--- title: Investigate every security event with an AI agent,... description: Datadog built a two-stage security detection pipeline to make AI-driven threat investigation practical at fleet scale. The first stage is Mambark, a... canonical: https://daily.dev/posts/investigate-every-security-event-with-an-ai-agent-without-the-frontier-bill-xe22yn4xd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Investigate every security event with an AI agent, without the frontier bill | daily.dev og:description: Datadog built a two-stage security detection pipeline to make AI-driven threat investigation practical at fleet scale. The first stage is Mambark, a... og:url: https://daily.dev/posts/investigate-every-security-event-with-an-ai-agent-without-the-frontier-bill-xe22yn4xd og:image: https://api.daily.dev/og/posts/XE22YN4XD.png og:image:alt: Investigate every security event with an AI agent, without the frontier bill og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Investigate every security event with an AI agent, without the frontier bill **[Datadog](https://daily.dev/sources/datadog)** · 8 min read · 0 upvotes · 0 comments ## Summary Datadog built a two-stage security detection pipeline to make AI-driven threat investigation practical at fleet scale. The first stage is Mambark, a 96.9M-parameter Mamba selective state-space model pretrained on hundreds of billions of audit log events. It scores every event using next-token prediction as an anomaly signal (no labels required), running in linear time to handle sequences of tens of thousands of events. From 10 billion daily events, it surfaces roughly 10,000 suspicious candidates at a cost of tens of dollars per day on commodity GPUs. The second stage is an LLM agent that performs full multi-step investigations only on this prescreened shortlist, keeping its cost similarly low — roughly four orders of magnitude cheaper than applying a frontier model to the raw stream. Mambark uses a uniform tokenization scheme across syslog, authentication, network, and insider-threat data with no hand-engineered features, and matches or exceeds state-of-the-art results on benchmarks including Thunderbird (F1 1.000), BGL (F1 0.999), and UNSW-NB15 (F1 0.994). The pipeline is currently in limited testing with Datadog Cloud SIEM design partners. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Datadog make AI agent-based security investigation affordable at scale? Datadog uses a two-stage pipeline: Mambark, a ~96.9 million parameter Mamba state-space model, scores every event in a stream via a single forward pass, forwarding only the most suspicious ones (around 10,000 out of 10 billion daily events) to an AI agent. This cuts agent investigation cost from tens of millions of dollars a day to roughly tens of dollars a day. _daily.dev surfaces engineering approaches like this for teams weighing AI agent costs against detection coverage._ ### What is Mambark and what benchmarks does it perform well on? Mambark is a Mamba selective state-space model with about 96.9 million parameters, pretrained on hundreds of billions of security audit log events for next-event prediction. It achieves F1 scores of 1.000 on Thunderbird, 0.999 on BGL, 0.994 on UNSW-NB15, an AUC of 0.987 on LANL Cyber1, F1 0.941 and AUC 1.000 on HDFS, and AUC 0.879 on CERT Insider Threat, using one backbone across all datasets. _Engineers evaluating anomaly-detection models for security pipelines can track results like these on daily.dev._ ### Why can't a frontier LLM agent alone scan every security log event for threats? Scoring every security-relevant event with a frontier LLM could cost tens of millions of dollars a day for a large enterprise, since reasoning over each event is computationally expensive. Interactive search only finds anomalies you already know to look for, so spotting a rare hidden anomaly among billions of events is a ranking problem requiring a cheap scorer, not a search problem an agent alone can solve. _daily.dev helps engineers weigh cost tradeoffs like this when designing AI-driven detection architectures._ ## Similar posts on daily.dev - [What we learned about AI agent security by monitoring our agents](https://daily.dev/posts/what-we-learned-about-ai-agent-security-by-monitoring-our-agents-mt55zajk6) · Datadog · 0 upvotes · 0 comments - [Scaling Security Alert Triage With Specialized Agents on Databricks](https://daily.dev/posts/scaling-security-alert-triage-with-specialized-agents-on-databricks-xgk54fnsn) · databricks · 1 upvotes · 0 comments - [Datadog Launches AI Security Agent to Combat Machine-Speed Cyberattacks](https://daily.dev/posts/datadog-launches-ai-security-agent-to-combat-machine-speed-cyberattacks-dpkebcyor) · Security Boulevard · 0 upvotes · 0 comments - [Tokenmaxxing is out. How to minimize AI spend without sacrificing security capability.](https://daily.dev/posts/tokenmaxxing-is-out-how-to-minimize-ai-spend-without-sacrificing-security-capability--hioxvbiot) · The New Stack · 2 upvotes · 0 comments - [Frontier AI models haemorrhage sensitive data](https://daily.dev/posts/frontier-ai-models-haemorrhage-sensitive-data-aky1ifa1f) · LeadDev · 0 upvotes · 0 comments --- Tags: [#machine-learning](https://daily.dev/tags/machine-learning), [#devops](https://daily.dev/tags/devops), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/investigate-every-security-event-with-an-ai-agent-without-the-frontier-bill-xe22yn4xd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Investigate every security event with an AI agent, without the frontier bill","url":"https://daily.dev/posts/investigate-every-security-event-with-an-ai-agent-without-the-frontier-bill-xe22yn4xd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/investigate-every-security-event-with-an-ai-agent-without-the-frontier-bill-xe22yn4xd"},"datePublished":"2026-07-28T14:57:49.528Z","dateModified":"2026-09-13T20:55:40.976Z","description":"Datadog built a two-stage security detection pipeline to make AI-driven threat investigation practical at fleet scale. The first stage is Mambark, a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0cf453fba4538f01b0078572e16133e2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0cf453fba4538f01b0078572e16133e2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Datadog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Datadog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8f9d7e3e4bd64bd7b9db9b2ea83e0c6a","url":"https://daily.dev/sources/datadog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/investigate-every-security-event-with-an-ai-agent-without-the-frontier-bill-xe22yn4xd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"machine-learning,devops,ai-agents","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Datadog","item":"https://daily.dev/sources/datadog"},{"@type":"ListItem","position":3,"name":"Investigate every security event with an AI agent, without the frontier bill"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/investigate-every-security-event-with-an-ai-agent-without-the-frontier-bill-xe22yn4xd#faq","mainEntity":[{"@type":"Question","name":"How does Datadog make AI agent-based security investigation affordable at scale?","acceptedAnswer":{"@type":"Answer","text":"Datadog uses a two-stage pipeline: Mambark, a ~96.9 million parameter Mamba state-space model, scores every event in a stream via a single forward pass, forwarding only the most suspicious ones (around 10,000 out of 10 billion daily events) to an AI agent. This cuts agent investigation cost from tens of millions of dollars a day to roughly tens of dollars a day. daily.dev surfaces engineering approaches like this for teams weighing AI agent costs against detection coverage."}},{"@type":"Question","name":"What is Mambark and what benchmarks does it perform well on?","acceptedAnswer":{"@type":"Answer","text":"Mambark is a Mamba selective state-space model with about 96.9 million parameters, pretrained on hundreds of billions of security audit log events for next-event prediction. It achieves F1 scores of 1.000 on Thunderbird, 0.999 on BGL, 0.994 on UNSW-NB15, an AUC of 0.987 on LANL Cyber1, F1 0.941 and AUC 1.000 on HDFS, and AUC 0.879 on CERT Insider Threat, using one backbone across all datasets. Engineers evaluating anomaly-detection models for security pipelines can track results like these on daily.dev."}},{"@type":"Question","name":"Why can't a frontier LLM agent alone scan every security log event for threats?","acceptedAnswer":{"@type":"Answer","text":"Scoring every security-relevant event with a frontier LLM could cost tens of millions of dollars a day for a large enterprise, since reasoning over each event is computationally expensive. Interactive search only finds anomalies you already know to look for, so spotting a rare hidden anomaly among billions of events is a ranking problem requiring a cheap scorer, not a search problem an agent alone can solve. daily.dev helps engineers weigh cost tradeoffs like this when designing AI-driven detection architectures."}}]} ```