Notifications
Clear all
Topic starter
07/06/2026 9:15 pm
TL;DR: SaaS apps now average more than 100 per organisation, and 75% of organisations plan to adopt DSPM in 2025 as data sprawl, oversharing, and compliance blind spots overwhelm perimeter-based security, according to Cyera Research. The real shift is that access control alone no longer answers where sensitive data lives, who can reach it, or how exposure changes across SaaS systems.
NHIMG editorial — based on content published by Cyera: DSPM for SaaS: Why Data Security Posture Management is Essential for Cloud Applications (2025 Guide)
By the numbers:
- SaaS tools now power nearly every part of business, with organizations using more than 100 applications on average.
- 75% of organizations plan to adopt DSPM in 2025 to gain visibility, reduce risk, and close the gaps that traditional approaches leave open.
- The global datasphere is projected to grow more than 50%, from 120 zettabytes in 2023 to 181 zettabytes by 2025.
Questions worth separating out
Q: How should security teams govern sensitive data across SaaS applications?
A: Security teams should govern SaaS data by combining identity controls with continuous discovery and classification.
Q: Why do traditional IAM controls fall short for SaaS data security?
A: Traditional IAM controls focus on authentication and entitlement, but SaaS risk is often about data placement, sharing, and cross-application movement.
Q: What breaks when sensitive SaaS data is not centrally visible?
A: What breaks is the ability to answer basic governance questions with confidence.
Practitioner guidance
- Map SaaS data exposure before expanding access Build an inventory of where sensitive data lives across the core SaaS applications your business relies on, then compare that to who can reach it and how it is shared.
- Tie DSPM findings to identity governance workflows Connect DSPM alerts to IAM and access review processes so excessive permissions, risky sharing, and policy violations can be evaluated alongside ownership and business need.
- Classify by business context, not file type alone Use context-aware rules that distinguish a routine collaboration file from a high-risk record based on application metadata, usage, and sharing path.
What's in the full article
Cyera's full guide covers the operational detail this post intentionally leaves for the source:
- API-level discovery coverage for Salesforce, Microsoft 365, Google Workspace, Slack, and development SaaS
- Context-aware classification examples for structured, semi-structured, and unstructured SaaS data
- Integration detail for connecting DSPM outputs to IAM, DLP, and compliance workflows
- Implementation guidance for handling shadow IT and API rate-limit constraints at scale
👉 Read Cyera's DSPM for SaaS guide on data visibility and cloud risk →
SaaS DSPM and data visibility gaps: what IAM teams need to know?
Explore further
08/06/2026 9:08 am
DSPM for SaaS is really a data visibility control, not just a security add-on. The article makes clear that the governing problem is not whether identities can authenticate to SaaS, but whether security teams can see where sensitive data sits after access is granted. That is a different control objective from perimeter security or entitlement review. For practitioners, the implication is that data governance must be treated as an identity-adjacent control plane, not an afterthought.
A few things that frame the scale:
- 83% of IT and cybersecurity leaders say lack of visibility is their biggest security weakness, according to Ultimate Guide to NHIs , Key Research and Survey Results.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, which shows how quickly governance models can lag runtime behaviour.
A question worth separating out:
Q: How do organisations know if DSPM is actually improving cloud security?
A: They should look for fewer blind spots, lower volumes of exposed sensitive data, faster compliance reporting, and shorter remediation cycles for risky sharing. If DSPM only adds alerts without changing those outcomes, it is not improving governance. The right signal is reduced exposure with less manual effort.
👉 Read our full editorial: DSPM for SaaS exposes the visibility gap in cloud data security
