Data security posture management (DSPM) is a category of security tools that finds sensitive data across cloud, SaaS and, in some products, on-premises data stores, classifies it, maps which people and services can reach it, and flags exposure such as public storage or excessive permissions. Gartner’s market definition says DSPM “discovers previously unknown data” and assesses “who has access to it to determine its security posture and exposure to privacy, security and AI-usage-related risks.” CSPM checks infrastructure settings and DLP controls data as it is used and moved; DSPM starts from the data itself. As of October 2026, AWS, Google and Microsoft all document native discovery services, and Microsoft’s CNAPP, Defender for Cloud, bundles it with CSPM and CIEM.
Related security coverage is listed in Enterprise Techie’s topic index.
In this guide
Key facts
| Source | What it asks for |
|---|---|
| Gartner DSPM market definition | Discover and classify unknown data; assess who has access |
| NIST SP 800-53 Rev. 5, CM-12 | Document where specified information is stored and processed, and the users who have access |
| NIST SP 800-53 Rev. 5, CM-12(1) | Automated tools to identify information by type |
| NIST SP 800-53 Rev. 5, PM-5(1) | An inventory of systems, applications and projects that process personal data |
| NIST CSF 2.0, ID.AM-07 (February 2024) | Inventories of data and metadata for designated data types |
| GDPR Article 30 | A written record of processing, including categories of personal data and third-country transfers |
| CISA Zero Trust Maturity Model v2.0 (April 2023; cisa.gov now labels its page archived) | Inventory, categorize and label data; detect and stop exfiltration |
How DSPM works
- Discover data stores. Enumerate object stores, databases, warehouses and SaaS repositories, including unregistered ones. Microsoft says its DSPM “finds managed and shadow data resources across clouds”; Amazon Macie keeps an inventory of S3 general purpose buckets.
- Classify the contents. NIST IR 8496, an initial public draft from November 2023, describes the methods: metadata such as file name, keywords, regular expressions for patterns such as card numbers, trained machine learning models, and manual review. Some tools sample rather than read everything; Microsoft samples up to 20 MB per file in cloud storage and 300 to 1,024 rows from selected database tables.
- Map access. Work out which identities can read each sensitive store. Wiz describes answering “who can access what data”; Microsoft traces attack paths from internet-exposed VMs to sensitive data stores.
- Find exposure. Combine sensitivity with configuration: a bucket that becomes publicly accessible (a Macie finding), data shared with outside accounts, production data in test environments, data outside approved regions.
- Drive remediation. Microsoft Purview DSPM lists removing public sharing links, applying DLP policies and revoking permissions; Macie sends findings to Amazon EventBridge and AWS Security Hub CSPM.
That loop closely matches NIST control CM-12, Information Location: identify where specified information is processed and stored, identify “the users who have access,” and document changes. Enhancement CM-12(1) calls for automated tools to do the identification.
DSPM use cases
- An inventory auditors can test. GDPR Article 30 requires each controller to “maintain a record of processing activities,” including “a description of the categories of data subjects and of the categories of personal data” and third-country transfers; Article 30(5) exempts some organizations under 250 employees. The record also covers purposes and recipients, which no scanner supplies; DSPM shows where the personal data actually sits.
- Public and external exposure. AWS says new S3 buckets don’t allow public access by default, but users can change policies to allow it. DSPM shows which changes put sensitive data in reach.
- Shadow and copied data. Exports, snapshots and test copies may lack the original’s controls. The CSA Cloud Controls Matrix asks for data owner authorization “before replicating or using production data in non-production environments.”
- Data residency. The CCM’s Data Location control says to “specify and document the physical locations of data,” and the NIST Privacy Framework (ID.IM-P7) asks for the processing environment, including geographic location, to be identified.
- Minimization and retention. GDPR Article 5 requires personal data to be “limited to what is necessary.” Finding stale copies supports deletion schedules; backups need their own rules, covered in the backup retention policy guide.
- AI data exposure. Purview DSPM monitors risks from AI apps and agents, including agent oversharing and exfiltration, and Google’s discovery service profiles Vertex AI training data. See the shadow AI risk analysis.
- Breach response. Microsoft says its DSPM helps teams respond to data breaches; see the data breach cost benchmarks.
DSPM vs CSPM
Cloud security posture management checks how infrastructure is configured. Microsoft’s CSPM documentation says Defender for Cloud “continually assesses your cloud infrastructure against security standards”; Gartner’s CSPM definition centers on a current cloud asset inventory and misconfiguration detection. A CSPM rule can report that a storage account allows public access. It can’t tell whether the account holds payroll files or empty build logs.
DSPM adds content and sensitivity, so the same finding can be ranked. Products blur the line: Microsoft’s Foundational CSPM is free, sensitive data discovery sits in the paid Defender CSPM plan and in Defender for Storage, and Macie checks both S3 bucket access controls and object contents.
DSPM vs DLP
The NIST glossary, quoting CNSSI 4009-2022, describes data loss prevention as the ability to “identify, monitor, and protect data in use,” in motion and at rest, in order to “detect and prevent the unauthorized use and transmission” of information. DLP acts on what people and systems do with data; NIST’s examples are endpoint and network actions. DSPM examines data at rest and asks whether its location and access are appropriate before anyone moves it.
Naming overlaps. Google’s discovery service belongs to Sensitive Data Protection, which now includes the service formerly branded Cloud DLP. Purview DSPM consolidates insights from Purview DLP and can apply DLP policies as remediation. CISA’s Zero Trust Maturity Model, whose cisa.gov page is now labeled “Archived Content”, pairs them: its optimal data inventory stage adds DLP that dynamically blocks suspected exfiltration.
DSPM vs CIEM and identity governance
Cloud infrastructure entitlement management analyzes identities and permissions in cloud IAM. Microsoft says its CIEM capability analyzes identity configurations and usage “to identify excessive, unused, or misconfigured permissions” across Entra ID, AWS IAM and Google Cloud IAM. AWS IAM Access Analyzer reports external, internal and unused access.
The overlap is access-path analysis. CIEM starts from the identity and asks what it can reach; DSPM starts from the sensitive store and asks who can reach it. Identity governance sits above both: CSF 2.0 PR.AA-05 asks that access permissions be “defined in a policy, managed, enforced, and reviewed,” applying least privilege (NIST AC-6) and separation of duties. DSPM findings show reviewers which entitlements matter most. Non-human identities are covered in the AI agent identity guide.
DSPM vs CSPM vs DLP vs CIEM
| DSPM | CSPM | DLP | CIEM | |
|---|---|---|---|---|
| Starts from | Sensitive data | Resource configuration | Data in use, in motion and at rest | Identities and entitlements |
| Core question | Where is sensitive data, and who can reach it? | Is infrastructure configured to standard? | Is this use or transfer allowed? | Which identities hold excess permissions? |
| Example finding | Customer records in a publicly readable bucket | Storage account allows public access | Upload containing card numbers | Unused admin rights on a service account |
| Typical action | Restrict access, remove copies, open a ticket | Fix the setting | Block or alert | Right-size or remove permissions |
| Framework anchor | NIST CM-12, PM-5(1); CSF ID.AM-07 | NIST CM-8 component inventory | CISA ZTMM data pillar | NIST AC-6; CSF PR.AA-05 |
How platforms bundle DSPM
Gartner describes cloud-native application protection platforms as “a unified and tightly integrated set of security and compliance capabilities” spanning configuration management, risk prioritization and runtime. DSPM can ship inside one: Microsoft calls Defender for Cloud a CNAPP and puts sensitive data discovery and CIEM in its Defender CSPM plan. CNAPP consolidation changes negotiating positions, as the Google and Wiz analysis explains. Vendors’ own descriptions as of October 2026, alphabetical within each group, not ranked:
| Packaging | Offering | Coverage the vendor documents |
|---|---|---|
| Cloud provider | AWS: Amazon Macie | Amazon S3; machine learning and pattern matching |
| Cloud provider | Google Cloud: Sensitive Data Protection discovery | BigQuery, Cloud SQL, Cloud Storage, Vertex AI, Amazon S3, Azure Blob Storage |
| Cloud provider | Microsoft: Purview DSPM | Microsoft 365, Azure, Fabric; other locations through partner integrations |
| CNAPP | Wiz | Agentless discovery in code, IaaS, PaaS, DBaaS and AI |
| Data security specialist | Cyera | Cloud, SaaS, DBaaS, on-premises; runs in the customer’s environment or as SaaS |
| Data security specialist | Netskope One DSPM | IaaS, PaaS, SaaS, on-premises; integrates with Netskope DLP and CASB |
| Data security specialist | Varonis | Cloud, SaaS, on-premises; permissions analysis |
DSPM evaluation checklist
- Data stores supported. Check every store type you run against documented support. Coverage ranges from S3 only (Macie) to products listing on-premises sources.
- Classification method and accuracy validation. Ask about methods, custom classifiers, and full scans versus sampling. Run the tool against a labeled sample of your own data and count misses and false positives. Microsoft notes its discovery “might not detect all types,” and Google says it cannot commit to full accuracy in every scenario. Treat any vendor precision figure as a claim to test.
- Agentless vs agent. Wiz and Cyera describe their discovery as agentless. Ask what on-premises sources require and which read permissions the scanner needs.
- Data residency of the scanner. Find out where content is read and where samples and metadata are stored. Cyera, for example, can run entirely within the customer’s environment or as SaaS.
- Access-path analysis. Check that effective permissions resolve through groups, roles and cross-account trust, including non-human identities.
- Ticketing and SIEM integration. Macie publishes findings to EventBridge; Google can send data profiles to Security Command Center and trigger Pub/Sub notifications.
- Remediation options. Confirm which fixes run automatically, which need approval, and whether actions are logged; Purview says actions taken by its AI agents are always audited.
- Cost and overlap. Microsoft bills Defender CSPM by enabled resources and samples partly to save discovery cost. Check whether an existing CNAPP or suite license includes DSPM.
How to decide
- Mostly one cloud: start with the provider’s native service and confirm store coverage.
- A CNAPP already deployed: check whether DSPM is included or an add-on; its value there is joining sensitivity to attack paths.
- Multicloud plus SaaS and on-premises file shares: shortlist products that document on-premises support and test classification on your own data.
- Documents concentrated in Microsoft 365: Purview DSPM covers it natively; check partner integrations for other locations.
- A regulator’s inventory requirement: map outputs to GDPR Article 30 or NIST CM-12 and PM-5(1) before the proof of concept.
DSPM sits alongside DLP, CSPM and CIEM; decide which tool owns each finding before alerts arrive from all four.
Frequently asked questions
What is DSPM in simple terms?
DSPM is software that finds where sensitive data is stored, classifies it, works out who can access it, and flags risky exposure for fixing. Gartner’s definition covers cloud providers and on-premises data centers.
What is the difference between DSPM and CSPM?
CSPM checks cloud infrastructure settings against security standards and reports misconfigurations. DSPM inspects the data inside resources and reports which sensitive data is exposed and to whom. A public bucket is a CSPM finding; a public bucket holding customer records is a DSPM finding. Microsoft Defender for Cloud offers both.
What is the difference between DSPM and DLP?
DLP detects and prevents unauthorized use and transmission of data as people and systems act on it. DSPM assesses where data rests and who can reach it. Some products connect them; Purview DSPM, for example, can apply DLP policies as remediation.
Is DSPM part of CNAPP?
Often. Microsoft includes sensitive data discovery in Defender for Cloud, which it calls a CNAPP, and Wiz offers data discovery on its platform. Specialist products such as Cyera, Netskope One DSPM and Varonis also document on-premises coverage.
Sources
- Gartner Peer Insights: DSPM market definition
- NIST SP 800-53 Rev. 5 (CM-12, PM-5)
- NIST Cybersecurity Framework 2.0
- NIST Privacy Framework 1.0
- NIST IR 8496 initial public draft
- NIST glossary: data loss prevention
- CISA Zero Trust Maturity Model v2.0
- GDPR (EUR-Lex)
- CSA: Cloud Controls Matrix data protection controls
- Microsoft: Defender for Cloud data security posture
- Microsoft: Purview DSPM
- AWS: Amazon Macie
- Google Cloud: Sensitive Data Protection data profiles
Last checked: October 2026. Guidance and product features change; check each source before you rely on it.