Notifications
Clear all
Topic starter
14/08/2026 6:36 pm
TL;DR: DSPM-first programmes delay enforcement for 6 to 12 months while data in motion keeps moving through email, endpoints, SaaS apps, and personal cloud accounts, according to Orion. Static labels and pattern-matching DLP can miss contextual exfiltration, which is why the sequencing question has become a risk-reduction question, not a tooling preference.
NHIMG editorial — based on content published by Orion: why the DSPM-first model no longer reduces risk fastest
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
Questions worth separating out
Q: How should security teams reduce data exfiltration risk before a full DSPM programme is complete?
A: They should start with controls that inspect and block data in motion, because the highest-risk leakage often happens through email, endpoints, SaaS applications, and personal cloud accounts before a catalogue is finished.
Q: Why do static data labels fail to stop many exfiltration events?
A: Static labels describe what data was when it was scanned, not whether a transfer is risky right now.
Q: What do teams get wrong about the DSPM and DLP sequence?
A: They often assume data must be fully classified before DLP is useful.
Practitioner guidance
- Deploy enforcement on data movement first Prioritise controls that can inspect and block transfers through email, endpoints, SaaS apps, and personal cloud destinations before the full data catalogue is complete.
- Connect DLP decisions to identity context Use the sender identity, device trust, destination, and application context to decide whether a transfer is legitimate in the moment, rather than relying only on content labels.
- Shorten the path from detection to blocking Measure how long it takes for a risky transfer to move from alerting to active enforcement, because months of policy tuning create the exact exposure window the article warns about.
What's in the full article
Orion's full article covers the operational detail this post intentionally leaves for the source:
- How the vendor's context-aware DLP model classifies unstructured content at the point of movement across endpoints, email, and SaaS.
- Examples of the detection logic used to distinguish legitimate sharing from risky transfer without a prior DSPM scan.
- Integration detail showing how the vendor absorbs classifications from Microsoft Purview and Sentra.
- The vendor's explanation of how quickly organisations can move from monitoring to blocking in its deployment model.
👉 Read Orion's analysis of why data in motion should come before DSPM →
Data in motion first: is your DLP strategy keeping up?
Explore further
14/08/2026 6:43 pm
Static classification is no longer a sufficient control model for data loss prevention. The article correctly challenges the idea that inventory must come before enforcement. In modern environments, data moves faster than catalogues can be built, and the security value lies in understanding movement context, not just file state. That does not make DSPM obsolete, but it does make DSPM-only sequencing a governance delay rather than a protection strategy. Practitioners should treat enforcement as the first security objective.
A question worth separating out:
Q: How do you know if context-aware DLP is working?
A: It should reduce time to enforcement, distinguish legitimate business transfers from risky ones, and produce fewer false positives on routine collaboration. If the programme still depends on long cataloguing cycles before it can act, it is not yet operating as a real control.
👉 Read our full editorial: Data in motion is overtaking dspm-first security models
