Notifications
Clear all
Topic starter
18/08/2026 2:25 pm
TL;DR: Cloud sprawl, shadow data, and AI adoption have pushed Data Security Posture Management from optional tooling to a baseline control, while siloed tools now create measurable exposure and coordination gaps, according to Securiti’s analysis of the 2026 GigaOm DSPM Radar. For identity and data security teams, the real issue is not discovery alone but governing who and what can reach sensitive data across human, workload, and AI paths.
NHIMG editorial — based on content published by Securiti: DSPM in 2026: Why It Matters More Than Ever
By the numbers:
- The 2026 GigaOm DSPM Radar evaluated 25 vendors across technical capabilities, emerging features, and business criteria.
- Data breaches involving multiple environments cost an average of $5.05 million.
Questions worth separating out
Q: How should security teams govern sensitive data used by AI systems?
A: Security teams should treat AI as a data consumer that needs policy boundaries, not just authentication.
Q: Why do shadow data repositories create so much security risk?
A: Shadow repositories create risk because they are often outside ownership, review, and access governance.
Q: What breaks when data security tools are split across cloud and SaaS environments?
A: When tools are split, security teams lose a connected view of data sensitivity, identity access, and policy enforcement.
Practitioner guidance
- Map abandoned data stores to accountable owners Inventory cloud, SaaS, and on-premises repositories that were created for short-term projects, then assign ownership, classification, and review cadence before they age into shadow data.
- Treat AI data access as a governed entitlement path Review the service connections, retrieval layers, and agent permissions that allow copilots or AI workflows to reach sensitive data.
- Build relationship-based breach impact analysis Connect data, identities, policies, and systems into a single context model so analysts can see which identities reached which repositories and through what path.
What's in the full article
Securiti's full post covers the operational detail this analysis intentionally leaves for the source:
- Vendor-specific explanation of the Data Command Graph and how it is used to correlate data, identities, policies, and AI systems.
- Evaluation context from the 2026 GigaOm DSPM Radar, including the criteria behind the platform and innovation placement.
- Product-level discussion of AI tuning, AI asset discovery, and undo capabilities for restoring files after AI-related mistakes.
- Examples of how the vendor positions consolidated governance across privacy, compliance, and AI security workflows.
👉 Read Securiti's analysis of why DSPM matters more than ever in 2026 →
Shadow data and AI risk are reshaping DSPM governance?
Explore further
18/08/2026 3:15 pm
Shadow data is now an access-control problem, not just a discovery problem. Once abandoned repositories fall outside ownership and review, they become unmanaged entitlement surfaces. DSPM only matters when it links inventory to who can actually reach the data, which is why identity context must sit beside data discovery. Practitioners should treat orphaned repositories as governance defects, not storage hygiene issues.
A question worth separating out:
Q: How do organisations know whether DSPM is actually improving control?
A: They should look for fewer unmanaged repositories, faster classification of newly created stores, and better linkage between sensitive data and the identities that can access it. If analysts can answer who, what, and where without manual correlation across multiple tools, the control is working. If not, visibility is still fragmented.
👉 Read our full editorial: DSPM in 2026: Why shadow data and AI raise the stakes
