Data Security Posture Mgmt (DSPM)
Discovers and classifies sensitive data everywhere.
Overview
DSPM finds where sensitive data lives across cloud, SaaS, and on-prem, then maps access and risk to it. It answers the foundational 'where is our data' question that DLP and governance depend on. A fast-growing category often bundled with CNAPP or data-access governance. Priced by data volume or environment.
Data discovery layered onto cloud security as the program matures.
Advantages
- Wiz/Cyera fast agentless discovery
- answers 'where is our sensitive data'
- feeds DLP and governance
- cloud-native.
Trade-offs
- New category with overlapping claims
- on-prem coverage weaker
- remediation still manual
- can duplicate a CNAPP data module.
Open-source option
DSPM is an emerging category; cloud-scale data discovery, classification and risk graphing depend on managed connectors and ML — no credible self-hostable OSS equivalent exists yet. OSS building blocks exist for pieces of the pipeline (Microsoft Presidio for PII detection, OpenMetadata/DataHub for cataloging) but none combine discovery + classification + access/risk graphing + remediation the way commercial DSPM does.
Vendors & tools in this area
Cloud-first DSPM with strong marks for discovery and exposure-path mapping across data lakes and SaaS.
Visit site →Semantic-AI DSPM; agentless, hybrid cloud + on-prem, no manual classification rules.
Visit site →Data Command Center DSPM module (Securiti is a Veeam company since December 2025); also listed in privacy-management for the broader PrivacyOps platform.
Visit site →