Notifications
Clear all
Topic starter
11/07/2026 8:33 pm
TL;DR: Integrating DSPM into CNAPP closes a critical data visibility gap by unifying protection, compliance assurance, and attack-surface visibility, according to SentinelOne. Related research notes AI-specific secrets grew by roughly 140% year over year and verified exploit paths now link exposed keys to critical workloads, making data-centric control the practical centre of cloud defence, not a bolt-on.
NHIMG editorial — based on content published by SentinelOne: 451 Research Report, Completing CNAPP with DSPM
By the numbers:
- AI-specific secrets grew by roughly 140% year over year, turning shadow AI into a primary cloud exposure point.
Questions worth separating out
Q: What breaks when CNAPP is deployed without DSPM?
A: CNAPP without DSPM can show misconfigurations and workload risk, but it leaves security teams blind to where sensitive data and usable credentials actually sit.
Q: Why do AI-specific secrets create new governance risk in cloud environments?
A: AI-specific secrets behave like non-human identities because they authenticate software, not people, yet they are often managed as ordinary configuration.
Q: How do security teams know if exploit path analysis is working?
A: Exploit path analysis is working when teams can identify which exposed secrets or vulnerabilities actually lead to production access, then remove those paths first.
Practitioner guidance
- Map sensitive data to reachable identities Correlate DSPM findings with IAM, service account, and workload inventories so every sensitive dataset is tied to the identities that can touch it.
- Treat AI API keys as governed identities Assign explicit owners, rotation intervals, and revocation paths for AI-specific secrets used by tools, agents, and automation.
- Prioritise exploit paths over generic findings Rank remediation by whether an exposed secret or unpatched system reaches production workloads, not by severity labels alone.
What's in the full report
SentinelOne's full report covers the operational detail this post intentionally leaves for the source:
- How CNAPP and DSPM are combined in practice to close data visibility gaps across cloud environments
- The verified exploit path approach used to connect exposed AI keys, cloud secrets, and unpatched vulnerabilities
- The report's deeper treatment of shadow AI as a cloud exposure source and how it changes remediation priority
- The specific data visibility and compliance assurance angles practitioners can use in implementation planning
👉 Read SentinelOne's report on completing CNAPP with DSPM →
CNAPP and DSPM: what changes for cloud security teams?
Explore further
11/07/2026 9:02 pm
DSPM is the missing data plane in modern cloud governance. CNAPP can expose misconfigurations and workload risk, but that is not the same as knowing where sensitive data, secrets, and AI credentials actually live. Without DSPM, security teams are governing infrastructure visibility while attackers are targeting the data path. The practical conclusion is straightforward: cloud control must follow the asset that creates the breach potential, not just the asset that hosts it.
A question worth separating out:
Q: How should organisations govern shadow AI access to cloud data?
A: Organisations should classify shadow AI tools as access-bearing systems and require the same lifecycle controls used for other non-human identities. That means explicit ownership, approved secret storage, periodic rotation, and revocation when a tool is no longer in use. If the access path is unmanaged, the data exposure is unmanaged too.
👉 Read our full editorial: Completing CNAPP with DSPM closes the cloud data visibility gap
