Topic starter
24/06/2026 9:04 pm
TL;DR: Data Security Posture Management is gaining traction because it finds sensitive data, maps who can reach it, and surfaces shadow data across hybrid environments, according to Netwrix and Gartner. The real governance issue is not visibility alone, but whether identity, access, and compliance controls can keep pace with data sprawl and over-permissioning.
Editorial analysis by NHI Mgmt Group, based on content published by Netwrix: “Insights on DSPM: Key Trends and Recommendations”.
Key questions
A: Without unified controls, organisations lose visibility into where sensitive data lives, who can access it, and how it is reused.
Q: Why does over-permissioning make shadow data harder to control?
A: Over-permissioning turns hidden data into reachable data by giving too many identities access to records that should be tightly scoped.
Q: How do you know if code-based DSPM is actually improving governance?
A: Look for fewer recurring exposure patterns, faster remediation of the exact code path, and a measurable reduction in sensitive data copied into logs, queues, and AI prompts.
Practitioner guidance
- Define sensitive-data classes first Establish consistent criteria for what counts as sensitive data, then apply those criteria across cloud, SaaS, and on-prem repositories so discovery output is comparable.
- Map data access to identities and entitlements Join data-location findings to IAM and NHI entitlement data so you can see which users, service accounts, and applications can reach high-value records.
- Prioritise overexposed repositories Rank repositories by sensitivity, reachability, and observed access patterns, then target the datasets with the largest entitlement footprint first.
Bottom line: Shadow data is the hidden governance problem in hybrid estates because unmanaged copies of sensitive information fall outside normal oversight and ownership.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:03 am
Shadow data is a governance failure, not just a discovery problem. The core issue in hybrid estates is that sensitive data can exist outside the control model that was supposed to govern it. Once data lives in unmanaged repositories, the organisation loses reliable ownership, access justification, and lifecycle oversight. The practitioner conclusion is simple: data governance must extend to every place data can be copied, shared, or forgotten.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do teams decide whether to prioritise DLP or DSPM first?
A: Teams should start with DLP when the immediate risk is data leaving the environment through collaboration, email, browser, or AI channels. They should start with DSPM when they need to understand where sensitive data resides and who can reach it. Mature programmes usually need both, because visibility and enforcement answer different questions.
👉 Read our full editorial: DSPM exposes the data governance gap in hybrid cloud estates