Topic starter
02/08/2026 11:40 am
TL;DR: Multi-cloud DSPM is designed to find and classify sensitive data across AWS, Azure, GCP, SaaS, and warehouses, because traditional tools lose track once data moves between environments, according to Cyberhaven. The real governance issue is not cloud sprawl itself, but whether teams can maintain consistent classification, access control, and lineage across every place data lands.
Editorial analysis by NHI Mgmt Group, based on content published by Cyberhaven: “How to Deploy DSPM Across Multiple Cloud Environments”.
By the numbers:
- The average enterprise operates over 3,000 misconfigured cloud assets across environments at any given time.
Key questions
Q: What breaks when DSPM only covers one cloud?
A: A single-cloud deployment creates blind spots as soon as data moves to another provider, warehouse, or SaaS platform.
Q: Why do overpermissioned service accounts increase data exposure in multi-cloud environments?
A: Service accounts often retain access across copies, pipelines and backups even when the data moves into a new risk domain.
Q: What are the signs that data governance is failing in a mixed cloud and legacy environment?
A: Common warning signs include unknown data locations, inconsistent classification, unclear access ownership, and ad hoc retention decisions.
Practitioner guidance
- Establish discovery-first multi-cloud coverage Connect cloud environments in read mode first, inventory where sensitive data actually lives, and delay enforcement until the dataset is understood.
- Normalise classification across providers Use one classification scheme for AWS, Azure, GCP, data warehouses and SaaS so the same data type receives the same governance treatment wherever it lands.
- Track lineage across data movement Trace copies, transformations and replications so security teams can see how production data becomes development data or SaaS-resident data.
Bottom line: Multi-cloud DSPM addresses a governance gap created when sensitive data moves faster than traditional cloud security tools can track.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:52 pm
Multi-cloud data security is now an identity governance problem as much as a storage problem. Once data copies into multiple clouds, the decisive control question becomes which identities, service accounts and shared workflows can still reach it. Classification without entitlement governance leaves organisations with labels but no enforcement path, so data security posture becomes a paper exercise rather than an operational control.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should teams prioritise first in multi-cloud DSPM programmes?
A: Start with datasets that have broad inherited permissions, shared access paths, or machine-to-machine integrations, because those usually create the largest exposure window. Then connect those findings to the identity owners who can actually remove the access or change the workflow.
👉 Read our full editorial: Multi-cloud DSPM exposes the governance gap in data security