Topic starter
18/08/2026 2:25 pm
TL;DR: Cloud sprawl, shadow data, and AI adoption have pushed Data Security Posture Management from optional tooling to a baseline control, while siloed tools now create measurable exposure and coordination gaps, according to Securiti’s analysis of the 2026 GigaOm DSPM Radar. For identity and data security teams, the real issue is not discovery alone but governing who and what can reach sensitive data across human, workload, and AI paths.
Editorial analysis by NHI Mgmt Group, based on content published by Securiti: “DSPM in 2026: Why It Matters More Than Ever”.
By the numbers:
- The 2026 GigaOm DSPM Radar evaluated 25 vendors across technical capabilities, emerging features, and business criteria.
- Data breaches involving multiple environments cost an average $5.05 million.
Key questions
Q: How should teams govern shadow data that appears outside formal ownership?
A: Treat shadow data as an access governance problem, not only an inventory problem.
Q: Why does AI adoption increase the risk created by fragmented data controls?
A: AI systems compress the time between data discovery, movement, and reuse, so fragmented controls fail faster.
Q: How should security teams implement DSPM across multi-cloud and SaaS environments?
A: Start with API-based discovery across the platforms that hold regulated or business-critical data, then layer classification, access context, and monitoring on top.
Practitioner guidance
- Expand discovery to shadow repositories Map cloud, SaaS, and on-premises locations that can be provisioned on demand, then verify which ones lack an owner, retention rule, or active classification.
- Tie AI ingestion to explicit access scopes Require approved datasets, policy checks, and monitored access paths before data can be consumed by copilots, internal models, or AI agents.
- Unify lineage and policy context Use a single governance view to connect data location, ownership, permissions, and downstream AI usage so fragmented tooling does not hide toxic combinations.
Bottom line: Shadow data, AI pipelines, and siloed tooling now create governance gaps that discovery alone cannot close.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:15 pm
Shadow data is now an identity governance problem as much as a storage problem. Once repositories can be created on demand and then forgotten, the control failure is not only incomplete discovery. It is the absence of a reliable ownership and access model for data that outlives the project that created it. Practitioners need to treat abandoned repositories as ungoverned access surfaces, not just stale assets.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: Adoption drops quickly. Teams treat the tool as shelfware because it adds friction without fitting into daily operations. The article’s message is that security findings must flow into existing systems such as IAM, GRC, DLP, and service workflows. When integration is missing, security loses both momentum and accountability.
👉 Read our full editorial: DSPM in 2026: Why shadow data and AI raise the stakes