimates in the forward-looking periods. For Datadog, I think that will be the case.

As a final (arguably optimistic) anecdote, at the Raymond James Investor Conference in early March, Datadog’s CFO made a funny remark. It may have been sarcastic, or reflects leadership’s view of the growth opportunity. When asked about expectations for revenue growth over the next 3-5 years, the CFO responded that they are generally conservative guiders and expect to beat and raise. He then pointed out that Datadog was growing at 80% year/year previously and that it “may not be possible to maintain 80% as you get into the billions of revenue.” We will see.

NOTE: This article does not represent investment advice and is solely the author’s opinion for managing his own investment portfolio. Readers are expected to perform their own due diligence before making investment decisions. Please see the Disclaimer for more detail.