Shared context turns production data into faster risk response

In the rapidly evolving landscape of software delivery, security and engineering teams must collaborate more closely, as adversaries leverage AI to accelerate their threats. This necessitates shared context from production data, enabling both sides to prioritize risks and respond efficiently. At Black Hat USA 2026, the need for this collaboration was highlighted as a significant challenge.

Historically, data silos have caused delays, as security teams often lack visibility into production data while engineering teams struggle to comprehend the security implications of requested fixes, according to Emilio Escobar, chief information security officer of Datadog Inc.

Escobar emphasized the importance of unifying the context for both teams, allowing them to view the same data from different angles. This shared perspective facilitates rapid problem-solving, as security teams can investigate threats on servers while engineering teams address issues like CPU saturation affecting customer-facing functions. The root cause, such as a crypto miner, remains the same, but without shared data, teams waste time pursuing separate solutions.

Risk prioritization becomes more effective when both teams have access to the same information. For instance, a vulnerability on an internet-exposed critical business function with a known exploit should be given higher priority than a similar issue buried deep within the infrastructure without an active exploit path. Without runtime and traffic context, both problems appear equally urgent, leading to tension when engineering is asked to act on them.

Escobar noted that many security teams lack the necessary runtime and application-level information, which is essential for understanding the full impact of vulnerabilities.

Traditional security tooling often focuses on surface-level aspects like attack surface, external scans, or infrastructure posture, rather than providing actionable insights into what is happening inside running applications and supporting systems. Escobar stressed the need for the right agents for the right use cases, enabling teams to remediate problems rather than merely identifying them.

By fostering shared context and deep visibility into runtime and application-level data, security and engineering teams can work more efficiently, prioritize risks appropriately, and respond to threats without friction.