AI SRE Agents Compared: Datadog, PagerDuty and incident.io on Access and Price

Datadog's AI SRE agent averages about 4 credits per investigation. PagerDuty's costs 4 AI Actions per request. The matching number hides different units: the first buys a whole investigation, the second buys one question. incident.io publishes no add-on price at all. The sharper split between these AI SRE agents is what each may change in production, and who has to say yes first.

The short answer. Buy Datadog Bits if Datadog already holds your telemetry. Buy PagerDuty Paige if telemetry is spread across vendors and PagerDuty already runs on-call. Buy incident.io if you want the agent limited to pull requests and can accept an unpublished add-on price. None of the three should touch production without a named approver.

AI SRE agent is the search term, and no vendor's docs use it

An AI SRE agent is software that picks up an alert or incident, queries your telemetry and code, proposes a root cause, and suggests or prepares a fix. SRE stands for site reliability engineering, the discipline of keeping production systems running.

Datadog's docs now say Bits Investigation, while its pricing page says Bits Investigate and its product URL still says bits-ai-sre. PagerDuty's docs call the agent Paige (SRE Agent). incident.io markets an AI SRE page and sells the feature as Investigations. Search for the old names and you can land on stale pricing, which is how a 6.5 credit estimate kept appearing in search results while Datadog's live page said about 4.

I checked every row below against vendor documentation and pricing pages on 5 November 2026. I did not run these products on a live incident. This post therefore tells you what each vendor commits to in writing, and that is a narrower thing than what each agent does well.

AI SRE agents compared: access, actions, approvals and price

Where a cell says a page is silent, I read the vendor's relevant docs and did not find the statement, which does not prove the capability is absent.

What each AI incident response tool can read

Read access decides how good the root cause can be, and it also decides your exposure. An agent that reads logs reads whatever your services wrote into them.

Datadog Bits reads Datadog first

Datadog's investigation docs list 13 native sources, including metrics, APM traces, logs, dashboards, Change Tracking, Real User Monitoring, Database Monitoring and the profiler. Source code is GitHub only. Grafana, Dynatrace, Sentry, Splunk, ServiceNow and Confluence are listed as third-party integrations in Preview for all customers.

If half your logs live in Splunk, a Preview connector is carrying half of the investigation. I would not sign on that basis without testing it on a past incident that crossed the boundary.

PagerDuty Paige reads through connectors

PagerDuty starts from the opposite position, because it holds incidents and not telemetry. Its connector list runs to 22 entries at the time of reading, from Datadog and Grafana to Honeycomb, Sumo Logic and Sentry. Paige also reads past incidents, change events, runbooks and GitHub code, pull requests and commits.

The SRE Agent docs say Paige analyses custom_details and notes only up to the first 2,000 characters of each. If your alerts carry long payloads, the end of the payload is not in the analysis.

incident.io reads the incident room

incident.io's coverage page is the most specific of the three about human context. An investigation reads the incident channel including threads, Scribe call transcripts, attachments, severity, custom fields and alerts. It does not read direct messages or channels you have not connected.

Its telemetry layer, Nexus, names 16 sources, among them Datadog, Grafana, Honeycomb and Splunk, plus Kubernetes and Postgres. It queries them on demand and says it does not ingest the data. The Datadog setup recommends read-only keys because Nexus only ever reads from Datadog. The telemetry pages use the name Nexus and not Investigations, so confirm your specific source works inside an investigation.

What each AI SRE agent can change in production

Most vendor comparisons stop at root cause quality. I think that is the wrong place to stop, because a wrong diagnosis costs minutes and a wrong action can cost an outage. The figure below sorts each documented capability by how close it gets to running systems. Cross-checking write scopes this way is the same exercise as the OAuth scope review for AI agents.

Datadog is the most capable here and also the furthest along the risk curve. Its remediation docs describe code fixes generated automatically by default for code-related root causes, with a person creating the pull request. Separately, a Preview feature lets a user click Run on a suggested Kubernetes action, using a Private Action Runner with network access to the cluster.

PagerDuty's position is less clear in writing. Its docs describe Paige recommending remediation and responders clicking nudges to take prescribed actions, and Skills are in Early Access. Only the Operations Cloud pricing page says Paige can execute recommended steps, "if approved". Get the mechanism behind that phrase in writing, because I could not find it in the docs.

incident.io rules execution out. Its trust page says an investigation acts only as a pull request you review and merge, and that it never merges or deploys anything. That is the narrowest scope of the three, and for a regulated team narrow is the feature.

Where human approval actually sits in each product

Every vendor says a human stays in control. The words sit in different places, and those places decide who can be bypassed. For the design question behind this, see how human-in-the-loop architecture works. For a 2am failure plan, see the on-call runbook template for agents.

Datadog: a policy engine, still in Preview

Guardrails let admins define which remediation actions Bits can take, where they apply and who approves. The docs name two levels. Ask requires approval from chosen teams, roles or individuals. Deny lets Bits recommend but not act. This is the only per-environment approval policy documented among the three, and I would rate it the strongest design, subject to the Preview label.

A Datadog blog post from 9 June 2026 gives an example where a guardrail allows Bits to apply memory-limit patches automatically in staging while production needs approval. The docs list no automatic level. Ask your account team which is current, because an automatic level changes your risk review.

PagerDuty: a permission list, not a gate

The connector docs group tools into Read Only and Write/delete, and each tool or group is set to Always Allow or Blocked. Paige then "uses only the allowed tools, automatically or via user request." I found no Ask setting on that page. Taken literally, enabling a write tool means no documented per-action approval from a person.

Block the Write/delete group on day one, then enable one tool at a time. Separately, the docs do not say whose identity an action runs under, and neither do Datadog's pages I read. That question has its own treatment in the piece on agent credentials against user impersonation.

incident.io: your existing code review

incident.io's approval step is the pull request, so your branch protection and review rules become the control. Automatic pull requests are off by default, and the page says to get in touch if you want them. Write access to a connected repository is still required for code changes. A rushed reviewer at 2am is the weak point here, and no setting in this product fixes that.

How each AI SRE agent's price unit behaves at volume

Each meter charges for a different event, so the same outage produces three different bills. The calculations below use only published rates, and my assumptions are labelled. They exclude the Datadog subscription you already pay for, and PagerDuty's plan fee also buys seats and on-call features, so the columns are not like for like.

Why 4 credits and 4 AI Actions are not the same price

Datadog's about 4 credits is an average for one autonomous investigation, however many steps it took. PagerDuty's 4 AI Actions apply to each request, nudge click or automated trigger, so a responder asking three follow-ups pays four times over. The first meter tracks incidents. The second tracks how much your team talks to the agent. I would expect the PagerDuty bill to vary more by team habit, and that is a common property of vendor agent meters.

Zan Digital calculation, not vendor quotes. Assumes one investigation per incident at Datadog's average of about 4 credits, and treats PagerDuty's allotments as annual, which its plan fees imply but its table cells do not state. Requests per incident is our assumption. Ultimate and credit pack prices are unpublished. PagerDuty also offers additional AI Actions for no credits in the first year on Essential and above if you sign by 15 January 2027.

Datadog's annual bundle breaks even at about 96 investigations

At $1.30 per on-demand credit, $500 buys about 385 credits, or about 96 investigations at 4 credits each. Below that, a committed bundle is money you lose, because unused commit credits do not roll over. Above 125 investigations the bundle runs out and overage bills at the on-demand rate automatically. I would start on demand and move to a commit after two months of real numbers.

The headline $4 needs care. Datadog's 2 November 2026 post says average cost per investigation fell 84%, from $25 at launch in December 2025 to about $4 in October 2026, and from 11 minutes to about 2. It never says whether that is your price or its own cost. Four credits at the bundle rate happens to equal $4, but at $1.30 it is $5.20, and Datadog does not link the two numbers. The credit table also lists a Bits Code fix at about 5 credits. The docs I read do not say whether an automatic fix inside an investigation bills separately, so ask.

What starts the meter decides your worst month

Bits starts when a monitor transitions to alert, if automatic investigations are on. Its default limits are one automatic investigation per monitor per 24 hours and 20 per organisation per 15 minutes. That caps a storm at 80 investigations an hour across 80 distinct monitors. At about 4 credits each, that is 320 credits and about $416 an hour on demand. A 500-credit bundle lasts about 94 minutes of that.

incident.io's triggering docs say investigations run on incidents, not directly on alerts, so noisy alerts cost nothing until someone or something declares an incident. Automatic runs have rolling hourly, daily and weekly limits, and past a limit an investigation waits for confirmation. The docs mention an "allowance" without giving the number, so get it in the order form. PagerDuty charges 4 AI Actions per Workflow or Escalation Policy trigger, so wiring Paige to a noisy policy spends the allotment on alerts nobody asked about.

Where this comparison is weakest

This post has no accuracy data, and accuracy is the first thing you care about. Datadog reports a 44% higher quality score on its own internal benchmark. incident.io says it backtests daily against historical incidents, and its backtests are not self-serve. PagerDuty's pages I read give no accuracy figure. None of these is independent, and I have not tested any of them, so a cheap agent with wrong answers could still be the worst buy here.

Documentation is also a poor proxy for behaviour. A page that does not mention an approval step might describe a product with one. PagerDuty's docs still use plan names that do not match its pricing page, which suggests the docs lag the product. Third-party tracker PricingSaaS reported different AI Actions quotas in October 2026 than the page showed on 3 November, so these allotments have moved recently.

The incident.io cost is the largest hole. I cannot place it on the same chart because the add-on price is unpublished, and 25 Pro responders with on-call come to $13,500 a year before it. Sales-negotiated discounts could also reverse any ordering in the cost table.

The strongest competing view is that this whole comparison is premature, because all three products changed materially in 2026 and a team should wait. I disagree for one reason: read-only investigation carries little risk and can be trialled monthly. Waiting is the right answer only for the write and execute rows, and those are the rows you can leave switched off.

AI SRE agent recommendation by stack

Pick by where your telemetry and your incident process already live. Where two rows both apply to you, I would let telemetry win, since root cause quality depends on it.

Datadog wins the first row, and it loses where it is strongest: its native depth is the reason a multi-vendor shop gets less from it. PagerDuty wins on reach and loses on written approval. incident.io wins on scope, and it asks you to buy without a public price. I would trust the vendor whose limits are written down, and on that test incident.io comes first and Datadog second, despite the Preview label.

Frequently asked questions

Where to start with an AI SRE trial this week

Pull your last 3 months of incidents and count three things: incidents, alerts per incident, and how many monitors or policies fired. Put those numbers into the cost table above, replacing my requests-per-incident assumption with something your responders would recognise. If you land below 96 investigations a month, you have no reason to accept a Datadog commit.

Then email your chosen vendor three questions and keep the reply. Which identity does each agent action run under? Which approval level applies to each write tool by default? What happens to the bill during an alert storm? A vendor that answers all three in writing has done most of your security review for you, and one that cannot has told you where to keep the agent read-only.

Related reading