Topic starter
07/06/2026 7:59 pm
TL;DR: Rapid AI growth and data sprawl are making it harder to locate and protect sensitive information across environments, according to Cyera, with Gartner’s 2025 Market Guide for DSPM framing discovery, classification, and cataloguing as the core response. The real governance test is whether visibility findings can be turned into durable protection, not just more inventory.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “2025 Gartner® Market Guide for Data Security Posture Management”.
Key questions
Q: How should security teams use DSPM findings in IAM governance?
A: Use DSPM findings to identify which identities can reach sensitive data, then feed that information into access reviews, entitlement cleanup, and owner assignment.
Q: Why do AI data environments make visibility gaps harder to manage?
A: AI increases the number of places data can be copied, transformed, and consumed, so static inventories become outdated quickly.
Q: What breaks when data discovery tools only label sensitive data and do not remediate it?
A: When tools only label data, security teams often end up with a larger list of findings and no practical reduction in exposure.
Practitioner guidance
- Map sensitive data discovery to ownership Assign named data owners to high-risk repositories and ensure every classified dataset has an accountable decision-maker for access and remediation.
- Link DSPM findings to access reviews Use exposure findings to drive entitlement review for users, service accounts, and automated workflows that can reach sensitive data.
- Prioritise unstructured data first Focus first on unstructured stores, shared repositories, and collaboration platforms where sensitive content is hardest to inventory and easiest to overshare.
Bottom line: AI-era data sprawl makes visibility a prerequisite for control, not a reporting exercise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
07/06/2026 9:45 pm
AI-era data sprawl has turned visibility into a governance prerequisite, not a reporting feature. When sensitive information is distributed across cloud, SaaS, and AI-enabled workflows, security teams cannot rely on static inventories or periodic reviews. The category exists because discovery has become a control dependency for every downstream decision about access, exposure, and retention. The practitioner takeaway is that DSPM should be evaluated as part of the governance stack, not as a standalone data catalog.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Business leaders plan to spend $124 million on average on AI in 2026, and 91% say data security and risk will shape their AI strategy.
A question worth separating out:
Q: How can teams tell whether DSPM is actually improving security?
A: Teams should look for fewer unknown sensitive-data locations, faster classification of new repositories, and a tighter link between exposure findings and entitlement changes. If discovery is improving but no access decisions change, DSPM is producing visibility without governance impact.
👉 Read our full editorial: Data security posture management for AI-era visibility gaps
This post was modified 3 days ago by NHI Mgmt Group