AI-native DSPM closes the data visibility gap in cyber recovery

At a glance

What this is: This is an analysis of Cyera's AI-native DSPM partnership with Cohesity, focused on how continuous data discovery and classification are being tied to cyber recovery workflows to reduce blind spots in large, distributed estates.

Why it matters: It matters because identity, access, and recovery teams increasingly need trustworthy data context before they can decide what to protect, restore, or investigate after an incident.

By the numbers:

• 60% of enterprises lack visibility into at least half of their data estate.
• 34% of organizations hit by ransomware said better data classification and protection would have made the biggest difference.
• Cyera says its classification approach delivers 95%+ accuracy across structured and unstructured data.

Context

AI-native DSPM is a data security posture management approach that uses AI to discover and classify sensitive data across distributed environments. The governance gap it addresses is simple: many organisations can no longer say with confidence where sensitive data lives, who can reach it, or what should be restored first when recovery pressure starts.

That gap becomes sharper as data spreads across cloud, SaaS, on-prem systems, backups, and AI workflows. For IAM, PAM, and data governance teams, the problem is not only protection at rest. It is the lack of reliable context needed to make access, remediation, and recovery decisions after an incident.

Cyera's partnership with Cohesity is presented as an attempt to connect discovery, classification, governance, and recovery into one operational loop. The underlying message is that cyber resilience now depends on continuous data intelligence, not isolated controls that stop at the perimeter of a single platform.

Key questions

Q: How should teams prioritise recovery when sensitive data is scattered across hybrid estates?

A: Teams should prioritise restoration by sensitivity, compliance exposure, and business criticality, not by whichever system happens to be easiest to recover. The key is to pair backup orchestration with continuous classification so the most exposed or regulated data is handled first. Without that context, recovery can restore risk as quickly as it restores availability.

Q: Why does poor data visibility make ransomware recovery harder?

A: Poor visibility slows recovery because teams cannot quickly identify what was exposed, what is business-critical, or what carries regulatory risk. That forces guesses during a time when speed matters most. The result is longer downtime, more uncertainty, and a higher chance that the wrong data is restored first.

Q: What breaks when classification is not connected to cyber recovery workflows?

A: Recovery breaks at the decision layer. Teams may be able to restore systems, but they lose the ability to distinguish sensitive data from low-risk data before it re-enters production. That creates a gap between technical recovery and governance recovery, which is where compliance and exposure mistakes usually happen.

Q: What should security, IAM, and resilience teams be accountable for in data recovery?

A: They should be accountable for making sure recovery decisions reflect current data sensitivity, access context, and regulatory impact. That means governance teams define the rules, identity teams understand who can reach the data, and resilience teams execute restores against that context. Shared accountability is essential when data context drives incident outcomes.

How it works in practice

Why data visibility breaks down across hybrid estates

Data visibility fails when discovery is fragmented across cloud, SaaS, on-prem, and backup silos. In that model, security teams may have controls around individual systems but no dependable view of where sensitive data has propagated or duplicated. AI adoption makes this worse because data is created, copied, embedded, and shared faster than manual classification can keep up. DSPM exists to continuously discover and classify data so governance decisions are made from actual state, not assumptions built at design time.

Practical implication: treat continuous discovery as a prerequisite for recovery planning, not as a reporting layer.

How AI-native classification changes recovery prioritisation

Classification is the mechanism that turns raw data inventory into recovery intelligence. Without it, teams restore by guesswork, usually guided by system criticality rather than data sensitivity or regulatory exposure. AI-native classification aims to distinguish structured and unstructured data at scale with less tuning than older rules-based approaches. In recovery workflows, that means teams can identify which backups contain sensitive records, which workloads carry the most compliance risk, and which assets should be restored first to reduce blast radius.

Practical implication: align restoration order to data sensitivity and business criticality instead of storage location alone.

Why cyber recovery and DSPM need to operate together

Cyber recovery becomes weaker when it cannot see the contents and context of what it is restoring. A backup can be intact and still be the wrong thing to bring back first if it contains exposed, redundant, or regulated data. The article points to agentless discovery and remediation inside recovery workflows, which is meant to narrow the gap between detection, classification, and response. That architecture matters because recovery is no longer just a storage problem. It is a governance decision about which data can safely re-enter production.

Practical implication: embed data classification into recovery runbooks so restore decisions reflect risk, not only availability.

NHI Mgmt Group analysis

Recovery without data context is a governance failure, not a storage failure. The article's core issue is that organisations cannot recover confidently when they do not know what they are recovering. That is an identity and governance problem because access, sensitivity, and restoration priority all depend on trustworthy data intelligence. The practitioner implication is that recovery workflows now need classification state as an input, not an afterthought.

Data visibility gap is the right named concept for this category shift. The article shows that the real control gap is not lack of backup capacity but lack of continuous visibility into where sensitive data lives and how it moves. In AI-heavy environments, that gap widens because content is copied into copilots, agentic workflows, and hybrid estates faster than static inventories can track. The practitioner implication is that governance programmes need an always-current data map, not periodic snapshots.

AI accelerates data sprawl faster than manual governance can absorb. AI adoption increases the number of places sensitive information can appear and the speed at which it can move. That means traditional point-in-time controls are increasingly mismatched to the operational tempo of modern estates. The practitioner implication is that data security teams should assume classification debt grows unless discovery is continuous.

Recovery decisions are now privileged decisions in disguise. When teams decide what to restore first, they are making access, exposure, and compliance choices that shape downstream risk. If sensitive data is restored before it is understood, the recovery process can reintroduce the incident rather than contain it. The practitioner implication is that restoration logic should be governed with the same discipline as privileged access paths.

AI-native DSPM is becoming a control plane for resilience, not just a discovery tool. The partnership described in the article reflects a broader market movement toward connecting data intelligence with operational response. That convergence matters because security teams increasingly need one view that links discovery, classification, prioritisation, and remediation. The practitioner implication is to evaluate whether data security tooling can influence recovery action, not just produce reports.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Key Challenges and Risks

What this signals

Continuous data intelligence is becoming the practical boundary between recoverable and unrecoverable incidents. When AI creates more copies of sensitive content across cloud and SaaS estates, static inventories age too quickly to support real-time restoration decisions.

Data visibility gap: Organisations that cannot continuously discover and classify sensitive data will keep making recovery choices with incomplete context. That creates avoidable exposure because restore order, retention cleanup, and compliance triage all depend on knowing what the data is before the incident closes the window.

The 72% security incident rate for organisations that describe themselves as confident in AI deployment is a warning that confidence can outrun control maturity, according to the 2026 Infrastructure Identity Survey. In practice, the teams that survive AI-driven sprawl are the ones that treat visibility as an operating requirement, not a one-time project.

For practitioners

• Map sensitive data propagation across recovery estates Inventory where sensitive data is duplicated across cloud, SaaS, on-prem, and backups so recovery teams can see the full blast radius before an incident forces decisions.
• Tie classification to restore order Update recovery runbooks so restoration priority is driven by sensitivity, compliance impact, and business criticality instead of storage location or backup age.
• Reduce ROT data before incidents expose it Identify redundant, obsolete, and trivial data in backup and production estates, then remove it to reduce exposure scope and lower storage overhead.
• Validate continuous classification accuracy Test whether discovery and classification remain reliable across structured and unstructured data at enterprise scale, especially where AI workflows are creating new copies of sensitive content.

Key takeaways

• Cyera's analysis ties recovery quality to data visibility, showing that enterprises cannot restore confidently when sensitive data is scattered across hybrid estates and backups without reliable classification.
• The article cites 60% of enterprises lacking visibility into at least half of their data estate, which explains why ransomware response so often turns into uncertainty about what to restore first.
• Continuous discovery and classification change recovery from a guesswork exercise into a governed decision process, especially when AI is accelerating data sprawl.

Key terms

• Data Security Posture Management: Data Security Posture Management, or DSPM, is the continuous discovery and monitoring of where sensitive data lives, how it is exposed, and where policy gaps exist. Its value rises when it feeds remediation rather than generating findings alone, especially in environments where AI expands the number of data paths.
• Cyber Recovery: Cyber recovery is the process of restoring systems, data, and access controls after a cyberattack in a way that preserves trust in the recovered environment. It goes beyond standard disaster recovery by assuming credentials may be compromised and restoration steps themselves may need validation.
• Data Visibility: Data visibility is the ability to discover what data exists, where it lives, and which identities or systems can access it. For AI governance, it is the prerequisite for classification, access review, and auditability because controls cannot be enforced against unknown or unmapped data.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.