Unified data security is exposing the DSPM and DLP gap

At a glance

What this is: Cyberhaven argues that unified data security is really a cohesion problem, where DSPM visibility and DLP enforcement remain disconnected across data states and environments.

Why it matters: For IAM, NHI, and broader security teams, the issue is that data controls lose effectiveness when access, movement, and policy execution are split across tools and workflows.

By the numbers:

• 62% of organisations are experimenting with AI agents, while 82% of the top 100 most-used GenAI SaaS applications are medium, high, or critical risk.
• 40% of data breaches involve data spread across multiple environments, including public clouds, private clouds, and on-premises infrastructure.
• By 2026, over 20% of businesses will prioritize DSPM technologies to discover and secure their known and unknown data repositories.

Context

Data security fails when visibility and enforcement sit in separate tools and separate operating motions. Discovery platforms can identify sensitive data, but they do not themselves stop movement or misuse, while DLP can block or warn without enough context to make those decisions precise.

That gap becomes more serious as data moves across endpoints, cloud services, SaaS, collaboration tools, and AI platforms. In identity terms, the problem is not only where data lives, but which users, service accounts, or automated workflows can move it and under what conditions.

Key questions

Q: What breaks when DSPM and DLP are not connected in practice?

A: When DSPM and DLP are not connected, teams get a visibility-only view of sensitive data and a separate enforcement layer that cannot act with enough context. The result is delayed containment, inconsistent policy decisions, and a control gap when data moves across cloud, endpoint, SaaS, or AI environments before response can occur.

Q: Why does data movement across environments make unified controls more important?

A: Because every hop strips away some context. A file that looks benign in one system may become risky once it is emailed, downloaded to a personal device, or copied into another platform. Unified controls matter when movement speed and environment changes outpace manual review and disconnected policy engines.

Q: What are the signs that data security workflows are too fragmented?

A: Common signs include risk dashboards that do not trigger action, policies that behave differently across endpoints and SaaS, and analysts who can identify exposure but cannot stop the transfer in time. If the team can see the issue but the workflow cannot intervene, the control stack is fragmented.

Q: How should organisations govern access to data used by AI systems?

A: Treat AI data access as an identity governance problem, not just a data storage problem. Define who or what can use each dataset, what purpose is allowed, and what runtime restrictions apply. Then review humans, service accounts, and AI agents separately so entitlement scope matches actual behaviour rather than a generic AI policy.

Technical breakdown

Why DSPM visibility and DLP enforcement drift apart

DSPM and DLP solve different parts of the same control problem. DSPM is designed to discover, classify, and assess sensitive data at rest, while DLP is designed to inspect and control data in motion. When these functions are bolted together, policy decisions lose context because the system that sees the asset often is not the system that can stop the transfer. That creates workflow latency, inconsistent policy interpretation, and weak feedback loops between risk discovery and response.

Practical implication: Security teams need a control model that connects discovery to enforcement at the point of movement, not after a dashboard review.

Why data lineage matters for access and movement decisions

Data lineage tracks where a file was created, how it moved, who touched it, and where it ended up. That context is essential because a download, share, or copy can be normal work in one path and risky exfiltration in another. Without lineage, policy engines see isolated events instead of a data journey, which makes enforcement blunt or overly permissive. Lineage is especially valuable when data crosses cloud, endpoint, SaaS, and unmanaged device boundaries.

Practical implication: Practical control depends on preserving lineage so enforcement decisions can reflect the file’s history, not just its current location.

How unified platforms change control of data at rest and in motion

Unified data security combines discovery, classification, and enforcement into one operating model. That matters because data at rest and data in motion are not separate risk domains, they are different phases of the same object. At rest, the issue may be misclassification, over-permissioning, or misplaced storage. In motion, the issue is sharing, emailing, or transferring data into less trusted environments. A unified model lets one policy logic span both states and reduces the gap between insight and action.

Practical implication: Teams should align policy design around data state transitions so the same rules can follow data as it moves across environments.

Threat narrative

Attacker objective: The objective is to move sensitive data out of governed contexts before unified detection and enforcement can intervene.

1. Entry occurs when sensitive data is discovered in one environment but later moves into another environment faster than the control stack can correlate the event.
2. Credential or workflow abuse follows when a user, service path, or approved sharing action moves data out of the monitored context without immediate enforcement.
3. Impact is delayed detection or accidental exposure, because security teams see the risk only after the data has already crossed endpoint, cloud, SaaS, or AI boundaries.

Breaches seen in the wild

• Cyberhaven Chrome extension breach 2024: A phished OAuth consent gave attackers Chrome Web Store publishing rights and a malicious Cyberhaven extension update reached about 400,000 users.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cohesion, not coverage, is the real data security failure: most enterprises do not lack tools, they lack a control plane that makes discovery and enforcement behave like one system. DSPM tells teams what exists, while DLP tries to stop movement, but separated telemetry and policy execution create a governance gap. The practical conclusion is that data security programmes should be assessed on operational cohesion, not tool count.

Data lineage is becoming a governance primitive: once files move through cloud, endpoint, SaaS, and AI workflows, static classification is no longer enough to explain risk. A file’s history now matters as much as its label, because movement context determines whether a transfer is routine collaboration or exposure. Teams should treat lineage as the connective tissue between policy intent and enforcement reality.

Unified data security is increasingly an identity problem as well as a data problem: the decisive question is which human users, service accounts, and automated workflows are allowed to move sensitive data across trust boundaries. That brings access scope, delegated permissions, and workflow authorisation into the data security conversation. Practitioners should govern data movement with the same discipline they apply to privileged access.

AI adoption is amplifying the DSPM and DLP gap: when 62% of organisations are experimenting with AI agents and 82% of the top 100 most-used GenAI SaaS applications are medium, high, or critical risk, the old separation between insight and enforcement becomes harder to defend. The named concept here is insight-action latency, the delay between discovering data risk and being able to stop it. Security teams should measure whether controls can act in the same workflow that reveals the risk.

Data perimeter collapse makes point solutions brittle: once data lives across personal and corporate devices, SaaS, cloud, and AI platforms, no single control point sees enough context on its own. That does not mean every tool fails, it means the operating model fails when tools are stitched together without shared policy logic. Practitioners should redesign governance around data mobility, not around the limits of any single product.

From our research library:

• 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
• Business leaders plan to spend $124 million on average on AI in 2026, and 91% say data security and risk will shape their AI strategy.
• Read next: AI Infrastructure Workload Identity Guide

What this signals

Insight-action latency: the next data security failure mode is not missing visibility, it is the delay between seeing a risk and turning that signal into enforcement. That is why programmes built around separate discovery and blocking tools increasingly struggle as data moves faster than manual workflow handoffs. The control objective is to compress the gap between classification and action.

The identity angle is now unavoidable because data movement is increasingly driven by users, service accounts, and AI workflows rather than by static storage locations alone. Security teams should design governance so that the same policy can follow data across cloud, endpoint, SaaS, and AI contexts without relying on manual reconciliation.

For practitioners

• Map data state transitions end to end Inventory where sensitive data is created, classified, shared, stored, and moved so policy can follow the data across environments.
• Unify detection and enforcement workflows Make sure discovery findings can trigger response actions in the same operating path, rather than waiting for separate review and manual handoff.
• Use lineage to drive policy decisions Base transfer controls on a file’s movement history, destination, and previous access path, not only on its current classification label.
• Govern AI data movement as a separate trust boundary Treat AI platforms, copilots, and agent workflows as distinct paths for sensitive data movement and apply the same controls you expect for other unmanaged egress routes.
• Reassess endpoint-to-cloud policy consistency Check whether the same sensitive file is handled differently when it moves from endpoint to SaaS to cloud storage, and close the gaps where policy changes by channel.

Key takeaways

• The central problem is not the absence of DSPM or DLP, but the operational gap created when discovery and enforcement are split across tools and teams.
• As data moves across cloud, endpoint, SaaS, and AI platforms, lineage and workflow context become necessary for reliable policy decisions.
• Security programmes should measure whether they can act on a data risk in the same workflow that discovers it, or whether they still depend on delayed human handoffs.

Key terms

• Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
• DSPM: Data Security Posture Management is the discipline of finding, classifying, and protecting sensitive data across storage systems and workflows. In AI environments, DSPM helps teams understand what data exists, where it lives, and whether AI systems can access it appropriately.
• DLP Monitoring: DLP monitoring is the continuous observation of how sensitive data is stored, moved, and used. It combines content awareness with policy enforcement so organisations can spot unauthorised sharing, risky transfers, and abnormal access before data leaves approved boundaries.
• Data Perimeter: A data perimeter is the boundary that determines where sensitive information may flow, be stored, or be processed. With AI tools, the perimeter matters because prompts, uploads, logs, and outputs can move information into systems outside normal enterprise control, even when the access itself is legitimate.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for practitioners building governed access models. It is a practical fit for teams that need to connect identity controls to broader security programmes.