Data security posture management (DSPM) explained

Data security posture management (DSPM) tools help security teams examine their entire data environment to find shadow data, reducing the risk of data loss.

Tracking down sensitive data across both cloud and on-premises systems can be vexing. Each environment presents its own challenges. Given the dynamic and ephemeral nature of cloud computing, cloud data is easily created, deleted, or moved around. The cloud attack surface is equally dynamic, making protection all the more difficult. On-premises data can be elusive, particularly when shadow AI usage creates mission-critical data stores outside IT’s purview. To address this latter point, most DSPM vendors are incorporating their own AI routines (or offering a separate AI SPM product, as we outlined here).

But AI isn’t the only source of shadow data: for example, old data repositories left lurking on some cloud container or in-house server that has long been forgotten, not updated, or unaccounted for. The goal of DSPM products is to locate this shadow data and complement the more expansive cloud security posture management (CSPM) tools. But instead of focusing on protecting cloud infrastructures, DSPM tools focus exclusively on the role of data and how it is consumed by various cloud and on-premises services.

How the DSPM market is evolving

Over the past few years, DSPM tools have been developed to discover both known and unknown data, provide structure, and manage the security and privacy risks of potential data exposure. The market segment has seen a lot of mergers and acquisitions of late, including the following:

• Tenable acquired Eureka Security and Vulcan Cyber, folding them into its CNAPP Cloud Security platform
• Palo Alto Networks acquired Dig
• Rubrik acquired Laminar Security
• Proofpoint acquired Normalyze
• IBM acquired Polar Security, folding it into Guardium
• Veeam acquired Securiti
• Varonis acquired a variety of companies, including Cyral, SlashNext, and AllTrue.ai to enhance its DSPM and other products
• Thales acquired Imperva and created its CipherTrust DSPM
• Google acquired Wiz

This activity shows how DSPM has become a hot commodity, as established security vendors are buying up niche vendors to expand how they identify and protect data.

According to Gartner, DSPM tools bridge “the gap between data discovery/classification and the eventual implementation of automated remediation controls.”

The research firm outlines five use cases for DSPM: data loss prevention (DLP), privacy and data governance, entitlement management, cloud posture management integration, and protecting AI-related workflows. DSPM has evolved to the point where “the products’ combined capabilities now bear only a slight resemblance to the capabilities of the vendors that pioneered DSPM, leading to uncertainty for customers as to what DSPM actually is,” Gartner says.

As a result, while all five use cases are key components of any DSPM strategy, not every DSPM tool will perform equally well — or even comprehensively — across the board.

Take DLP for example. It used to be the sole place where security tools would examine threats and try to combat risk from these threats. But as cloud estates have grown, and as AI training data exploded, enterprises need to move beyond plain-vanilla DLP and establish better ways to find evidence of an attack, stolen data, or AI-fueled phishing attempts.

Part of the problem is that, as Gartner reports, “traditional data security products have an insufficient view to discover previously unknown, undiscovered, or unidentified data repositories, and they fail to consistently discover sensitive data.” That is where integration into other security tools is essential — and why so many mergers and acquisitions have taken place to fill these gaps.

Overall, the DSPM market is experiencing a boom in interest, with the tools catching on quickly in the past few years. As late as 2022, Gartner found a miniscule market penetration of less than 1% across its clientele. More recently, the research firm found that DSPM’s growth over the past two years has outpaced every other cybersecurity category.

What to look for in data security posture management (DSPM) tools

DSPM tools require a significant amount of staffing resources to evaluate because they touch on so many aspects of your IT infrastructure. That’s a good thing, because you want these tools to seek out and find data no matter where it could be hiding.

Having a plan that prioritizes which data is most important to your organization will help focus your evaluation. It’s also important to document how each DSPM offering creates its data map and subsequent dashboards. You should also understand the specific cloud and on-premises services that are covered and which ones are on the vendor’s near-term product roadmap.

How each vendor describes where it goes looking for data is instructive. Every vendor supports some visibility into some of the cloud data repositories of Amazon Web Services, Google Cloud, and Microsoft Azure. But that doesn’t mean that they cover every service offered by each of the cloud providers that deals with data.

For example, AWS has its S3 storage, Relational Database Service, Redshift’s cloud data warehouse, Athena serverless SQL queries, and ElasticSearch managed data services, among several other places that operate on data. Veeam takes pains to delineate which services are covered in each cloud platform, but other DSPM providers are not as transparent. Varonis, meanwhile, uses a “universal data connector” that can seek out a wider range of structured data destinations, both cloud-based and on-premises. Some vendors acknowledge cloud services they don’t support. Be sure to note that this is a very dynamic situation as vendors are adding coverage areas continually as their customers demand them.

Tracking down data is just the beginning, however. Once found, the data must be cataloged, evaluated, and summarized in various dashboards. That could be tricky if done without tight security controls, which is why most DSPM vendors claim that “customer data always stays within the customer’s environment.” This typically means collecting metadata, rather than the data itself, using read-only access to the apps, services, and database structures. Vendors refer to this as “agentless” or “using API access.” This approach has the advantage of being able to scan huge volumes of data quickly to understand the nature of its usage and potential risk factors.

Once the data has been discovered and its metadata has been collected, the next step is to perform regular scans to see what changes have been made: Has data been copied to some dark corner of your cloud estate? Has someone just changed access rights to allow for greater or insecure access? These tools provide a single point of view across all the various cloud and on-premises data locations. The key word here is “regular.” Scans have default periods (such as daily or weekly) and can be activated when new data repositories are found.

How data is consumed in your production environment, including data pipelines, lakes, and warehouses, is another aspect to consider. This can involve creating data maps to classify this landscape as well as facilitating audits to enumerate who has access to which data resource and under what specific circumstances it was shared across your enterprise. Maps are not just pretty pictures but important visualizations that often show where shadow data was abandoned, for example.

On top of all these activities there is the entire field of data governance. DSPM products assign risks and apply consistent security policies to manage your entire data collection, and they work with other security tools to enforce these policies and remediate problems. Many of the vendors included below have begun offering continuous auditing as part of their DSPM governance package, which is a welcome development in this fast-changing world.

Each DSPM tool has several components, including agents and agentless collectors (useful for tracking on-premises data), a centralized management dashboard, scanners that detect and prioritize data collections, maps of data lineage and usage, and compliance assessments.

Most vendors offer their DSPM product in one or both wider contexts: to integrate with third-party security services (such as offered by Veeam and Wiz) or as part of their own security product portfolio with other add-on modules that include identity management, cloud management, detection and response, and log analysis tools (Palo Alto Networks, Varonis, and Wiz).

The specifics on these integrations are worth examining, as some vendors, such as Varonis, Wiz and Palo Alto Networks, have wider support than others. Understanding the scope, integration level, and what other protective features are included, and which are available at an extra cost will take some effort to figure out.

Products can be deployed as a complete SaaS cloud-based solution, run from on-premises servers or private virtual machines/containers, or in some combination.

Finally, there is the issue of pricing. All the products overviewed here are pricey. Few vendors were willing to share this information, indicating that prices are flexible and depend on numerous factors. Some vendors are now charging by the terabyte for DSPM, an interesting development that could result in higher usage costs. However, numerous vendors offer annual subscriptions on either or both the Amazon and Azure marketplaces, which typically start at $30,000 for the smallest of networks. Plan on spending at least $100,000 annually, with higher prices to analyze larger data collections.

Leading vendors for data security posture management (DSPM)

The market space of DSPM is evolving quickly. Based on our own research and research from Gartner, GigaOm, IDC, and other analyst firms, we’ve identified 10 DSPM tool providers worth investigating. We also contacted several other vendors for this article that did not respond to our inquiries, so they are not detailed here: BigID, Concentric, Flow Security, IBM, OneTrust, Rubrik, Symmetry Systems, and Theom.

Cyera DSPM Platform

Cyera’s DSPM Platform helps organizations discover, classify, and secure sensitive data across cloud, SaaS, AI, and on-premises environments. The platform — along with its DDR companion DataWatcher — enables enterprises to control what data AI applications and agents can access, govern how that data is used, and reduce exposure risk across data at rest, in motion, and in use. Cyera provides agentless visibility into structured, semi-structured, and unstructured data, highly actionable risk and access intelligence dashboards, and more than 500 built-in data classifiers. The platform integrates with numerous security and data ecosystem tools, including Netskope, Splunk, Tines, Wiz, Collibra, DataHub, and Secoda, and supports on-prem/hybrid deployments for customers requiring in-environment scanning and regional data residency controls. Pricing on AWS for its Cloud Platform starts at $50,000 per year.

Microsoft Purview DPSM

Microsoft Purview DPSM is part of a larger data protection effort that is in preview form and will be rolled out in June at the company’s Build conference. It consolidates separate data protection tools to provide a single place to monitor and enforce security policies, and create and monitor security objectives. Purview DPSM will integrate with DSPM tools from Cyera, BigID, and OneTrust, and it uses Copilot and other AI agents to identify and protect your data collections. It replaces older DSPM tools that are now labelled “classic” versions.

Palo Alto Networks Cortex Cloud DSPM

Palo Alto Networks’ Cortex Cloud DSPM integrates with hundreds of SIEM, workflow, and ticketing solutions, as well as XDR and single sign-on (SSO). It comes with more than 600 prebuilt data classifiers, but more importantly, it works closely with various AI tooling to automate detection and remediation threats. It supports Microsoft 365, Snowflake, other SaaS services, a wide range of cloud providers, and on-premises file shares.

Proofpoint DSPM

Proofpoint DSPM recently folded in the company’s Normalyze acquisition and added integration with Proofpoint’s DLP solution. The tool scans cloud, SaaS, and on-premises data sources. It uses AI tools to identify attack paths and classify high-value data and auto-remediates when identifying misconfigurations. It integrates out-of-the-box with APIs for SOAR, third-party ticketing, and notification and automation platforms, including Atlassian Jira, ServiceNow, Microsoft Purview, and Slack. It offers more than 300 data classifiers and protects AI workflows.

Sentra End-to-End Data Security Platform

Sentra End-to-End Data Security Platform provides both continuous compliance and a superset of DLP policies, offering deep support for most cloud computing services along with support for containers, virtual machines, and on-premises data sources. It has its own data detection and response (DDR) tool for near real-time detection and a series of actionable dashboards. There are lots of integrations with data management (Coralogix, DataDog, and DataHub), email, ITSM (Jira, PagerDuty, and ServiceNow), CNAPP (Wiz), collaboration (Atlan, Azure Boards, Monday.com, Slack, and Teams), IAM (Active Directory and Okta), incident response (Seemplicity), SIEM (Splunk), and on-premises file shares. It also has powerful data classifiers that leverage built-in AI features to provide metadata enrichment and context, along with automated risk mediation. Sentra has four pricing tiers on AWS, starting at $50,000 per year.

Tenable One Cloud Exposure

Tenable One Cloud Exposure combines DSPM with threat detection and integrates with data lakes and warehouses such as Atlas, Salesforce, ServiceNow, Snowflake, and Jira-based ticketing systems. The tool continuously scans, categorizes, and remediates data across on-premises, cloud, and SaaS platforms to correlate identity, workload context, and potential threats. It also can dynamically verify and protect data that is externally reachable. Tenable has expanded its protective envelope to cover additional data types (such as secrets) and cloud providers.

Thales CipherTrust DSPM

Thales CipherTrust DSPM ties together visibility and remediation of your data located across both cloud and on-premises environments. It builds on its Imperva acquisition and can classify both structured and unstructured data and can map and protect data flows and encryption keys and secrets across the entire enterprise.

Varonis DSPM

Varonis has been in the data security business for more than a decade and covers both on-premises and cloud data repositories. It provides several hundred integrations with SIEM (e.g., Splunk), SOAR (e.g., Palo Alto XSOAR), firewalls, VPNs, web proxies, DNS services, Active Directory, Entra ID, Microsoft Purview Information Protection, and Okta. The product includes a managed DDR service that uses behavioral detection models and automated remediation. Varonis has been on an acquisition binge to broaden its security platform to include better phishing, compliance testing, and AI protection. Varonis AWS pricing is $750 per TB per year.

Veeam DSPM

Since acquiring Securiti, Veeam has added a variety of breach and compliance management features to Veeam DSPM, as well as on-premises protection to complement its data backup tooling. Its tool supports data streaming technologies such as Confluent, Google PubSub, Kafka, and Kinesis. It comes with 350 content classifiers that support multiple languages along with more than a thousand predefined detection rules, including AI-based data sources and uses. It integrates with a wide collection of cloud-native security services, cloud access security brokers (CASBs), CNAPPs, CSPMs, cloud infrastructure entitlement management (CIEM) systems, DLP systems, intrusion detection systems (IDSes), Kubernetes security posture management (KSPM) systems, SIEM systems, and compliance tools. It is priced per terabyte, starting at $450 per TB per year for structured data and $1,000 per TB per year for unstructured data, with volume discounts available.

Wiz for DSPM

Wiz maintains a solid brand and product identity, despite being acquired by Google. It packages its products differently from most vendors, offering three products to protect code, cloud assets, and to defend against threats. All three are needed for a complete DSPM solution, which has been expanded to cover shadow data detection and AI-driven data classifiers. Wiz offers two licensing plans, but the full collection of DSPM features is available only on its more expensive Advanced plan. Wiz adds a lightweight agent called Runtime Sensor for detection and response. In addition to the usual cloud data sources, it also scans a variety of on-premises databases, such as MongoDB, MySQL, and PostgreSQL, as well as cloud versions, including Databricks. Wiz also integrates with more than 60 security products. Wiz’ AWS pricing starts at $38,000 per yr to protect 100 workloads.