Market Guide for Data Security Posture Management

17 September 2025 - ID G00823795 - 18 min read
By Joerg Fritsch, Brian Lowans,  and 1 more
DSPM solutions provide essential visibility into data assets, especially data used for AI. They discover, classify, and catalog unstructured and structured data across sources. Cybersecurity leaders should use DSPM to assess and mitigate exposure to privacy, security, and AI-related data risks.

Overview

Key Findings

  • Data security posture management (DSPM) solutions provide essential visibility into constantly moving and exposed data, especially as more data is used for AI purposes. It bridges the gap between data discovery/classification and the eventual implementation of automated remediation controls.
  • Vendors are taking different approaches to integrating bolt-on and value-added capabilities, which is confusing for customers because there is no like-for-like. However, most DSPM products can be grouped into one of five main use cases: DLP, privacy and data governance, entitlement management, CSPM, and DSPM for AI.
  • DSPM products populate their built-in proprietary data catalogs with the metadata created by their discovery capabilities. These data catalogs remain proprietary and do not support open standards, such as DCAT or Dublin Core, leading to significant vendor lock-in.
  • Organizations often underestimate the effort required to operationalize DSPM outputs, especially in large enterprises where the volume of data can be overwhelming or more than one DSPM vendor is deployed.

Recommendations

  • Operationalize DSPM findings in a timely manner by allocating sufficient staffing and resources. Plan to implement at least one DSPM product to address the security of unstructured data.
  • Prioritize vendors that provide capabilities to assess risks associated with data residency, unauthorized access, and excessive privileges across a data estate, while also delivering robust security capabilities, such as DAG, DLP, and DAM, that align with architecture and control requirements.
  • Align DSPM solutions to the organization’s business needs and primary use cases by prioritizing DSPM that supports emerging open standards and offers broad integration capabilities.

Market Definition

Data security posture management (DSPM) discovers previously unknown data across on-premises data centers and cloud service providers (CSPs). It also helps categorize and classify previously unknown and discovered unstructured and structured data. As data rapidly proliferates, DSPM assesses who has access to it to determine its security posture and exposure to privacy, security and AI-usage-related risks. DSPM is delivered as software or as a service.
DSPM tools play a crucial role in helping organizations classify, manage and secure their data more effectively. By identifying potential risks, such as those linked to data residency, unauthorized access or excessive privileges, these tools enable organizations to apply appropriate security controls and comply with data protection regulations.
DSPM tools provide visibility into data access, allowing organizations to enforce least-privilege principles, enhance data security and mitigate the risk of data breaches. This visibility also helps organizations understand data dependencies and impacts, thereby aiding compliance and data quality efforts. Additionally, DSPM tools help identify data owners, improving accountability and supporting effective incident response and root cause analysis.
Moreover, DSPM tools generate audit trails, compliance reports and real-time alerts for any policy violations. These features help organizations adhere to regulations and standards, including privacy, financial, government and health regulations. DSPM tools also play a vital role in protecting data from accidental exposure by AI pipelines, ensuring that sensitive information remains secured throughout the AI development process.

Mandatory Features

  • Data discovery: Identify and locate sensitive information within an organization’s data repositories. DSPM tools can provide visibility across:
    • Managed cloud data warehouses
    • Unmanaged databases running on-premises
    • Object storage, such as file stores, managed on-premises and in the cloud
  • Data classification: Automatically classify and tag data based on categories, such as personally identifiable information (PII), financial data, health information and intellectual property. DSPM tools use pattern recognition, machine learning and contextual analysis to label data.
  • Data risk analysis and posture management: Assign risk scores to data based on factors such as sensitivity, access patterns and exposure. DSPM tools continuously monitor and analyze access patterns, configurations and compliance with security policies to identify vulnerabilities and misconfigurations.

Common Features

  • Data access analysis: Discover who has access to data by continuously scanning access permissions and monitoring user activities across various data repositories.
  • Compliance: Ensure that data-handling practices align with regulatory requirements by continuously monitoring and enforcing data security policies. DSPM tools provide audit trails, generate compliance reports and offer real-time alerts for any policy violations.
  • Access analysis and anomaly detection: Continuously monitor data access patterns and usage, providing real-time alerts and detailed audit logs to detect and respond to unauthorized activities. Anomaly detection features use advanced analytics and machine learning to identify unusual access behaviors, helping to quickly pinpoint potential security threats and insider risks.
  • Generative AI (GenAI) policy enforcement: Identify data flowing into large language models (LLMs) used by GenAI by analyzing data pipelines and providing data access governance and entitlement management.
  • Data security in AI pipelines: Ensure that sensitive data is protected from exposure by AI pipelines by detecting how it moves and transforms.
  • Data lineage: Map the entire life cycle of data, tracing its origins, movements and transformations across the organization.

Market Description

The DSPM market — and with it the capabilities and products — needed many iterations and adaptations to achieve usefulness to end customers. DSPM now supports an evolving portfolio of data security capabilities. The iterations have been so extensive and impactful that the products’ combined capabilities now bear only a slight resemblance to the capabilities of the vendors that pioneered DSPM, leading to uncertainty for customers as to what DSPM actually is.
Figure 1 illustrates a DSPM-supported data security process where DSPM discovers data across multiple environments, classifies it to understand sensitivity, and analyzes risk. Risks include overexposed data with lenient access permissions, data that is not in the appropriate geolocation, or that is otherwise not protected correctly. Based on these insights, DSPM defines and enforces policies with built-in capabilities or through integration with third-party tools, and monitors and feeds into remediation and reporting. For the data sources, the width of the lines qualitatively represents common DSPM bias toward cloud-based data and file shares.
Figure 1: Data Security Posture Management Capabilities
Data security process flows from data sources into mandatory and common DSPM capabilities for visibility and protection.
DSPM is an all-seeing, all-feeling nervous system for data security. It creates awareness of data vulnerabilities and enables mitigation before those are exploited.
For some vendors, the many iterations have led to products that seem to have lost focus. They offer more functionality than organizations need, and at times overload the end with bolt-on data discovery and insights capabilities for which they have no use or staff to operationalize them.
The most foundational capability present in even the earliest DSPM is providing swift and accurate data visibility. Although data discovery and classification were not new by the time DSPM emerged, customers using leading DSPM vendors could achieve results at much greater speed than with traditional products. To achieve higher speeds, DSPM vendors frequently leverage cloud data APIs, which enable their products to scan data rapidly in cloud environments. However, these speed advantages cannot be replicated for data stored in on-premises systems, where these APIs are not present. As a result, DSPM products may not work at all on-premises, or may operate much more slowly compared to their performance in the cloud.
DSPM products leverage cloud security posture management (CSPM) capabilities to scan cloud infrastructure and identify data assets, enabling more consistent tracking as assets move or proliferate across environments. This approach provides greater uniformity in data classification processes and allows for more reliable monitoring of data residency and sovereignty — capabilities not typically offered by traditional data classification products.
DSPM bridges the gap between data discovery/classification and the eventual implementation of automated remediation controls. For example, it quarantines sensitive data by integrating with third-party DLP products or enforces data protection policies to prevent unauthorized access via third-party EDRM products.
Despite these advances, a critical limitation remains: Most DSPM vendors frequently lack automated remediation for the data risks they identify. Many are now attempting to address this gap by integrating their solutions with data access governance (DAG), data loss prevention (DLP), and identity and access management (IAM) controls. As the market continues to evolve, the true value of DSPM will depend on how effectively it can close this gap and deliver actionable, automated responses.

Market Direction

Interest in and uptake of products that include DSPM capabilities or stand-alone DSPM products is currently on the rise. The most evident reason for this is the advent of turnkey GenAI capabilities and, with it, the need to manage and secure unstructured data — the key use case for DSPM.
DSPM for AI extends capabilities to cover AI-specific needs, such as filtering prompts and outputs for sensitive data or including agentic data access activity into entitlement management reports. Table 1 has an overview of DSPM capabilities that are frequently augmented or extended to AI. In addition to evaluating these capabilities, prospective DSPM buyers should also determine whether a vendor can support specific AI services and architectures, such as Microsoft Copilot, ChatGPT, or Claude.

Extending DSPM Capabilities to AI

DSPM capabilities
How to extend to AI
Data discovery and classification
Extended to discover sensitive data in prompts, output, and vector databases (embeddings).
Data access analysis
Inclusion of data access of agentic AI and (stand-alone) models to data stores.
Data flow mapping (data security in AI pipelines)
Maps data flows in AI pipelines, for example, as used in model training and third-party AI APIs.
Policy enforcement
What (Gen)AI can be used, and in what geographic region it can be used. Reporting unsanctioned use of AI.
Integration
Extends DSPM integration to popular AI platforms, for example, OpenAI or Amazon SageMaker.
Source: Gartner
DSPM for AI frequently covers only risks in off-the-shelf AI applications or features. For example, it does not typically cover model security, such as model inversion attacks or model data leakage testing, in custom-made AI deployments.
Vendors evolved in three main directions from their origins — pure-play DSPM versus traditional data security incumbent — shapes how their toolsets will grow:
  • DSPM-native startups that continue to grow independently.
  • DSPM-native startups that have been acquired by traditional vendors in the DLP, SSE, DAG, storage, or DAM markets.
  • Traditional data security vendors with DLP, SSE, DAG, storage, and DAM that have built out DSPM capabilities in their legacy platforms.
As vendors continue to evolve, these market directions have created competitive challenges because customers frequently have requirements in each of the three subcategories. This causes difficulties because the subcategories often have different security product buyers, making it unclear which enterprise role has to fund and operationalize DSPM.
Looking ahead, the DSPM market may see even greater convergence with adjacent data and AI governance platforms, driven both by strategic acquisitions (for example, Collibra’s purchase of Raito) and by vendors extending native DSPM capabilities into broader data security and governance suites. DSPM, DSP, data governance, and AI governance platforms will coalesce around common APIs and integration frameworks, simplifying deployment and accelerating time to value as these once-separate capabilities will start to converge into unified control planes for the entire data life cycle. The proverbial “single pane of glass for data security” that, for traditional security controls, was often promised but too hard to achieve.

Market Analysis

Vendor Categorization

DSPM products include actionable security controls that, for example, operationalize security policy or risk insights. However, products differ widely and there is little homogeneity, making it difficult for end customers to compare and select DSPM from five main categories:
DLP products operationalize DSPM to extend DLP. For example, by adding features that prevent sensitive data from leaking to off-the-shelf AI such as Microsoft Copilot. Several DLP vendors have acquired early-stage DSPM vendors to extend established DLP products in this way.
Privacy and data governance products operationalize DSPM to support end customers with a focus on privacy, such as privacy reporting or subject rights requests. Customers with a general interest in data governance find this variation of DSPM particularly helpful.
Entitlement management products operationalize DSPM to optimize entitlements and limit oversharing. Entitlement management is frequently seen as a mandatory element for preparing data before it can be used by GenAI.
CSPM operationalizes DSPM to facilitate holistic cloud security, where both the infrastructure security posture and data security controls are used as input for an initial triage of the resulting overall data risk. This is the initial DSPM use case described by Gartner in 2023.
DSPM for AI operationalizes one or more of the other categories to secure the data, models, and training pipelines of AI and ML deployments. Some vendors call this “AI Security Posture Management” or “AI SPM,” which bears the risk of acronym overload and dilutes the meaning of the market category DSPM.

Benefits of Adopting DSPM

The key benefit of DSPM is data visibility. This has always been important, and no organization can confidently navigate the age of AI without a clear understanding of data assets and their security. This visibility is the launchpad for action, such as assessing and prioritizing data according to risk, bridging the gaps to blocking security controls provided by third-party vendors, or automated remediation, such as blocking access based on detected anomalies.

Thus, DSPM is in an excellent position to support customers on their journey to treat data as secured and managed assets — not as buried artifacts. Examples are:
  • Data security for AI: Secure usage of AI requires not just data, but data that is well-known, governed, and secured. Some DSPM products secure off-the-shelf AI capabilities, such as Microsoft Copilot, or custom-made AI deployments, such as AI models that are trained and run in-house, by discovering AI data pipelines and building their product capabilities around these.
  • Data access anomaly detection: By monitoring AI and data product pipelines in real time, DSPM automatically detects anomalous access patterns, or unauthorized data flows — helping organizations to maintain data quality and implement guardrails throughout the product life cycle. Some DSPM data catalogs and reporting dashboards give an end-to-end view of which data contains regulated or sensitive information, how they have been built and who has accessed it (also known as data lineage), and provide required audit information.
Besides innovative use cases around data products and AI, DSPM also supports and enhances traditional use cases — for example, reducing the false positive rate of DLP, building a comprehensive data catalog for privacy management and reporting or entitlement management.

Challenges of DSPM Adoption

Gartner inquiry data shows that end customers implementing DSPM face three main challenges that are closely related:
  • Need for many FTEs and/or temporary hires to validate and act on the product results. For example, Gartner observed that an organization with approximately 40,000 employees may need 100 temporary hires to initially validate and sort the DSPM findings, such as file entitlements for GenAI, within a 100-day sprint.
  • Heavy reliance on cloud-native architectures and SaaS architectures with limited on-premises support. Products and services that have no stand-alone on-premises deployment model are a growing concern for organizations with strict data residency or compliance requirements. Often going as far as being a deal breaker. At the same time, even on-premises DSPM deployments frequently funnel even “metadata-only” insights back to the vendor’s cloud, introducing data privacy and regulatory concerns that can undermine the very protections DSPM is meant to deliver.
  • Lack of open standards and integration options with other security tools. Customers cannot repeat resource-consuming activities for each DSPM product but want to leverage the data catalog across all data security products. However, in the absence of open standards and integration options, customers must frequently make an either-or decision in favor of a single capability group.
  • Uncertainty around the type of DSPM required for the business. Because customers frequently must focus on one DSPM product, they find themselves weighing equally pressing and important data security requirements against each other.
  • Lack of automated remediation controls. DSPM, particularly when implemented in organizations without established data security programs, often generates a high volume of alerts. However, many DSPM solutions lack automated remediation features to quickly address these alerts. As a result, users can experience alert fatigue, even if a DSPM is integrated with other data security incident response processes. This limitation has led clients to question the overall value of the product and has contributed to many customers abandoning traditional database activity monitoring (DAM) tools in the past.

Representative Vendors

The vendors listed in this Market Guide do not imply an exhaustive list. This section is intended to provide more understanding of the market and its offerings.
The vendors listed in this Market Guide do not imply an exhaustive list but are intended to provide more understanding of the market and its offerings.
This section features representative vendors for DSPMs across several subcategories — there is hardly any like-for-like comparison. It also lists traditional vendors that have significantly rearchitected their products, for example, through the acquisition of a DSPM vendor.

Vendor Selection

The DSPM market is seeing ongoing consolidation on two fronts: consolidation into broader platforms and acquisitions of stand-alone DSPM vendors. At the same time, new vendors and startups are entering this market. Table 2 lists representative DSPM vendors that exemplify the mandatory and product-specific common features described in the Market Definition section.

Representative DSPM Vendors

Vendor
Product name
BigID
Concentric AI
Concentric AI Semantic Intelligence Platform
Cyera
Cyera Data Security Platform
Forcepoint (Getvisibility)
Data Security Cloud
Google (Wiz)
Google Cloud Platform
IBM (Polar Security)
Guardium DSPM
Microsoft
Microsoft Purview
Palo Alto Networks (Dig Security)
Cortex Cloud DSPM
Proofpoint (Normalyze)
Proofpoint DSPM
Rubrik (Laminar Security)
Rubrik DSPM
Securiti
Data Command Center
Sentra
Symmetry Systems
Symmetry Data+AI Security Platform
Varonis
Varonis Data Security Platform
Source: Gartner

Market Recommendations

Address Years of Unstructured Data Security Debt by Allocating Resources to Implement at Least One DSPM Product

Many organizations have not cataloged their unstructured data and are uncertain about its security and compliance. Data security debt is a category of technical debt often revealed in the process of implementing generative AI technologies. Generative AI uses unstructured data in a way that was not previously a concern for organizations, revealing activities that need to be completed, such as data classification and sensitivity labeling of the data available for ingestion. Addressing data security debt early on reduces data security risks throughout the life cycle.
Allocate resources to implement at least one DSPM to catch up, and catalog and secure both structured and unstructured data to similar levels of maturity. Organizations with high data security maturity frequently have more than one DSPM implemented because they need DSPM for use cases where current DSPM products hardly overlap (for example, DLP and entitlement management for GenAI). Given that the results of DSPM data discovery are not shareable between products or vendors, the only solution today is to implement two DSPM products. In such cases, Gartner recommends clients to prioritize DSPM for their main use case and hold off on the deployment for less urgent use cases until the market further evolves.

Ensure DSPM Products Align With Prioritized Security Use Cases

The unstructured data catalog that DSPM products create is tedious work, and because vendors do not implement open standards, it remains proprietary and represents significant vendor lock-in. It is currently impossible to leverage DSPM data catalogs across multiple security or DSPM products. In the case of DSPM, this also locks into a specific approach or use case.
Therefore, a product’s approach to unstructured data management and security must align with the prioritized use case, maturity in data security and management, and long-term plans for unstructured data. For example, while the organization plans to leverage 100% of its data for GenAI by the end of next year, the prevalent use case at that time might be DLP. In many cases, this cannot be done satisfactorily with one DSPM product.

Plan for Sufficient Staffing and Resource Allocation to Operationalize DSPM Findings

Implementing DSPM is not just a technology investment; it requires significant human resources to validate, triage, and act on the findings. Organizations often underestimate the effort required to operationalize DSPM outputs, especially in large enterprises where the volume of unstructured data can be overwhelming. For example, an organization with 40,000 employees might need up to 100 temporary hires to process DSPM findings and rectify the entitlements of their unstructured data for GenAI within a 100-day sprint.
To ensure success, plan for adequate staffing with internal resources or temporary hires to manage the influx of insights and remediation tasks generated by DSPM tools. Establish clear processes for prioritizing and addressing findings, and use phased rollouts to manage workload effectively. Proactive resource planning will maximize the value of DSPM investments and achieve measurable improvements in data security posture.

Prioritize DSPM Solutions With Open Standards and Integration Capabilities

When selecting a DSPM solution, prioritize products that support open standards, such as Data Catalog Vocabulary (DCAT) or Dublin Core, and that offer robust integration capabilities with existing security tools and data catalogs. The lack of open standards in the DSPM market often leads to vendor lock-in and creates silos, making it difficult to leverage data catalogs across multiple security products. By choosing solutions that emphasize interoperability, investments are future-proofed, and workflows between different parts of the security ecosystem are smoothed.
Integrating DSPM with other security tools, such as DLP, privacy management, and entitlement management platforms, allows for a more holistic approach to data security. This not only reduces redundant resource-consuming activities but also enhances visibility and control over data assets. In the long run, this strategy will help avoid costly migrations and enable an organization to adapt quickly as data security needs evolve.

Note 1: Gartner’s Initial Market Coverage

This Market Guide provides Gartner’s initial coverage of the market and focuses on the market definition, rationale for the market, and market dynamics.