Executive Summary
Run every DSPM trial on your own accounts. Count what it finds, then count what it fixed and who approved each fix.
Data security posture management (DSPM) finds sensitive data across cloud, SaaS and on-premises stores, works out which people, service accounts and AI agents can reach it, and flags or fixes the exposure: a public bucket, an overshared folder, an unencrypted copy of a production database in a test account. Microsoft states that instead of focusing on infrastructure or endpoints, Data Security Posture Management centers on the data itself: where it resides, who can access it, how it is used, and whether it is adequately protected.
Data loss prevention (DLP) acts when data moves, on an endpoint, in email or on a web upload. Cloud security posture management (CSPM) checks how cloud resources are configured, whatever they hold. DSPM starts from the data at rest and asks whether its location, access and protection match its sensitivity. Section 3 compares the three.
This guide explains what DSPM does, how to evaluate it on your own data, how it is priced, and how eight vendors differ. They fall into five approaches: a standalone DSPM platform, a data intelligence platform shared with privacy and governance, an access governance platform, a DSPM module of a cloud security platform, and DSPM inside the productivity suite. Ownership has moved fast in this market, and Section 5 sources each acquisition to the companies’ own announcements.
What Is Data Security Posture Management (DSPM)?
DSPM does four jobs. It discovers data stores, including ones nobody registered: a database snapshot, a bucket made for a migration, a collaboration site left open after a project. It classifies what is inside them, such as personal data, health records, card numbers, credentials and source code. It maps access, meaning which users, roles, service accounts and AI agents can read each store. And it scores the result and routes a fix, from removing a public link to revoking a permission or deleting a stale copy.
The unregistered stores are the reason the category exists. Data that engineers copy to test a feature, analysts export for a report, or a team syncs into a SaaS tool rarely appears in the asset inventory, and it usually carries looser access than the production system it came from. Security teams call it shadow data. Infrastructure tools see the bucket or the database. DSPM reads what is in it.
AI assistants made the access question urgent. A copilot or agent answers with whatever its user, or its own service account, can read. Overshared files that nobody opened for years become answers to a prompt. Several vendors in Section 5 now map AI agents as identities alongside people, and some add controls on what data reaches AI tools.
Regulation asks for the same inventory. The FTC Safeguards Rule requires designing and implementing safeguards to control the risks you identify through risk assessment, including identifying and managing the data, personnel, devices, systems, and facilities that enable you to achieve business purposes, and protecting by encryption all customer information held or transmitted by you both in transit over external networks and at rest. The rule is 16 CFR 314.4. A DSPM report does not satisfy it on its own, but it supplies the data map that the risk assessment and the encryption check start from.
DSPM vs DLP vs CSPM
The three tools look at the same estate from different starting points. CSPM starts from the cloud resource and checks its configuration against a benchmark: is the bucket public, is logging on, is the key rotated. DLP starts from an event, such as an email, an upload or a file copied to USB, and decides whether to allow it. DSPM starts from the data and asks where it sits, who can reach it and whether its protection matches its sensitivity.
A CSPM finding says a storage bucket is public. A DSPM finding says the same bucket is public and holds 40,000 customer records, which decides whether it is fixed today or next quarter. DLP and DSPM share classification: a classifier that labels a file at rest can label it again when it moves, so one classification engine across both cuts duplicated tuning.
Vendors now sell the three together. Microsoft states that Data Security Posture Management continuously scans the environment to identify sensitive data, assess risk, and recommend actions, and consolidates insights from the Microsoft Purview solutions data loss prevention (DLP), Insider Risk Management, information protection with sensitivity labels, and Data Security Investigations. Cyera states that its pricing is tied to customer outcomes and that it offers two plans, for DSPM and DLP. Two of the vendors in Section 5 sell DSPM as a module of a cloud security platform. Buying DSPM from the vendor that already runs your DLP or CSPM saves an integration, but test its discovery and classification on the same accounts as a standalone product.
Data detection and response (DDR) is the monitoring half. Posture is a snapshot of where data sits and who could reach it; DDR watches what is happening to it now, such as a mass download, a copy into an unapproved region or a new external share. Ask whether DDR is included or sold as a separate module. The DLP guide covers in-motion controls, and the CSPM guide covers cloud configuration.
| Starts from | Answers | Does not answer | |
|---|---|---|---|
| DSPM | The data in cloud, SaaS and on-premises stores | What sensitive data exists, where, who can reach it, and whether it is protected | What happens to data in transit; it reports exposure rather than stopping a transfer |
| DLP | Data in motion and in use | Whether this email, upload or copy should be allowed | Where data already sits and who can read it there |
| CSPM | Cloud resource configuration | Whether resources follow a security benchmark | Whether a misconfigured resource holds anything sensitive |
| DDR | Activity on data stores | Whether data is being accessed, copied or shared in an unusual way now | Exposure that exists but has not been used yet |
How to Evaluate a DSPM Platform
Start with coverage. List your data stores by type: object storage, managed databases, data warehouses, SaaS applications, file shares, collaboration suites and on-premises databases. Ask each vendor which of them it scans today, which through a partner, and which are on its roadmap. A store the product cannot read does not appear in its findings.
Then test classification. Vendors publish their own accuracy figures. Cyera states that its AI-native classification engine adapts to each environment and delivers 95%+ precision without manual rules or ongoing tuning. Varonis states that it auto-classifies the entire data estate by sensitivity and topic with 98%+ accuracy and no rules or RegEx to write and maintain. The two figures measure different things, precision for one and accuracy for the other, so neither settles the question. Run each product on a sample of your own data, including records unique to your business such as policy numbers or part numbers, and count true and false matches.
Ask where the scanning runs: inside your cloud account, sending only metadata out, or in the vendor’s service, with samples copied to it. Sentra states that customer data never comes to Sentra, and that its short-lived, read-only scanners start inside the customer’s account, in the same region as the data. Cyera states that it can be deployed entirely within your cloud or on-prem environments so sensitive data remains in place, and that it also offers a secure SaaS deployment. For regulated data, where scanning runs decides what your privacy and procurement teams must approve.
Check the access map. A finding is useful only if it names who can reach the data: users, groups, roles, service accounts, third parties and AI agents, with the path that grants access. Ask whether the product reads effective permissions, including inherited and cross-account access, or only the permissions set directly on the store.
Finally, test the fix. Ask which remediation actions run from the product, which open a ticket, and which need another tool. Ask for previews before a change, rollback after it, and an audit trail of who approved it. Then ask how it handles AI: which copilots, agents and models it inventories, and whether it maps what each can reach.
| Capability | What it does | What to ask |
|---|---|---|
| Discovery | Finds data stores, including unmanaged copies | Which store types are covered natively, and how new stores are found |
| Classification | Labels personal, financial, health, secret and business data | Precision and recall on your own sample, and how custom classifiers are built |
| Access mapping | Shows who and what can reach each store | Effective permissions, cross-account access, service accounts and AI agents |
| Exposure context | Combines sensitivity with public exposure, encryption and vulnerabilities | Which signals feed the risk score, and whether it can be tuned |
| Remediation | Revokes access, removes links, masks or deletes data | Which actions run natively, with previews and rollback |
| Data detection and response | Watches activity on sensitive stores | Which logs it reads, and how alerts reach your SOC |
| Compliance mapping | Reports findings against regulations and frameworks | Which frameworks ship, and whether reports satisfy your auditors |
| AI coverage | Inventories copilots, agents and models and the data they reach | Which AI services, and whether access is mapped or only listed |
| Deployment | Where scanning and storage run | In your account, the vendor’s cloud, or on premises, and in which regions |
| Scale and cost of scanning | How much data is read and how often | Sampling method, rescan frequency, and who pays the cloud compute |
Vendors in Data Security Posture Management (DSPM)
Representative vendors include BigID, Cyera, Microsoft Purview (DSPM), Palo Alto (Cortex Cloud DSPM) / Dig Security, Securiti / Veeam, Sentra, Varonis and Wiz DSPM (Google). The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors
The DSPM vendors below are grouped by where the product comes from, which decides what it covers first and what it adds to. Ask each vendor to confirm in writing which data stores, which deployment model and which modules the quote covers.
The first approach is a standalone DSPM platform built for cloud and SaaS data. Cyera states that it uses an agentless architecture to continuously scan and classify data across hundreds of petabytes. Cyera states that it offers 30+ out-of-the-box remediation actions, including revoking access, masking sensitive data, triggering predefined workflows and routing issues to data owners. Cyera states that, certified FedRAMP High (Class D), it extends its platform to federal agencies and regulated industries adopting agentic AI. Sentra states that it finds sensitive data, maps which people and AI agents can access it, and removes the access that should not be there, all inside the customer’s environment. Sentra states that Sentra Shadow AI DLP combines Shadow AI Discovery with browser-based data protection to discover AI usage and prevent sensitive data from being shared with AI.
The second approach comes from data discovery for privacy and governance, and adds security posture to it. BigID states that, from discovery and classification to DSPM, privacy automation, identity security, AI security, and AI governance, it connects the context organizations need to move from visibility to action. BigID states that it unifies DSPM, AISP, Cloud DLP and Data Security Platform capabilities in one solution. BigID states that it enables native action: revoke access, delete toxic data, redact secrets, enforce retention, and delegate remediation. BigID states that it covers multicloud, SaaS, IaaS, hybrid, on-prem, dev, and AI environments. Securiti tells customers they can leverage 800+ pre-defined rules to automatically assess compliance with security frameworks and regulatory standards. Securiti lists preventing sensitive data sprawl through data streaming systems such as Confluent and Apache Kafka. Securiti lists People Data Graphs that automatically identify the individuals and specific personal data exposed in a breach. Securiti states that Veeam acquired Securiti in December 2025 to create one system to see, secure, govern, and recover all data. Veeam states that the unified Veeam and Securiti AI platform gives customers visibility, security, governance, and recovery across production data, backups, AI pipelines, cloud and on-premises.
The third approach comes from data access governance: permissions on file shares, directories and collaboration suites, with activity monitoring and response. Varonis states that the DSP platform covers data discovery and classification, data access governance, event monitoring, threat detection and response, and automated remediation. Varonis states that its MDDR analysts watch customer data 24x7, handling triage, investigation, and response. Varonis states that most customers deploy in under an hour, with no agents or infrastructure to roll out. On October 15, 2026, Varonis Systems, Inc. and Proofpoint, a portfolio company of Thoma Bravo, announced a definitive agreement under which Varonis will be acquired by Proofpoint. Proofpoint states that the transaction is expected to close in the first half of 2027, subject to approval by Varonis shareholders and regulatory approvals.
The fourth approach is DSPM as a module of a cloud security platform, alongside posture management, workload protection and code scanning. Wiz states that Wiz DSPM provides graph-based context to remove attack paths to data, with continuous agentless discovery of sensitive data in code, IaaS, PaaS, DBaaS, and AI against built-in and custom classifiers. Wiz states that it correlates sensitive data with cloud context, including public exposure, identities and entitlements, vulnerabilities, malware, and lateral movement. Wiz states that it assesses compliance posture against regulatory frameworks such as PCI DSS, HIPAA and HITRUST, with a geographical view of data findings for data sovereignty. Google announced on March 11, 2026 the completion of its acquisition of Wiz, which will join Google Cloud and maintain its brand. Google states that Wiz products will continue to work and be available across all major clouds, including Amazon Web Services, Google Cloud Platform, Microsoft Azure, and Oracle Cloud. Palo Alto Networks announced on Dec. 5, 2023 that it had completed its acquisition of Dig Security, a provider of Data Security Posture Management (DSPM). A request for dig.security is answered by a data security page on paloaltonetworks.com. Palo Alto Networks tells customers they can use hundreds of built-in classifiers to discover sensitive data such as source code, business documents, and developer secrets across their cloud environments. Palo Alto Networks states that Prisma Cloud DSPM provides a full mapping of sensitive data and risk in 24 hours with no connectors required, and that data is scanned and classified in the customer’s cloud account. Palo Alto Networks states that the WildFire malware analysis engine is integrated into Prisma Cloud DSPM to identify malware hidden in stored data. Palo Alto Networks states that Cortex Cloud combines AI-based detection, anomaly detection, and behavioral signals to surface high-risk incidents in real time.
The fifth approach is DSPM inside the productivity suite. Microsoft states that Microsoft Purview Data Security Posture Management (DSPM) helps organizations discover, protect, and investigate sensitive data risks across their digital estate. Microsoft states that in the asset explorer, Microsoft locations currently include Microsoft 365 only, and non-Microsoft locations are made possible by integration with partner solutions. Microsoft states that setup tasks include, in preview, setting up Microsoft Sentinel data lake to integrate with partner solutions for non-Microsoft data sources, such as Google Cloud Platform and Snowflake.
DSPM also ships inside backup platforms, security service edges and cloud providers’ own services. Rubrik stated on August 30, 2023 that Laminar, a data security posture management (DSPM) company, had recently been acquired by Rubrik. Rubrik announced that Rubrik Enterprise Proactive Edition (EPE), supporting Data Security Posture Management (DSPM) for cloud, SaaS, and on-premises, is generally available. Rubrik states that Rubrik Laminar is designed to give organizations full visibility into their most sensitive data to assess who is doing what with it. On October 15, 2024, Netskope announced enhancements to the Netskope One platform that include integrated data security posture management (DSPM) capabilities. Netskope cited its recent acquisition and integration of DSPM innovator Dasera. Netskope states that Netskope One DSPM integrates with DLP, CASB, and other Netskope One SSE components. AWS states that Amazon Macie discovers sensitive data using machine learning and pattern matching, and enables visibility and automated protection against data security risks.
| Vendor | Approach | Where it fits |
|---|---|---|
| Varonis | Access governance and managed response | Discovery, access governance, monitoring and remediation; 24x7 managed response; sale agreed in October 2026 |
| BigID | Data intelligence with privacy and governance | DSPM, AI security, cloud DLP and privacy on one discovery layer; native remediation actions |
| Securiti / Veeam | Data intelligence with privacy and governance | 800+ compliance rules; streaming data; breach impact analysis; acquired in December 2025 |
| Palo Alto (Cortex Cloud DSPM) / Dig Security | DSPM in a cloud security platform | Hundreds of built-in classifiers; scans in your cloud account; malware scanning of stored files |
| Wiz DSPM (Google) | DSPM in a cloud security platform | Data findings on the Wiz Security Graph with exposure and identity context; acquisition completed in March 2026 |
| Microsoft Purview (DSPM) | DSPM in the productivity suite | Built on Purview DLP, labels and insider risk; Microsoft 365 natively, other stores through partners |
| Cyera | Standalone DSPM platform | Deploys in your cloud, on premises or as SaaS; agentless; 30+ remediation actions; DSPM and DLP plans |
| Sentra | Standalone DSPM platform | Read-only scanners inside your account; maps people and AI agents; licensed by data volume |
Eight vendors across five approaches; three approaches hold two vendors each. The approaches were written before any vendor was assigned to them, and the eight rows are the vendors the previous edition of this guide evaluated. A row in this table cannot be bought. Rubrik (Laminar), Netskope (Dasera) and Amazon Macie are covered in the text above, and any DSPM vendor can make its own case in the Spotlight below.
How much should you budget for Data Security Posture Management (DSPM)?
DSPM is sold as an annual subscription, and the unit varies by vendor: the volume of data scanned or stored, the number of data stores or cloud accounts, or the number of users in a suite license. Compare quotes for the same estate, scanned at the same frequency.
Most DSPM vendors quote rather than publish prices. Sentra states that its licenses are generally based on the volume of data stored (data at-rest) across IaaS, PaaS, DBaaS, SaaS and on-premises environments. Cyera states that its pricing is tied to customer outcomes and that it offers two plans, for DSPM and DLP. Microsoft states that data security and compliance value associated with user-based protection in Microsoft 365 is available in the Microsoft Purview Suite (requires Microsoft 365 E3), and that data security, compliance, and governance value across data estates, networks, generative AI apps, and agents is pay as you go.
One cloud provider’s discovery service publishes per-unit prices, which gives a reference point for the cost of scanning. In an AWS pricing example for 15 S3 buckets holding 10,000,000 objects, with 150 GB inspected, Amazon Macie charges $0.10 per S3 bucket per month, $0.01 per 100K objects, and $1 per GB inspected after a 1 GB free tier for automated sensitive data discovery. A DSPM platform covers far more than one provider’s storage, but the example shows the cost drivers to ask about in any quote: how much data is read, how often, and how many objects are tracked.
Scanning also has a cloud bill. A product that scans inside your account runs compute that your cloud provider charges you for, and a full rescan of a petabyte estate is not free. Ask each vendor how it samples, whether it rescans only changed data, and what compute cost a customer of your size sees.
The largest cost is the fixing. Every finding needs a decision and an owner, and the first scan of a large estate returns more findings than a team can work through. Budget for data owners’ time and for automated remediation, not only for the license.
| Model | You are charged for | Grows with | Where it goes wrong |
|---|---|---|---|
| Data volume | Terabytes stored or scanned across covered stores | Data growth | Backups, logs and archives counted at full rate |
| Data stores or accounts | Each database, bucket group, SaaS tenant or cloud account | Number of stores | Many small accounts priced like large ones |
| Platform module | DSPM as an add-on to a cloud security or SSE platform | Platform workloads or users | Coverage limited to what the platform already sees |
| Suite license | DSPM within a productivity suite tier, plus usage charges | Users and pay-as-you-go usage | Non-suite stores priced separately through partners |
| Managed service | The product plus analysts who watch it | Data and service level | Response times not written into the contract |
How long does implementation take for Data Security Posture Management (DSPM)?
A DSPM rollout moves from connecting accounts, to classifying, to fixing the worst exposure, to monitoring. The connection takes days; agreeing who fixes what takes longer, so start that conversation in the first week.
Connect cloud accounts, SaaS tenants and on-premises stores with read-only roles. Compare the stores found with the asset inventory, and list the ones nobody claims.
Review classification on a sample of each data type with its owner. Add custom classifiers for data unique to your business, and record false matches until they are rare.
Start with sensitive data that is public, shared externally or held in a test account. Delete stale copies, close shares and revoke unused access, and record each decision.
Turn repeat fixes into automatic actions or tickets routed to data owners. Send DDR alerts to the SOC, and report exposure trends to the risk committee each quarter.
What should you ask vendors about Data Security Posture Management (DSPM)?
Ask each vendor to answer in writing and to demonstrate on your own accounts, not a demo tenant.
-
Does most of your sensitive data live in one productivity suite?Yes Start with that suite’s DSPM, and test what it misses in cloud databases and other SaaS.No Compare platforms that cover several clouds, SaaS and on-premises stores.
-
Do you already run a cloud security platform with a DSPM module?Yes Trial the module against one standalone DSPM on the same accounts, and compare what each finds.No Weigh standalone DSPM against the platform approach on coverage outside IaaS.
-
Do privacy and security share the data inventory?Yes Shortlist platforms that serve privacy requests and data mapping from the same discovery.No Weight classification accuracy, access mapping and remediation first.