The problem that defined a decade
For most of its existence, IT monitoring had one job: tell you when something broke.
You set thresholds. You got alerts. You woke someone up at 2 a.m. If they were lucky, the runbook told them what to do. If not, they opened a bridge call and spent three hours correlating logs from six different tools while the business lost money.
The monitoring industry grew solving this problem, then hit a wall. By the early 2020s, every serious enterprise had more dashboards than people to watch them, more alerts than any team could triage, and more data than any static threshold could meaningfully interpret.
AI didn't arrive in IT monitoring as a feature. It arrived because the old model stopped working.
What actually changed
The shift isn't just algorithmic. It's architectural.
Traditional monitoring asks: is this metric above or below a number set last quarter? AI-driven monitoring asks: given everything happening across this system right now, what's actually wrong, why, and what should happen next?
That's a different product, and the companies that understood this early built real leads. The ones that bolted "AI" onto threshold-based engines as a marketing move are now scrambling to catch up.
Here's how the major players have positioned themselves, and where the real product differentiation sits.
The hybrid-observability vendors: intelligence as a platform promise
One group of hybrid-observability vendors has made a clear strategic bet: rebranding the entire platform around AI-powered hybrid observability. The branding matters less than what it signals: these companies no longer position themselves as monitoring tools. They position themselves as an intelligence layer.
Their AI suites have added several useful capabilities.
Anomaly detection with dynamic thresholds. Instead of requiring administrators to set static alert thresholds, a process that's outdated the moment infrastructure changes, these platforms use machine learning to build baselines per resource, time of day, and day of week. A CPU spike at 3 a.m. on a Saturday gets treated differently from the same spike during a Monday morning deployment window. This alone removes a large share of false-positive alerts.
Forecasting and capacity planning. Forecasting modules use time-series models to predict when resources will hit saturation, days or weeks before they do. This shifts the product's value from reactive alerting to proactive capacity intelligence. For infrastructure teams running hybrid environments across AWS, Azure, and on-prem, that's genuinely useful.
Root cause analysis. Their most ambitious AI feature. When an incident fires, the platform tries to correlate signals across the affected topology (network, application, infrastructure) and surface a probable root cause instead of a list of symptoms. The accuracy isn't perfect, but the direction is right: operators want answers, not more data.
Most of these platforms still lack a strong AI-native interface. Their AI features show up through dashboards and alert configurations, powerful but not conversational. The next step for them is making intelligence accessible through natural language, something competitors are already shipping.
Datadog: the broadest bet in observability
Datadog has made the most aggressive AI product investments of any observability vendor, for a simple reason: they have more data than almost anyone else.
Metrics, traces, logs, synthetics, security signals, and real-user monitoring all flow through one platform for hundreds of thousands of customers. That gives their models more signal variety to train on than siloed point products can match.
Watchdog is their longest-running AI capability, an always-on anomaly detection engine that surfaces unusual patterns across services without requiring configuration. What started as a novelty feature has become central to how Datadog customers triage incidents. Watchdog fires before humans notice the problem. Not always, but often enough to change operator behavior.
Bits AI, their conversational assistant launched in 2024 and expanded through 2025, is the bolder bet. Bits lets operators query observability data in plain language: "What changed in the payment service in the last two hours?" or "Summarize the blast radius of this database slowdown." It generates runbooks, drafts post-mortems, and surfaces relevant dashboards automatically when an alert fires.
The product insight matters here: Datadog isn't just adding AI to observability. They're rethinking the interface operators use to experience it. The dashboard, the primary surface of monitoring tools for decades, may be giving way to a conversation.
LLM Observability is their newest frontier. As enterprises deploy AI applications at scale, those applications need monitoring too: prompt latencies, token costs, model drift, hallucination rates. Datadog built dedicated tooling for this, creating a feedback loop where AI monitors AI. It positions them in front of a category that didn't exist three years ago.
Dynatrace: the causation advantage
Dynatrace built its AI strategy around a claim that sets it apart from every other vendor: correlation isn't enough. You need causation.
Their Davis AI engine, which predates most competitors' AI investments by years, is built not just to detect anomalies but to trace their causal chain. When a transaction slowdown affects five services at once, Davis doesn't surface five alerts. It surfaces one: the root cause, with the downstream effects listed as consequences.
This is architecturally significant. It requires a topology model, a real-time map of how every component in an environment relates to every other, which Davis maintains automatically through their Smartscape discovery engine. The AI is only as good as the topology it reasons over, and Dynatrace has invested heavily in keeping that topology accurate.
Their Grail data lakehouse is the infrastructure behind this: bringing metrics, logs, traces, events, and business data into one storage and query layer lets Davis reason across data types that used to sit in silos. One causal AI engine, over all your data, with no sampling.
Dynatrace has historically struggled with enterprise approachability. The platform is powerful and the AI is genuinely differentiated, but the learning curve is steep and the pricing model has frustrated buyers. Their recent move toward more flexible consumption pricing suggests they know it.
New Relic: the open platform play
After a turbulent few years (a co-CEO transition, a go-private deal, real restructuring), New Relic repositioned around a simpler message: one platform, all your data, AI-powered.
Their New Relic AI assistant, embedded across the platform, offers conversational incident analysis, error explanation, and log summarization. The experience is cleaner than most competitors: the AI surfaces directly where engineers already work, instead of in a separate module they have to go find.
Their most interesting recent investment is error analysis. New Relic AI can take an application error, explain it in plain language, suggest probable causes, and generate a code fix directly in the monitoring interface. For teams running DevOps, that shortens the distance between detection and fix in a way pure infrastructure monitoring tools can't.
New Relic's edge is pricing simplicity (user-based rather than data-volume-based) and a real focus on developer experience. Their AI features feel built for engineers, not operations managers, a meaningful difference in a market where both personas have real purchasing power.
PagerDuty: from alert router to operations intelligence
PagerDuty's product evolution is one of the more instructive pivots in this space. They started as an alert-routing and on-call management tool, best-in-class at a narrow function. As AI reshaped what monitoring platforms could do, PagerDuty had a choice: stay narrow and deep, or expand the platform.
They chose expansion, through PagerDuty Advance, their AI layer built on a partnership with generative AI providers.
Intelligent alert grouping uses ML to cluster related alerts into single incidents, cutting the number of notifications that reach on-call engineers. Alert fatigue is one of the most documented problems in IT operations, and this feature attacks it directly.
Postmortem automation is their most impressive recent capability. PagerDuty Advance can draft a postmortem automatically after an incident resolves, pulling in the timeline of events, the communications that happened, the contributing factors identified during response, and a draft of recommended follow-up actions. What used to take a senior engineer two hours to write now takes ten minutes to review and refine.
The strategic insight: PagerDuty owns the response layer, the moment humans engage with incidents. By making AI most valuable at that moment, they're building an advantage pure monitoring platforms can't easily copy.
The patterns worth watching
A few consistent patterns are showing up across these platforms, and any product leader in this space should be tracking them.
The interface is shifting from dashboard to conversation. Every major vendor is investing in natural language query. The dashboard isn't disappearing, but the primary interface for incident response is becoming conversational. That has real implications for UX design, data architecture, and how platforms define "time to insight."
Noise reduction is table stakes now. Dynamic thresholds and alert grouping aren't differentiators anymore, they're expected. Vendors who built these capabilities in 2020 and called them AI features are finding the bar has moved past filtering noise toward taking action on it.
Autonomous remediation is the next frontier. Several vendors are moving beyond surfacing recommendations to actually executing remediations (restarting services, scaling resources, rerouting traffic) with varying levels of human approval required. This is the riskiest and most valuable territory. The product challenge is building enough trust in the AI's judgment that operators are willing to hand over control, without losing the ability to understand what's happening in their own environment.
Observability and security are converging. Datadog's unified security and observability platform, Dynatrace's security analytics, and Splunk's repositioning after the Cisco acquisition all point to the same thing: the data needed to understand performance anomalies and the data needed to detect security threats increasingly overlap. Platforms that unify these will cut tool sprawl for enterprise buyers and create real switching costs.
What this means for product leaders
If you're building in this space, or buying in it, the questions to ask have changed.
It's no longer enough to ask how many integrations a platform has, or what its alerting latency is. The questions that matter now:
- What does this platform's AI actually reason over? Anomaly detection on isolated metrics is a different thing entirely from causal analysis across a full topology. Know which one you're buying.
- Where does the AI surface, and for whom? AI that lives in a module only AIOps specialists use is a different product from AI embedded in the daily workflow of every on-call engineer.
- What's the human-in-the-loop model? As platforms move toward autonomous remediation, the approval and override mechanisms matter enormously, both for operator trust and for regulatory compliance.
- How does the platform learn from your environment specifically? Generic models are a starting point. Platforms that adapt to the specifics of your infrastructure, your normal, your topology, your failure patterns, deliver meaningfully better results.
Padmanabh Sahasrabudhe has led product strategy across IT monitoring, cybersecurity, and pharma tech platforms at enterprise scale.