What is DSPM (Data Security Posture Management)?
Data Security Posture Management (DSPM) discovers where sensitive data resides across cloud storage, databases and warehouses, classifies it by sensitivity, and determines which identities and network paths can reach it — shifting the security question from how a store is configured to what is actually inside it and who can read it.
The problem DSPM solves
Most organisations cannot answer a simple question: where is our customer data?
Not because nobody cares, but because data sprawls faster than anyone documents it. One production database becomes a database, three read replicas, four analytics warehouses, a dozen buckets holding exports, a data lake, a Snowflake stage, and a caching layer somebody stood up for a demo. Every copy is a copy of the risk, and no map exists — until an auditor, a regulator or a breach demands one.
Why "encrypted at rest" is a weak answer
Compliance reports routinely show 100% encryption at rest. It is usually true and frequently irrelevant.
Encryption at rest protects against one specific threat: someone physically obtaining the storage medium. It does nothing about the far likelier scenario — a legitimate credential reading the data through the API exactly as designed. If the key is a provider-managed key that every principal in the account can use, "encrypted" is a checkbox, not a control.
DSPM asks the better questions: what is in this store, who can read it, and is any path to it reachable from outside?
How DSPM works
- Discover every data store across the estate — object storage, managed databases, warehouses, file systems, backups and snapshots.
- Classify what each one holds. Sensitivity labels typically cover PII, PHI, PCI cardholder data, credentials and intellectual property.
- Map access by joining classification with the identity graph, so you know exactly which principals can read or write each store.
- Assess exposure by layering network reachability on top — a technically encrypted bucket that is publicly reachable is exposed.
- Monitor continuously, because new datasets and permission changes appear constantly.
Metadata vs content classification
Vendors split into two approaches, and the distinction matters for procurement and privacy review.
Content-based classification reads the data and pattern-matches on it. It is the more precise method and the more invasive one: it requires read access to the actual records, and often means data leaves your environment.
Metadata-based classification infers sensitivity from resource names, tags, schema and column names, storage class and configuration. A table with columns ssn and date_of_birth, or a bucket named customer-pii-exports, is a high-confidence classification without anyone reading a row. It is less precise on ambiguous stores, but it never touches the underlying data — which is often the deciding factor for regulated environments.
DSPM vs CSPM vs DLP
- [CSPM](/learn/cspm) — is the store configured correctly?
- DSPM — what is in the store, and who can reach it?
- DLP — is data leaving through a channel it should not?
DSPM is the context layer that makes the other two useful. A public bucket is a medium finding; a public bucket holding 800,000 PII records is an incident. Same misconfiguration, entirely different priority — and only DSPM knows the difference.
Next steps
Frequently asked questions
What does DSPM stand for?
DSPM stands for Data Security Posture Management — discovering where sensitive data lives across cloud environments, classifying it, and determining who can access it.
What is the difference between DSPM and DLP?
DLP (Data Loss Prevention) monitors data in motion and blocks it leaving through unauthorised channels. DSPM maps data at rest — where it is, how sensitive it is, and which identities and network paths can reach it. DLP is a control at the boundary; DSPM is an assessment of the estate.
Does DSPM read my actual data?
It depends on the approach. Content-based classification reads records directly and is more precise but requires access to the data itself. Metadata-based classification infers sensitivity from names, tags, schemas and configuration without reading any content, which many regulated organisations prefer.
Why is DSPM needed if data is already encrypted?
Encryption at rest protects against physical media theft, not against a legitimate credential reading the data through the API. If the encryption key is usable by every principal in the account, encryption adds little. DSPM answers who can actually decrypt and read the data.