DSPM needs data lineage to expose insider threat activity

At a glance

What this is: Cyberhaven argues that DSPM on its own sees exposure, while data lineage is what reveals whether sensitive data was actually touched and moved.

Why it matters: IAM, NHI, and insider-risk teams need behavioural context because access visibility without movement evidence leaves investigations and escalation decisions under-informed.

Context

DSPM is designed to answer inventory and posture questions, but insider risk is a behavioural problem as much as a data-location problem. When a tool can show sensitive files and misconfigurations yet cannot show whether content was copied, renamed, or moved, the governance gap sits between exposure and evidence.

That gap matters for identity and access teams because the question is not only who could reach the data, but what they did after reaching it. In practice, the control failure is often a lack of continuous lineage across cloud, SaaS, endpoint, and collaboration workflows, which leaves insider investigations relying on partial signals.

The article's core claim is that mature insider-risk programmes need both posture and movement context. That is typical of modern enterprise environments, where data often leaves its original repository through normal user actions rather than obvious exfiltration events.

Key questions

Q: What breaks when DSPM is used without data lineage for insider risk?

A: DSPM without data lineage breaks at the point where exposure becomes behaviour. You can see that sensitive data is overexposed, but you cannot prove whether someone opened it, copied it, renamed it, or moved it to an external destination. That leaves insider risk teams with posture tickets instead of evidence about actual data movement.

Q: Why does insider risk require more than static data posture?

A: Because insider events are behavioural, not just structural. Static posture can show broad access or misconfiguration, but it cannot tell whether a user downloaded the file, moved fragments into another tool, or transferred the content outside the organisation.

Q: What are the signs that insider activity is becoming a data exfiltration problem?

A: Watch for unusual patterns such as large print jobs, documents copied to USB devices, uploads to cloud storage tools, or sensitive files sent to personal email or chat. These behaviors can indicate that data is leaving approved channels. The key is to tie the event to a user and preserve enough detail to reconstruct the sequence quickly.

Q: How should security teams combine DSPM and DLP in modern data environments?

A: Use DSPM to discover and classify sensitive data, map who can access it, and identify exposure that policy may not see. Use DLP to enforce rules at the point of movement. The strongest programmes connect the two so discovery informs control decisions and enforcement feeds back into prioritisation.

Technical breakdown

Why posture scanning stops short of insider detection

DSPM establishes what sensitive data exists, where it is stored, and which permissions make it reachable. That is useful for exposure management, but it is still a snapshot. Insider risk is temporal and behavioural: a user can download, copy, rename, fragment, and relay data across systems while each individual action looks ordinary in isolation. A posture engine that only scans repositories will see the misconfiguration, not the exploitation path. The technical limit is that static classification does not maintain state across user sessions and downstream transformations.

Practical implication: Treat posture findings as exposure indicators, not proof of misuse.

How data lineage preserves the chain of custody

Data lineage tracks origin, transformation, and movement across the places users actually work, including copy-paste, uploads, attachments, renames, and browser-based transfers. That gives security teams a continuous chain of custody for sensitive content rather than a list of isolated repositories. In insider-risk terms, lineage turns an exposed file into an observable activity trail. It also helps distinguish benign access from material movement, because the same content can be seen leaving its original container even when no single event looks exceptional on its own.

Practical implication: Instrument the paths where data changes form, not just the repositories where it sits.

Why DSPM, DLP, and IRM only work together

DSPM, DLP, and IRM solve different layers of the same problem. DSPM finds where sensitive data and risky permissions exist. DLP enforces controls at the point of movement. IRM correlates posture and behaviour over time to assign risk meaning. If any one layer is missing, teams lose context or enforcement or both. For identity governance, the key insight is that entitlement review alone cannot explain whether access turned into movement. Behavioural context has to join entitlement data before an investigation can separate accidental exposure from active insider activity.

Practical implication: Correlate posture, movement, and user behaviour before escalating insider-risk cases.

Threat narrative

Attacker objective: The objective is to remove sensitive data from governed storage without triggering controls that only watch the original repository.

1. Entry begins when a user with legitimate access reaches overexposed sensitive data in a repository, shared drive, or collaboration system.
2. Credentialed access is then abused through ordinary actions such as download, copy, rename, paste, or upload, which can move content outside the original control boundary.
3. Impact occurs when the data leaves the environment or is assembled into a form that supports misuse, investigation gaps, or external disclosure.

Breaches seen in the wild

• Slack GitHub breach 2022: Slack employee tokens stolen via a compromised vendor were used to download private GitHub repositories over the 2022 holidays.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Data lineage is now a control plane, not a reporting enhancement. The article is really about the limits of posture-only governance. Once data is copied, renamed, or moved into another system, the original repository view loses forensic value. That means insider-risk programmes need evidence of movement as a first-class control objective, not just an after-the-fact investigation aid. Practitioners should treat lineage as part of the data security operating model.

Posture without behaviour creates false confidence in data security programmes. A broad permission set or exposed repository is only one part of the risk story. Without movement context, teams can see that data was reachable but not whether it was acted on by a user in a notice period, a contractor, or an over-entitled employee. That is why this problem sits at the intersection of DSPM and identity governance: access decisions need behavioural confirmation to become defensible. Practitioners should align exposure findings with user activity evidence before prioritisation.

Insider-risk detection now depends on correlating identity, endpoint, and collaboration signals. The article shows that data often leaves through everyday work tools rather than a single obvious transfer event. That makes isolated logging insufficient. Security teams need to connect who accessed the data, how it changed, and where it moved across cloud, endpoint, and SaaS services. Practitioners should assume the exfiltration path will cross boundaries that traditional repository scanners do not own.

Data movement creates the named concept of posture-to-provenance gap. This is the gap between knowing that data is overexposed and knowing whether that exposure was actually exploited. The article makes clear that the gap is where insider incidents hide, because posture tells you the condition and provenance tells you the outcome. Practitioners should design controls and investigations around that gap, not around repository scans alone.

From our research library:

• 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
• Read next: Identity Security Posture Management (ISPM) Guide

What this signals

The practical shift for security teams is to stop treating DSPM as a static exposure report and start treating it as one input into an evidence chain. When lineage is missing, every risky permission looks similar, even though only some have already turned into user-driven movement.

Posture-to-provenance gap: this is the point where access visibility ends and behavioural proof begins, and it is where insider-risk programmes most often fail. The organisation that can correlate exposure with movement will make faster, more defensible decisions about escalation, containment, and offboarding.

The broader pattern is familiar across data security programmes: 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026. That underscores how much sensitive-data risk now lives in collaboration and workflow layers rather than only in repositories.

For practitioners

• Map sensitive-data movement paths Trace how sensitive files move from source repositories into downloads, browser uploads, email attachments, and collaboration tools so that movement outside the original container is visible.
• Correlate posture findings with user activity Join DSPM exposure alerts to identity and session telemetry so that a risky permission only escalates when activity shows access, copy, rename, or transfer behaviour.
• Prioritise high-risk notice-period activity Flag users in resignation or offboarding windows when their access volume, file breadth, or data movement deviates from baseline, because those are the patterns that most often convert exposure into loss.
• Align DSPM with DLP enforcement Use DSPM to identify what is sensitive and DLP to stop it leaving through browser upload, email, or removable media once lineage shows the data is being moved.

Key takeaways

• DSPM tells teams where sensitive data is exposed, but lineage is what shows whether a real insider event has already started.
• The core operational gap is not inventory alone, but the inability to trace copied, renamed, or re-uploaded data across common work tools.
• Mature insider-risk programmes need posture, movement, and user-behaviour signals together if they want defensible investigations and earlier intervention.

Key terms

• Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
• Data Security Posture Management: Data Security Posture Management, or DSPM, is the continuous discovery and monitoring of where sensitive data lives, how it is exposed, and where policy gaps exist. Its value rises when it feeds remediation rather than generating findings alone, especially in environments where AI expands the number of data paths.
• Insider Risk Management: Insider Risk Management is the practice of detecting, investigating, and reducing harm caused by legitimate identities misusing access. It covers human error, malicious insiders, compromised accounts, and increasingly AI-driven actors that can move sensitive data without breaking perimeter controls.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.