---
title: Runtime Prioritization Engine
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Cloud Security > Triage and Prioritize > Runtime
  Prioritization Engine
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Runtime Prioritization Engine

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

{% callout %}
# Important note for users on the following Datadog sites: app.datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, app.datadoghq.eu, ap1.datadoghq.com, ap2.datadoghq.com, uk1.datadoghq.com

{% callout %}
##### Join the Preview!

Runtime Prioritization Engine is in Preview for Cloud Security Vulnerabilities. Use this form to request access.

[Request Access](https://www.datadoghq.com/product-preview/runtime-prioritization-engine/)
{% /callout %}

{% /callout %}

Security scanners surface thousands of findings per environment. Most teams default to ranking by CVSS severity, but static scores flag many findings that are never exploited in practice as critical. Real risk depends on live context: is the vulnerable code running, is an exploit available, and does the affected resource touch sensitive data or a business-critical workflow?

The Datadog Runtime Prioritization Engine combines runtime behavior, exploitability, exposure, and business context from Observability and Security data to identify the 5% of findings that pose real, exploitable risk, so you can focus only on what matters.

## How it works{% #how-it-works %}

The Runtime Prioritization Engine is designed to be explainable. For each finding, Datadog evaluates five risk dimensions using production context and shows why the finding was prioritized.

| Dimension                | Question it answers                           | Example signals                                                                                                                                                                                                          |
| ------------------------ | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Reachability**         | Is the vulnerable component actually running? | Affected image observed running on a production workload. Vulnerable package observed executing at runtime.                                                                                                              |
| **Exposure**             | Can attackers reach it?                       | Resource publicly accessible from static network analysis. Runtime evidence of exposure to active attacks.                                                                                                               |
| **Exploitability**       | Are attackers likely to exploit it?           | Public exploit code exists. Finding actively exploited in the wild (listed in [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)). High exploit probability ([EPSS](https://www.first.org/epss/)). |
| **Business criticality** | Would a compromise have high impact?          | Resource supports a critical business function (Crown Jewel). Runs with elevated privileges and processes sensitive data.                                                                                                |
| **Actionability**        | Can the right team fix it?                    | Service owner identified. Fix or mitigation available.                                                                                                                                                                   |

The Runtime Prioritization Engine prioritizes a finding when these signals indicate real, exploitable risk in your environment. Findings that do not meet the prioritization criteria stay visible, but move out of the active triage queue.

## Crown Jewels{% #crown-jewels %}

[Crown Jewels](https://docs.datadoghq.com/security/cloud_security_management/crown_jewels.md) are the resources that support your most critical business functions (services, hosts, databases, containers, etc.). Datadog automatically infers them from observability data such as APM trace flow, service dependencies (fan-in), SLOs, traffic, incidents, and more.

Crown Jewels update continuously as your environment changes. You can also add your own Crown Jewels manually in Datadog Cloud Security.

## Ownership{% #ownership %}

[Ownership](https://docs.datadoghq.com/security/cloud_security_management/review_remediate/ownership_agent.md) identifies the team or service owner responsible for fixing a security finding. Datadog infers ownership from observability metadata such as service tags, team tags, deployment metadata, on-call configuration, source control links, service catalog entries, and more.

When ownership is known, the engine can route findings to the right team instead of leaving security teams to manually chase remediation owners.

## Filter findings by runtime signals{% #filter-findings-by-runtime-signals %}

When [Runtime Package Prioritization](https://docs.datadoghq.com/security/cloud_security_management/setup/agent/kubernetes.md#runtime-package-prioritization-preview) is enabled, Datadog adds the runtime signals it observes to container image vulnerability findings for packages installed by an operating system package manager (`apt`, `yum`, or `apk`). Search, filter, and group by these tags:

| Signal                   | Tag                                |
| ------------------------ | ---------------------------------- |
| Package is running       | `@risk.is_package_running:true`    |
| Accessed by root process | `@package.is_running_as_root:true` |
| SUID binary present      | `@package.has_suid:true`           |

Datadog adds a tag when it observes a signal. An absent tag means Datadog did not observe the signal; it does not mean the package is unused. Use the tags to prioritize what to fix first, not to rule findings out.

Use the tags in the [Vulnerability Explorer](https://app.datadoghq.com/security/csm/vm), combined with any other criteria. For example, high and critical vulnerabilities that are running and have a fix available:

```
@risk.is_package_running:true @severity:(high OR critical) @remediation.is_available:true
```

Signals persist for the lifetime of an image version: after a package is observed running, findings for that image keep the signal. Because container images are immutable, the signal reflects what has run in that image. When the image is no longer deployed, its findings age out and close.

## Get started{% #get-started %}

1. Deploy the Datadog Agent, version **7.79.0** or later, with Cloud Security enabled. On Kubernetes, use **7.81.0** or later for the most complete signal coverage. See [Setting Up Cloud Security](https://docs.datadoghq.com/security/cloud_security_management/setup.md).
1. Enable Runtime Package Prioritization on the Agent to surface the *Package is running* signal on vulnerability findings. See the instructions to do so for [Kubernetes](https://docs.datadoghq.com/security/cloud_security_management/setup/agent/kubernetes.md#runtime-package-prioritization-preview), [Docker](https://docs.datadoghq.com/security/cloud_security_management/setup/agent/docker.md#runtime-package-prioritization-preview), or [Linux](https://docs.datadoghq.com/security/cloud_security_management/setup/agent/linux.md#runtime-package-prioritization-preview) deployments.
1. Open the [Cloud Security Summary](https://app.datadoghq.com/security/csm) in Datadog. Prioritized findings are surfaced at the top of each funnel and in the [Security Inbox](https://docs.datadoghq.com/security/security_inbox.md).

## Further reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Understand Cloud Security severity scoring](https://docs.datadoghq.com/security/cloud_security_management/triage_and_prioritize/severity_scoring.md)
- [Detect and remediate vulnerabilities with Cloud Security](https://docs.datadoghq.com/security/cloud_security_management/vulnerabilities.md)
- [Review prioritized findings in the Security Inbox](https://docs.datadoghq.com/security/security_inbox.md)
- [Prioritize security findings with the Datadog Runtime Prioritization Engine](https://www.datadoghq.com/blog/runtime-prioritization-engine/)
- [Securing the AI era: Outpace AI-powered attacks with unified security and observability](https://www.datadoghq.com/blog/datadog-security/)