Datadog launches Scout 1.0, an AI specialized in root cause analysis for IT incidents

Datadog introduces Scout 1.0, an AI model trained to investigate IT incidents, with claimed costs up to 19 times lower.

When an application fails, engineering teams typically examine alerts, compare logs and metrics, and identify the events that might explain the incident. With Scout 1.0, Datadog introduces its first AI model specifically trained for this type of investigation. Integrated into Bits Investigation, Scout develops hypotheses, queries telemetry, and searches for evidence supporting a diagnosis. According to Datadog's internal evaluations, the model achieves performance comparable to several leading general-purpose AI systems, at estimated inference costs between three and nineteen times lower, depending on the comparison. A Model Built for Production Incidents

Scout 1.0 was developed for Site Reliability Engineering (SRE), a discipline focused on maintaining the availability, reliability, and operation of software services.

When a system encounters a problem, identifying its origin often requires examining multiple sources of information.

Increased response times might result from an overloaded database, a configuration change, a software deployment, or an unavailable external service.

The symptoms alone do not always reveal the underlying cause.

Scout operates within Bits Investigation, Datadog's AI SRE agent, to help conduct these investigations.

The objective is to begin investigating as soon as an alert appears, potentially before an on-call engineer has started reviewing the incident.

Datadog wants to make an initial automated investigation practical for a much larger share of production alerts, rather than reserving detailed analysis for the most severe incidents. Forming Hypotheses and Examining Evidence

A Bits investigation involves several steps.

The system first examines the alert context and information available about the affected environment.

It can then formulate competing hypotheses about the incident's origin and query telemetry to test each explanation.

These signals may include metrics, event logs, and execution traces.

The collected evidence helps eliminate unsupported explanations and strengthen those consistent with the observed behavior.

The agent can then produce a diagnosis accompanied by supporting information.

Datadog illustrates this workflow with a PostgreSQL incident in which Bits presents a likely cause and proposed recovery actions.

Investigations involve multiple successive model calls. This repetition makes inference cost particularly important: a single incident may require numerous searches, checks, and hypothesis revisions. Specializing GLM-5.3 Flash

Datadog built Scout 1.0 on GLM-5.3 Flash, applying additional reinforcement learning to specialize it for SRE investigations.

Rather than developing another general-purpose model, the company focused training on the operations required to investigate production incidents.

The process uses simulations reproducing technical failures and their underlying causes.

Datadog draws on historical incidents and telemetry from real alerts to construct these environments.

The company states that its training simulations do not contain customer data.

Within each scenario, Scout uses tools modeled on Bits Investigation to examine the situation, gather evidence, and test competing explanations.

The training process rewards identifying the root cause and supporting conclusions with relevant evidence.

This approach aims to improve the model's behavior throughout an investigation rather than optimizing only the quality of its written answers. An Internal Reinforcement Learning Infrastructure

Datadog also developed distributed infrastructure to train Scout.

The system builds on open-source tools, combined with components for simulating incidents, evaluating results, and training models.

It supports repeated simulated investigations, using their outcomes to improve Scout's behavior.

This type of reinforcement learning depends heavily on the quality of its training environments.

To learn how to identify the cause of a failure, the model must encounter simulations that meaningfully represent relationships between symptoms, events, and underlying problems.

Datadog is therefore developing Scout and Bits Investigation together.

The model learns to operate Bits tools, while those tools can be improved based on problems observed during training and evaluation.

The company provides additional information in its Scout technical report. Performance Comparable to More Expensive General-Purpose Models

Datadog developed AlertEval, an internal benchmark for measuring investigation quality.

It uses real alerts, archived telemetry, and root-cause explanations written by engineers.

Datadog's teams assembled thousands of evaluation points through their incident-response workflows.

On AlertEval, the company reports that Scout 1.0 medium performs comparably to GPT-6.1 Sol high and Claude Opus 5.5 high, at estimated inference costs three to eight times lower.

Scout medium also reaches performance comparable to Claude Fable medium and GPT-6 Astra medium, with reported cost reductions of twelve and nineteen times, respectively.

These comparisons concern the estimated inference cost of an entire investigation, not simply the published price per million tokens.

Specialization is an important factor. Scout is trained for a narrow set of tasks, while the compared systems are designed for a much wider range of applications.

The results therefore do not establish that Scout outperforms those models in unrelated areas. Different Reasoning Effort Levels

Scout can allocate additional computation to more demanding investigations.

Datadog describes medium, high, and xhigh configurations, each associated with a different level of computational effort.

In Scout 1.0 xhigh, the model devotes more resources to finding the cause of an incident and checking the available evidence.

On AlertEval, Datadog reports performance comparable to Claude Fable xhigh at an estimated four times lower cost.

The company also reports that its highest-effort configuration outperforms GPT-6 Astra on this evaluation.

The aim is to use