DSPM: What Data Security Posture Management Does and How to Evaluate It

TL;DR: Data security posture management (DSPM) is tooling that finds sensitive data wherever an organization stores it, labels what that data is, and shows which people, services and machine accounts can reach it. It starts from the data rather than the systems that hold it. Vendors disagree on scope, so check which stores a product can scan today. In our reading, a useful proof of concept seeds known test data and traces each finding to a named owner.

What is DSPM?

Data security posture management (DSPM) is a category of tooling that finds sensitive data wherever an organization keeps it, labels what that data is, and shows which people, services and machine accounts can reach it. Microsoft's description of the workflow begins with a discovery step to automatically locate sensitive data across cloud, hybrid, and on-premises environments. Its examples include software as a service (SaaS) applications and data lakes.

The term is recent. IBM notes that Gartner first identified DSPM in its 2022 Hype Cycle for Data Security and that the approach is sometimes called "data first" security. The idea reverses the usual order. Instead of securing the devices, systems and applications that hold or move data, the tool starts from the data itself.

The four questions

In our reading, DSPM products are built to answer four questions in sequence. A tool that answers only the first two works more like a data catalog than a security control.

1. Where is our sensitive data? Discovery covers the stores the security team knows about and the ones it does not. Microsoft specifically names shadow data or forgotten cloud assets as a target.
2. What is it? Classification sorts what was found by type and sensitivity, such as personal, health or financial records, and ties it to the compliance rules that apply.
3. Who or what can reach it? Microsoft describes this as understanding who has access to sensitive data and whether that access is appropriate. In our reading, this has to include service accounts and applications as well as employees.
4. What changed, and what gets fixed first? Rubrik writes that a DSPM must detect and alert on data security policy violations, prioritize those alerts, and provide remediation playbooks.

Scope differs by definition

Trend Micro defines DSPM as tooling used to monitor, manage, and secure data in the cloud. Rubrik says the category is sometimes known as cloud data security posture management (CDSPM). Microsoft's definition extends to on-premises stores. All three companies sell products in this area, so we read each definition as a description of that company's own product.

Check scope first. In our reading, the first question in any evaluation is which stores a product can actually scan today. Some may cover only cloud object storage. Others may also reach file shares and databases in your own data centers.

DSPM does not replace the rest of the stack. Our glossary defines the adjacent terms.

How DSPM works across cloud data stores

Trend Micro says most data security posture management (DSPM) tools follow the same five steps. The walk-through below keeps that order but treats access analysis as its own stage. In our reading, that is where most of the risk in a forgotten copy sits.

Take one example. A developer copies a production customer database into a snapshot to test a migration, finishes the test and moves on. Nobody files a ticket. Rubrik describes this pattern: developers can spin up or copy entire data stores quickly, without having to involve security.

1. Discovery. Trend Micro describes the process as continuously scanning all on-premises servers and cloud environments to find sensitive data assets. The snapshot appears in the inventory even though no one registered it. Rubrik argues that scanning should be asynchronous to production environments so it does not affect performance. That is a fair question to put to any vendor during a trial.

2. Classification. Discovered data is sorted by how sensitive it is, how safely it is stored, who has access to it, and whether it falls under rules such as the General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA), the Payment Card Industry Data Security Standard (PCI DSS) or the California Consumer Privacy Act (CCPA). Here, the snapshot is tagged as holding customer records. It may also be tagged as in scope for one or more of those rules.

3. Access analysis. One stated goal is to reduce or eliminate over-entitlements and over-permissions on sensitive data. For the snapshot, the questions are practical: which roles can read or restore it, and whether any of them sit outside the team that ran the test.

4. Risk prioritization. Assets are then prioritized by level of risk and importance. Rubrik says that when a cloud security posture management (CSPM) tool uses DSPM data context, teams can focus on those alerts that impact highly sensitive data. A snapshot of customer records with broad read access should rise near the top.

5. Remediation and monitoring. Fixes can include stronger authorization and access controls, more advanced data encryption technologies, and data loss prevention (DLP) tools. For the snapshot, the likely fix is simpler: confirm an owner, then delete the copy or lock it down. After that, the use and movement of sensitive data is continuously monitored to flag anomalies and policy violations.

We think the snapshot case makes a good test script. Plant a known copy of synthetic customer data in a test account. Then time how long the tool takes to find it, label it, surface who can reach it and route it to someone who can act.

What DSPM tends to find in a first scan

Vendor pages describe the first scan in similar terms: a short set of finding types that recur across products.

Varonis says the cloud presents "numerous attack and exposure paths, from shadow databases and misconfigured permissions to unsecured passwords and AI training pipelines" (Varonis). AI here means artificial intelligence.

Reading the volume

Proofpoint advertises remediation "across 200+ prebuilt risk findings" (Proofpoint). That is a count of rule types, not of problems in your estate. In our reading, the total at the end of a proof of concept says as much about the scanner's rules as about your exposure.

Context sets severity

The same misconfiguration can carry very different weight. BigID puts it this way: "A publicly accessible test bucket containing synthetic data does not create the same data risk as a publicly accessible bucket containing customer records, credentials, source code, or regulated health information" (BigID). Ask any vendor in a trial to show why a finding was rated high, field by field.

Coverage behind the findings

A clean result can reflect a partial scan. Varonis cautions against limited sampling, like scanning only a portion of object stores such as Amazon S3 or Azure Blob (Varonis). We think the first question after any scan is what share of each store was read in full.

For the AI training findings, the controls sit close to model governance. Our AI governance guide covers who should own them.

How DSPM differs from DLP, CSPM and SSPM

Data security posture management (DSPM), data loss prevention (DLP), cloud security posture management (CSPM) and SaaS security posture management (SSPM) are often bought by different teams. In our reading, they then land on the same budget review. The quickest way to separate them is by the object each one protects.

IBM frames DSPM as a reversal of the usual model. Rather than securing the systems and applications that hold or move data, DSPM focuses on protecting the data directly. Varonis draws the line against DLP. In its account, DLP focuses on sensitive data loss in motion at egress points, while DSPM works on the data assets themselves.

SentinelOne describes DLP as a control that actively blocks and monitors data movement. Its example is a rule that stops an employee from emailing credit card numbers outside the company network. In our reading, DLP also keeps logs of blocked attempts to transmit sensitive data, which auditors draw on.

The two posture tools sit closer to infrastructure. BigID says CSPM identifies cloud misconfigurations, policy violations, excessive infrastructure permissions, vulnerable resources, and compliance gaps, commonly across AWS, Microsoft Azure and Google Cloud. SSPM evaluates application configurations, permissions, identities, integrations, and other SaaS-specific posture risks.

Where the overlap matters

The sharpest overlap is between CSPM and DSPM. BigID puts it this way: CSPM may identify a publicly exposed cloud resource, and DSPM adds the context to tell whether that resource holds sensitive or regulated information. BigID, which sells DSPM, also argues that for organizations holding sensitive data across cloud, SaaS and AI workflows, CSPM does not replace DSPM.

In our reading, overlap is less of a problem than unclear ownership. Two tools that both flag an open storage bucket are workable. Trouble starts when nobody knows which team closes it.

A practical test before any purchase:

• Take one recent exposure finding and trace which tool raised it.
• Name the tool that would have blocked the data leaving, if any.
• Write down which team owns the fix for each layer.

If two tools claim the same step, that is where the integration questions belong. For shorter definitions of each term, see the security glossary.

Where DSPM fits with IAM, SIEM and the teams that own data

DSPM produces findings, not fixes. A finding only reduces risk when it lands in a queue that someone already works from. IBM says DSPM complements many of the other solutions in an organization's security technology stack, and that its insight and automation help teams address data security and compliance issues and prevent their recurrence. Preventing recurrence depends on the systems downstream.

Identity and access management

In our reading, many DSPM findings turn out to be access findings. BigID's checklist for an over-permissioned cloud database asks whether that access exceeds business need and whether anyone has accessed the sensitive data. Both are identity questions.

In our reading, the cleanest route sends an excess-access finding to the identity and access management (IAM) team as a proposed entitlement change. The data classification should travel with it, so the reviewer sees what the role can reach, not just its name.

Security information and event management

We think the main value for security information and event management (SIEM) is enrichment, not volume. A sensitivity label and data location can raise the priority of a detection that touches regulated data.

Ticketing and who owns the fix

BigID notes that a security finding without data context can produce the wrong priority. The same applies to tickets. In our reading, a ticket that says a bucket is exposed, with no owner and no data label, tends to sit unworked.

The ownership split below is our own view, not a standard.

Two patterns stand out in our reading. Security teams rarely own the data, so they should not own most of the fixes. And each ticket needs a named business owner before it is filed, or it bounces between teams.

In our reading, in organizations with a business information security officer, that role is often the practical bridge to data owners in each business unit. Where that bridge sits also depends on the reporting structure around the security function.

A practical check during evaluation: ask the vendor to show one finding going from detection to a closed ticket in your own IAM and ticketing tools, with the owner field filled in automatically.

Questions to answer in a DSPM proof of concept

A proof of concept should end with evidence your own team produced, not a demo you watched. The plan below is our own view of what to test. It assumes a few weeks of testing, a named owner on your side and written pass criteria agreed before the first scan.

Pick the stores yourself

Connect a mix of stores: one large object store, one production database, one software as a service (SaaS) application and one file share that nobody fully trusts. Varonis frames effective coverage as spanning infrastructure as a service (IaaS), databases, SaaS applications and cloud file storage (Varonis). Ask for full scans of each store, given the earlier caution about sampling.

Measure classification against a known sample

Seed one test store with records your team has labeled: synthetic credentials, fake patient notes and dummy card numbers. Add decoys that look sensitive but are not. Varonis says DSPM classifies data by sensitivity and type, naming credentials, protected health information (PHI) and personally identifiable information (PII) as examples (Varonis). Count hits, misses and false alarms for each type.

Trace access paths to the object

Proofpoint says DSPM evaluates vulnerabilities by analyzing access paths, user privileges and data sensitivity (Proofpoint). Varonis calls for mapping sensitive data against permissions and access activity down to each object (Varonis). Pick three findings and have an engineer confirm each path by hand. If the path cannot be reproduced, the finding is not ready to send to an owner.

Follow a fix to the owner

Varonis separates passive capabilities from active ones that remediate issues and enforce policies (Varonis). In our reading, the useful test is narrower than a feature list. Route five real findings through your ticketing system and see whether they land with the team that owns the data. Then check whether a closed finding reopens when the problem returns.

Score it plainly

Write the results into a one-page scorecard against the criteria you set at the start. Keep raw counts, not adjectives, so the comparison holds up when finance and the data owners read it.

Rolling out DSPM after the purchase

Vendors are open about where rollouts stall. Trend Micro lists ensuring organization-wide compliance with DSPM policies, practices, and regulations among its implementation challenges, and that compliance has to come by employees, contractors, service providers, and other third parties. Its answer is that organizations need to develop a clear roadmap for deployment.

In our reading, the people problem outlasts the tooling problem. A data security posture management (DSPM) platform tells you where valuable or sensitive data is, who can access it, and what its security posture is. It cannot decide who fixes a finding. That decision needs a named data owner for every store.

We think owners engage faster when the output answers a question their auditor or privacy lead already asks. Trend Micro describes classification that records whether data falls under GDPR, HIPAA, PCI DSS, CCPA, or other regulatory frameworks. Those frameworks are the General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA), the Payment Card Industry Data Security Standard (PCI DSS). The table below does not interpret any rule. It names the evidence each phase can feed. Confirm the exact clause with whoever owns that obligation.

Training belongs in the last phase. Trend Micro says an organization should continuously train all security personnel in the goals, benefits, and best practices for data security.

Exposure reduction is where owner buy-in gets tested. Proofpoint frames that goal as controlling who can access sensitive data, how it is used, and how it might be misused. Each of those changes touches someone's workflow, so the owner signs off, not the security team alone.

The first week

• Name the data owners for your top five stores by sensitivity, and get each one to accept the role in writing.
• Pick the stores for the proof of concept. Include at least one store that falls under a framework you report against.
• Write the pass criteria before the scan runs. Cover what counts as a correct label, who closes a finding, and which export your auditor would accept.

For the wider first-quarter plan, see /guides/ciso-first-90-days-plan.

What this guide does not cover

This guide does not rank, grade or recommend any vendor, and it does not compare pricing or estimate what a deployment will cost. It names the evidence a rollout can produce for privacy, health and payment card rules but does not interpret those rules. It is not legal or financial advice, so confirm each obligation with the person who owns it in your organization.