Observability and APM — Monitoring, Logs, Tracing and Incident Response

The binding constraint — incumbent vulnerability

Two listed pure plays hold the top, and every independent challenger worth buying has just been bought. Datadog reported 2025 revenue of $3.427B, up from $2.684B (+28%), with about 32,700 customers and 603 paying $1M or more a year in ARR, up from 462 [A, 10-K filed 2026-02-18]. Dynatrace reported fiscal 2026 (to 31 March) revenue of $2.018B (+19%) and ARR of $2.054B (+18%) from about 4,100 large customers [A, 10-K filed 2026-05-20]. Cisco now reports Observability as its own product line — Splunk's observability products, AppDynamics and ThousandEyes — at $1.095B in fiscal 2026, up 4%, after paying about $27B for Splunk in March 2024 [A, Cisco 10-K]. Elastic ($1.739B fiscal 2026 revenue, +17%, about 24,000 customers [A]) sells the same log store into observability and security. The consolidation wave of 2026 closed the cloud-native gap. Palo Alto Networks completed its purchase of Chronosphere — the best-funded Prometheus-scale metrics challenger — on 29 January 2026 for total consideration of $3.0B [A, PANW 10-K], and Snowflake bought Observe on 2 February 2026 for preliminary consideration of $595.8M [A, Snowflake 10-Q]. Elastic's own 10-K names both deals as the reason large technology companies are now direct competitors. Private equity owns the previous generation: New Relic (Francisco Partners and TPG, about $6.5B equity, November 2023 [A, company release]), Sumo Logic (Francisco Partners, about $1.7B, May 2023 [A]), SolarWinds (Turn/River, $4.4B enterprise value, April 2025 [A]) and LogicMonitor (Vista-controlled; $800M from PSG, Golub and others at about $2.4B, November 2024 [B]). The open-source floor is the standard, not a niche. Prometheus, OpenTelemetry, Jaeger and Grafana are the instrumentation every vendor ingests, so switching cost has been deliberately lowered by the industry itself — and Grafana Labs, which monetises that floor, says it has passed $600M of ARR and 10,000 customers [C, company release, August 2026]. The remaining funded independents are Grafana Labs, Honeycomb (nearly $150M raised [B]), Coralogix ($115M Series E, about $350M total [B]) and, on the incident-response side, PagerDuty ($492.5M revenue, +5% [A]) against incident.io ($62M Series B, over $96M total [B, company post]). How this differs from its neighbours. 541514-ai-agent-infrastructure-and-evaluation is tracing and evaluation of LLM agents specifically — a layer Datadog, Dynatrace and Grafana are now bolting onto this record's platforms; this record is general telemetry for every application. 5415-msp-remote-monitoring-and-service-automation is the managed-service provider's endpoint toolkit (RMM/PSA) sold per client device; this record is bought by the in-house engineering or SRE team for its own systems, although LogicMonitor and SolarWinds sell into both. 541514-cnapp-cloud-security-posture-management scans cloud configuration for risk; the overlap here is only where a log platform (Splunk, Elastic, Sumo Logic) doubles as SIEM. 541514-itsm-and-it-portfolio-management is the ticket and CMDB system of record; on-call paging and incident response sit here because they are triggered by telemetry, not by a service request. The leaders are not weakening — Datadog grew 28% and Dynatrace 19% — and the cloud-native, telemetry-lake and AI-agent wedges have each been bought or funded. Incumbent vulnerability decides it.