Topic starter
02/08/2026 11:44 am
TL;DR: Shadow data, audit friction, and AI exposure are where DSPM creates value, according to Cyberhaven. Data governance only improves when findings change access and movement decisions, not when they merely add inventory.
Editorial analysis by NHI Mgmt Group, based on content published by Cyberhaven: “The ROI of DSPM: What CISOs Need to Know”.
Key questions
Q: When should organisations prioritise DSPM over expanding DLP rules?
A: Prioritise DSPM when you cannot answer basic exposure questions, such as where sensitive data is stored, who can reach it, and whether that access is intentional.
Q: What are the signs that data and AI governance is not working as intended?
A: Common warning signs include poor data classification coverage, unidentified cookies or trackers, duplicate files that remain unaddressed, and difficulty mapping AI system components and dependencies.
Q: What breaks when DSPM stops at discovery?
A: When DSPM stops at discovery, the organisation knows more about where sensitive data lives but still cannot prove that access is appropriate.
Practitioner guidance
- Tie DSPM findings to policy enforcement Route high-risk classifications into blocking, quarantine, or approval workflows so discovery changes data movement, not just reporting.
- Review AI data paths as part of governance Map where employees upload sensitive data to AI tools, collaboration apps, and external services, then compare those flows to approved data handling rules.
- Recheck contractor and shared access scope Use DSPM output to identify where third-party users can reach regulated data that exceeds their business need or expected data handling boundary.
Bottom line: DSPM is best understood as a governance control that reduces exposure, not as a reporting tool that simply expands inventory.
Glossary terms: Data Security Posture Management, Shadow Data, Data Lineage, Entitlement review
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 12:55 pm
DSPM ROI is fundamentally a governance question, not a software procurement question. The article is right to frame value in terms of breach reduction, audit effort, and operational capacity, because those are the outcomes boards can price. The deeper point is that discovery only creates value when it changes access decisions, retention decisions, or movement decisions. Practitioners should measure whether DSPM is shrinking exposure paths, not whether it is simply producing more inventory.
A few things that frame the scale:
- Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to the State of Secrets in AppSec.
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should IAM teams use DSPM in access review decisions?
A: Use DSPM to verify whether access rights match the sensitivity of the data, not just the business role attached to the account. If contractors, shared accounts, or service workflows can reach regulated data unnecessarily, the entitlement model is too broad. Access reviews should remove that mismatch before it becomes a data exposure issue.
👉 Read our full editorial: DSPM ROI is really a data governance and AI risk question