CIOPages

CIOPages · State of Play · Data Security Posture Management

State of Play 2026: Data Security Posture Management

Acquisitions moved DSPM into cloud security, data security and backup platforms, and Microsoft made its own DSPM generally available. Where the market stands in 2026, and what each type of product costs where prices are public.

Published October 20, 2026

Data security posture management (DSPM) software finds sensitive data across an organization's cloud, SaaS and on-premises data stores and classifies it. It then shows who can access that data, how it is used and whether it is protected. It starts from the data itself, not from the infrastructure or the endpoints that hold it.

Where the market stands

Larger security and data companies bought several DSPM vendors between 2023 and 2026.

  • Palo Alto Networks completed its acquisition of Dig Security on December 5, 2023, and integrated it into Prisma Cloud. On February 13, 2025, it introduced Cortex Cloud as the next version of Prisma Cloud.
  • Proofpoint agreed to acquire Normalyze on October 29, 2024. It expected the deal to close in November 2024.
  • Forcepoint completed its acquisition of Getvisibility, a DSPM and data detection and response (DDR) vendor, on April 7, 2025.
  • Veeam announced on December 11, 2025, that it had completed its $1.725 billion acquisition of Securiti AI. Securiti's founder, Rehan Jalil, became Veeam's President of Security and AI. On May 12, 2026, Veeam announced its DataAI Command Platform, built on the Securiti acquisition, and a preview of the first two resilience offerings on it. Veeam says the platform's data graph spans live and backup systems.
  • Google completed its acquisition of Wiz on March 11, 2026, for $29.5 billion after purchase price adjustments and excluding post-combination compensation. Alphabet reports Wiz's results in its Google Cloud segment.

Cyera remains independent. It raised $600 million at a $12 billion valuation on June 10, 2026, in a round led by Evolution Equity Partners. On September 3, 2026, it completed its acquisition of Oasis Security, an access management vendor, which became Cyera Identity.

What changed in 2026

  • Microsoft announced general availability of the new version of Purview Data Security Posture Management in May 2026. It covers Microsoft 365, Azure, Fabric and integrated third-party SaaS. It extends to Google Cloud Platform, Snowflake and Databricks, and integrates with partner solutions from Varonis, Cyera, BigID and OneTrust. At the May announcement, the partner solutions for non-Microsoft data sources and the Data Security Posture Agent remained in preview. Microsoft's deployment documentation still lists the agent as in preview.
  • Varonis has announced the end of life of its self-hosted products as of December 31, 2026. It describes its platform as SaaS-based.
  • AWS announced Security Hub Extended on February 26, 2026, generally available in all commercial Regions where Security Hub runs. It sells curated partner tools with pay-as-you-go pricing on a single AWS bill. Its Data category lists Cyera and Varonis.

Four kinds of product

DSPM products fall into four groups.

  • Standalone DSPM platforms. Cyera scans without agents across cloud, SaaS, database services and on-premises stores. It runs inside the customer's cloud or on-premises environment, or as managed SaaS. Its platform also includes Omni DLP, Agent Guardian for AI agents and Cyera Identity.
  • DSPM inside a cloud security platform. Wiz DSPM discovers sensitive data without agents in code, IaaS, PaaS, database services and AI. It uses context from the Wiz Security Graph to remove attack paths to critical data. Palo Alto Networks includes DSPM and cloud DDR in Cortex Cloud Runtime Security and in Cortex XSIAM Premium, and sells Cortex Data Security as a standalone product or add-on.
  • Data security and access governance suites. Varonis covers AWS, Azure and Google Cloud, SaaS apps, databases and on-premises file shares, and right-sizes permissions. Forcepoint and Veeam bought DSPM vendors to add to their existing platforms, and Proofpoint agreed to buy one.
  • Cloud provider tools. Amazon Macie inventories Amazon S3 buckets, flags issues such as public access and finds sensitive data in S3 objects. Google Cloud Sensitive Data Protection profiles BigQuery, Cloud SQL, Cloud Storage and Vertex AI data, and also Amazon S3 and Azure Blob Storage. Microsoft Purview DSPM covers Microsoft 365, Azure and Fabric.

What each costs where prices are public

  • Amazon Macie. In US East (N. Virginia), bucket monitoring costs $0.10 per bucket per month. Automated discovery costs $0.01 per 100,000 objects monitored per month. Sensitive data inspection costs $1 per GB for the first 50,000 GB a month, $0.50 per GB for the next 450,000 GB and $0.25 per GB beyond 500,000 GB. The first 1 GB a month is free. The 30-day free trial on first enabling Macie excludes sensitive data discovery jobs.
  • Google Cloud Sensitive Data Protection. Consumption-mode discovery costs $0.03 per GB profiled, capped at 3 TB per table or bucket. Subscription mode costs $2,500 per subscription unit of reserved profiling capacity. The first month is a fixed term, and billing is monthly after that. A qualified Security Command Center subscription includes a default organization-level discovery subscription.
  • Microsoft Purview. Microsoft's DSPM documentation names no separate DSPM price. Purview covers Microsoft 365 data under per-user licenses (the Microsoft 365 E3/E5/A5/F5/G5 model). Non-Microsoft 365 data sources are billed pay-as-you-go through an Azure subscription.
  • Cyera. List prices as published. Its AWS Marketplace listing sells 12-month contracts at $50,000 for up to 25 TB, $100,000 for up to 100 TB and $250,000 for up to 250 TB, each with 24x7 support. In AWS Security Hub Extended, Cyera DSPM with Datawatcher costs $73 per TB per month for 250 to 500 TB, $65 for 501 to 1,000 TB and $53 above that, with a 250 TB minimum. Datawatcher, an optional managed service, adds 12% of total spend.
  • Varonis. List prices as published. In AWS Security Hub Extended, Varonis Data Security Platform for AWS costs $29 per TB per month for 150 to 499 TB, $25 for 500 to 999 TB and $13 above that, with a 150 TB minimum.
  • Wiz. List prices as published. Its AWS Marketplace listing prices Wiz Essential at $24,000 and Wiz Advanced at $38,000 for 100 cloud workloads on a 12-month contract. Usage beyond the contract costs $0.01 per consumption billing unit. The listing does not mention DSPM.
  • Cortex Data Security. Licensed from a pool of workload units that protected data assets consume. A standalone base license starts at 200 workloads. The product requires Premium Support. Virtual machines that are not disks or buckets do not count.

What a deployment requires

  • Permissions. Purview DSPM needs an account with the Entra Compliance Administrator role or membership in the Purview Compliance Administrator role group. Microsoft says to allow about a day after setup before tenant data appears.
  • Non-Microsoft sources in Purview. Partner solutions for sources such as Google Cloud Platform and Snowflake are set up through Microsoft Sentinel data lake. That setup is in preview.
  • What counts against a license. In Cortex Data Security, discovering an asset uses no license. A license is used only once the asset is onboarded and actively scanned.
  • Where scanning runs. Ask each vendor whether scanning runs inside your accounts or in its SaaS, and whether any data leaves your environment. Cyera offers both models.
  • Extra cloud charges. Macie can incur Amazon S3 retrieval and AWS KMS decryption charges on top of its own fees. Google charges Cloud Storage fees during profiling in either pricing mode.

Questions to settle first

Settle these before a shortlist.

  • Where does your sensitive data sit: in one cloud, across several clouds, in SaaS or on file shares?
  • Do you already own a cloud security platform or Purview licensing that includes DSPM, and does it reach every store you need?
  • Who acts on the findings: the security team, the privacy office or the data owners?
  • Will the pricing unit (buckets, gigabytes, terabytes or workloads) stay affordable as your data grows?
  • If you run Varonis self-hosted, what is your plan before December 31, 2026?
  • Has your vendor changed owners, and what does the new owner's roadmap say about the product you are buying?
Sources. Microsoft Learn, Learn about Microsoft Purview Data Security Posture Management (DSPM): https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about; Microsoft Learn, What's new in Microsoft Purview: https://learn.microsoft.com/en-us/purview/whats-new; Microsoft Security Blog, "What's new in Microsoft Security: May 2026", May 21, 2026: https://www.microsoft.com/en-us/security/blog/2026/05/21/whats-new-in-microsoft-security-may-2026/; Microsoft Learn, Considerations for deploying Microsoft Purview Data Security Posture Management: https://learn.microsoft.com/en-us/purview/data-security-posture-management-considerations; Microsoft Learn, Learn about Microsoft Purview billing models: https://learn.microsoft.com/en-us/purview/purview-billing-models; Palo Alto Networks, "Palo Alto Networks Completes Acquisition of Dig Security", December 5, 2023: https://www.paloaltonetworks.com/company/press/2023/palo-alto-networks-completes-acquisition-of-dig-security; Palo Alto Networks, "Palo Alto Networks Introduces Cortex Cloud, the Future of Real-Time Cloud Security", February 13, 2025: https://www.paloaltonetworks.com/company/press/2025/palo-alto-networks-introduces-cortex-cloud--the-future-of-real-time-cloud-security; Palo Alto Networks, Cortex Data Security documentation, Understand Cortex Data Security licenses: https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/understand-cortex-data-security-licenses; Palo Alto Networks, Cortex Data Security documentation, License allocation: https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/understand-cortex-data-security-licenses/license-allocation; Proofpoint, "Proofpoint Signs Definitive Agreement to Acquire Normalyze", October 29, 2024: https://www.proofpoint.com/us/newsroom/press-releases/proofpoint-signs-definitive-agreement-acquire-normalyze; Forcepoint, "Forcepoint to Acquire Getvisibility, Expanding AI-Driven Data Security and Risk Visibility", March 10, 2025: https://www.forcepoint.com/newsroom/2025/forcepoint-acquire-getvisibility-expanding-ai-driven-data-security-and-risk; Forcepoint, "Forcepoint Completes Acquisition of Getvisibility", April 7, 2025: https://www.forcepoint.com/newsroom/2025/forcepoint-completes-acquisition-getvisibility-uniting-ai-driven-innovation-data; Veeam, "Veeam Completes Acquisition of Securiti AI", December 11, 2025: https://www.veeam.com/company/press-release/veeam-acquires-securiti-ai.html; Veeam, "Veeam Launches DataAI Command Platform", May 12, 2026: https://www.veeam.com/company/press-release/veeam-launches-dataai-command-platform-the-industrys-first-unified-data-and-ai-trust-infrastructure-for-the-agentic-era.html; Alphabet Inc., Form 10-Q for the quarter ended March 31, 2026: https://www.sec.gov/Archives/edgar/data/0001652044/000165204426000048/goog-20260331.htm; Cyera, "Cyera Raises $600 Million at $12 Billion Valuation", June 10, 2026: https://www.cyera.com/press-releases/cyera-raises-600-million-at-12-billion-valuation-to-continue-building-the-trust-layer-for-the-ai-era; Cyera, "Cyera Completes Acquisition of Oasis Security", September 3, 2026: https://www.cyera.com/press-releases/cyera-completes-acquisition-of-oasis-security; Cyera, Data Security Posture Management: https://www.cyera.com/platform/dspm; AWS News Blog, "AWS Security Hub Extended offers full-stack enterprise security with curated partner solutions", February 26, 2026: https://aws.amazon.com/blogs/aws/aws-security-hub-extended-o%EF%AC%80ers-full-stack-enterprise-security-with-curated-partner-solutions/; AWS, AWS Security Hub pricing: https://aws.amazon.com/security-hub/pricing/; AWS Marketplace, Cyera Cloud Data Security Platform: https://aws.amazon.com/marketplace/pp/prodview-mc6f4tbu6otj4; Varonis Systems, Form 10-K for the year ended December 31, 2025: https://www.sec.gov/Archives/edgar/data/1361113/000162828026005450/vrns-20251231.htm; Varonis, Data Security Posture Management: https://www.varonis.com/platform/data-security-posture-management; Wiz, Data Security Posture Management: https://www.wiz.io/solutions/dspm; AWS Marketplace, Wiz Cloud Infrastructure Security Platform (Plus Consumption): https://aws.amazon.com/marketplace/pp/prodview-5geds7fc2wk7m; AWS, What is Amazon Macie?: https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html; AWS, Amazon Macie pricing: https://aws.amazon.com/macie/pricing/; AWS Price List API, Amazon Macie, US East (N. Virginia): https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonMacie/current/us-east-1/index.json; Google Cloud, Sensitive Data Protection pricing: https://cloud.google.com/sensitive-data-protection/pricing; Google Cloud, Sensitive Data Protection documentation, Data profiles: https://docs.cloud.google.com/sensitive-data-protection/docs/data-profiles