AI now touches APIs, databases, data warehouses, and back-end systems, and the attack surface has grown with it. Attackers are using the same technology to exploit systems in real time, while security tools built around pre-production checks are struggling to keep up. In this conversation with CISO Forum, Anupam Kumar Jha, Head of Solutions Engineering – India, Datadog, argues that runtime context is now critical. He explains why siloed security and observability tools slow down incident response, how CISOs can gain visibility into AI agents and shadow AI, and why only a fraction of vulnerabilities truly demand urgent action. He also outlines three priorities CISOs should act on in the next 90 days.
CISO Forum: AI is now both a security tool and a security risk. Beyond the hype, what has actually changed in enterprise security over the last 12 months?
Anupam Kumar Jha: With the advancement of AI and the introduction of AI technologies, AI now has access to companies, APIs, databases, data warehouses, back-end systems, and infrastructure. As AI adoption has increased, the attack surface has grown from a security standpoint. Over the last 12 months, new attack vectors have emerged due to advances in AI.
As a result, it has become more important than ever to have a modern security solution that can address these new attack parameters and unify the context in a single space. That’s what Datadog is also doing.
CISO Forum: How are attackers using AI today, whether for phishing, deepfakes, faster reconnaissance, or exploit development? In Indian enterprises specifically, what are you seeing?
Anupam Kumar Jha: India is no exception. This is happening globally and in India.
As I said, with the advancement of AI, it now has access to different systems, and defending against these new types of attacks has become increasingly important. What has changed is that security has shifted from being static to gaining runtime visibility as attacks occur and attackers attempt to access your production systems.
With AI, attackers can now exploit your systems in real time, whether through vulnerabilities, phishing, or other methods.
There are new attack vectors, like data exfiltration and sensitive data leakage. It has become more important to consider runtime context because the legacy approach of looking at things before production is no longer enough.
You need that runtime visibility as these attacks are happening, so you can respond promptly and have the context of system performance issues and security in the same place.
That’s something that’s happening in India as well as globally.
CISO Forum: The gap between a vulnerability being disclosed and exploited keeps shrinking. How should security teams rethink detection and response speed?
Anupam Kumar Jha: When we talk about security exploits, they happen in three stages. There are three important parameters: first, detecting them as and when they occur.
The second is identifying the resolution, and the third is implementing that resolution and the remediation itself. As the gap shrinks, enterprises need a system or platform that can handle all three in one place.
Datadog is also doing that. It already has observability context, including system, API, and infrastructure performance. When an exploit occurs at runtime, Datadog can detect it from either an AI- or non-AI-attack perspective.
Because we have both observability and attack context, we can provide faster resolution and remediation.
Enterprises and new-age companies should consider moving to a more unified approach to system performance and security. That will make resolution and remediation much faster.
Attackers are using these AI solutions, just like developers, to identify and attack systems faster. We need an upgrade to a modern solution that can detect, respond to, and remediate these attacks more effectively, and Datadog is helping customers do that.
CISO Forum: AI applications introduce new attack surfaces, including prompt injection, data poisoning, and compromised model supply chains. Which of these risks are enterprises underestimating most?
Anupam Kumar Jha: The company should move toward upgrading and modernizing its systems to better handle these new attack vectors.
In the age of AI, pre-production checks and vulnerability detection were the legacy approaches. That’s no longer going to suffice as new attack vectors emerge.
Organizations should look for modern, more context-oriented solutions that can handle these new types of attacks and, in real time, bring together data points from different stages of the application lifecycle with runtime context.
Organizations should go for that. As I talk about this, runtime context becomes even more important. Datadog offers solutions such as AI Guard, which can detect modern attack vectors and combine them with context from system performance and user experience, since these data points come from a single platform rather than being disjointed.
These need to be more context-oriented and more connected. That is where organizations should move, and Datadog is helping to empower that shift.
CISO Forum: Teams are adopting AI tools faster than IT can track. How can CISOs get visibility into shadow AI without slowing innovation?
Anupam Kumar Jha: When we talk about the pace of innovation, there is a concept in AI called context engineering, which is about bringing more and more context into a single place. As these advancements are happening, it’s not about slowing them down. Velocity is really important. And that should continue to, you know, be at the same pace or even improve the pace at which it is going.
But what is increasingly more important is, as you are expanding with the velocity that people are and shipping features with the velocity that organizations are at the same run rate, you need visibility and connected visibility across each, you know, each of the elements that comprise an IT stack.
If I have to give an example, within a typical, you know, AI stack today, you would have AI agents that you would consume from different model providers. You would have your own in-house built AI agents as well. You will have APIs, you’ll have infrastructure, you’ll have databases.
As and when these fast advancements are happening across all of these different entities, at the same pace, you need a tool that can give you the entire attack surface, the security posture of the entire attack surface.
It’s becoming increasingly more important to be able to have a view of the entire attack surface, including the modern AI agents and, you know, the large language models that people consume, so that you’re able to keep your security posture and keep pace with the pace of innovation.
That needs to happen, especially with AI. Because with AI, we spoke previously, there are new attack vectors, there are new types of attacks. Attackers are using AI to exploit your systems faster. And hence, your security posture must be able to match the speed of the innovation that’s happening on the business side.
CISO Forum: Agentic AI refers to software that acts autonomously, with credentials and access to critical systems. How should organizations handle identity, permissions, and accountability for these agents?
Anupam Kumar Jha: Autonomy without trust is a liability. If you have autonomous systems but you can’t trust them, they’re practically of no use.
That raises the question: should we avoid autonomy altogether? Like, should we stop it altogether? And the answer is no. The answer is autonomy: autonomous systems, automatic workflows are great.
And that, you know, using it in the right way is making our systems and organizations and the pace of innovation in general. It’s taking it and heading it in the right direction.
But what you need to focus on is how you can make your autonomous systems more trustworthy. You know, how you can enhance trust in them. And the way you enhance trust in them is by having complete visibility into what those systems and AI systems are accessing.
Let’s imagine you have an autonomous system, which is accessing your APIs, your databases, you know, your sensitive information within an organization. And if I told you that you would have X-ray vision or a complete vision into everything that that system is accessing, it is acting upon, you know, and it is part of, that will help give you confidence that, okay, I have a view into everything that this autonomous agent is doing.
And that is what is needed to maintain the pace of this autonomy and also do it with confidence. The answer to your question is that, as this innovation progresses and this autonomy picks up pace, it should continue at the same pace, but not at the cost of trust.
And what do we need to improve the, you know, the quality and the trust factor? It’s by having visibility into everything that your AI agent is accessing and acting upon. Once you have that visibility across the board, that would help in, you know, continuing at the pace at which the businesses are growing.
CISO Forum: On the defense side, where is AI genuinely helping security operations, in areas like alert fatigue and triage? Where must humans stay firmly in the loop?
Anupam Kumar Jha: Datadog actually published a report recently. And it has a very interesting data point. If you apply runtime context, so we did a report of like all the vulnerabilities or threats that arise out of systems.
And if you apply runtime context to all those vulnerabilities and threats, only 18% are truly critical and need to be acted upon immediately. And the rest 82% can actually be reprioritized.
That’s relevant because, as we talk about AI advancements, you also use AI-based prioritization to figure out what you actually need to work on, basically. Carrying that runtime context with these AI-powered technologies, like Datadog, is also one of them, where we can tell you, “Hey, out of these several vulnerabilities or threats you really have, this is what is going to have a real impact on your system.”
AI-based prioritization is something that is really, really relevant in that conversation. And that, in the runtime context that I spoke about, becomes even more powerful. Datadog is adding a third layer on top: the observability context, which shows how your systems are also performing. So clubbing all of that addresses that point where, like you mentioned, how can AI be used in prioritization of these security threats as well.
CISO Forum: Security and observability data still sit in separate tools in most organizations. How does that silo affect the time it takes to detect and contain an incident, and how does convergence change that?
Anupam Kumar Jha: Like, imagine any typical organization or business; they would have so many different technology stacks that make up their entire platform: databases, on-prem systems, cloud systems, APIs, microservices, and so on and so on.
Now, imagine you had separate security solutions and siloed security solutions for each one of them, which was the case, which continues to be the case for a lot of organizations.
And suddenly you’re informed by someone, or your internal systems detect, that there has been a security breach, a security threat, or a vulnerability.
Now imagine you having to go through all of these- six, seven, eight, 10 different platforms- and then trying to figure out where exactly the root cause was.
And even if you figure out where the root cause was, you would not have context into, okay, how did this security problem affect my database? How did it affect my infrastructure? How did it affect my APIs? You would not have any context because you’re using different, siloed tools for each layer. That is what happens in many cases. And as a result of that, what happens is your time to respond, your time to detect, respond, and resolve these incidents becomes exponentially higher.
And that’s what Datadog truly believes in: that if you have all of these contexts from all of these systems- observability context as well as security context across all of these layers in a single platform, you will be able to detect, diagnose, and resolve those much, much faster and quicker.
CISO Forum: With the DPDP Act in force, sensitive data can leak through prompts, logs, and model outputs. What should Indian enterprises do first to stay compliant as AI usage scales?
Anupam Kumar Jha: It’s not limited to Indian organizations; it applies to them as well. As AI adoption is increasing and the use of AI agents within any system is increasing, we are seeing the attack surface has really broadened across infrastructure, databases, APIs, like all the systems we spoke about, and there are new attack vectors. That people need to deal with. And that’s why the importance of a solution that can give you that can detect those new attacks for you, even block them where possible, is the need of the hour, and also be able to give you those threats and attack details in context to your system performance details.
That’s something that is really needed for these organizations who are adopting AI really, really quickly. The pace of innovation with AI needs to keep up with the security pace as well. How you secure the pace at which you secure all of these systems, and for that to happen, you need modern systems that can detect modern attack vectors and give you context on how those attack vectors are affecting system performance. And I previously mentioned Datadog has tools specifically for that. AI Guard is one of our very popular solutions. AI Guard and the sensitive data scanner are available in Datadog for consumers to use, and they are used to detect certain modern attacks.
CISO Forum: If a CISO could act on only three things in the next 90 days as AI adoption accelerates, what should they be?
Anupam Kumar Jha: One would definitely be to make a map, almost like getting a view of all the AI agents and AI systems that they have and what type of information they are accessing, and whether they can access it, because, as I said, getting a view into your AI use is really, really important. So, that’s number one. Number two is they should be looking at security and observability, not as siloed solutions, but rather something that is, you know, something that sits in a single platform and can get more context and unify the context from security and observability, especially with the adoption of AI.
That’s something that definitely needs to happen. And number three would be: we’ve mentioned it in a few answers, as the attack surface is widening, people should, and organizations should. The attack surface is widening. People should, and organizations should be equipped to deal with those new attack vectors in a much more connected way. Those are the three things that people should really focus on.
