Notifications
Clear all
Topic starter
24/06/2026 9:04 pm
TL;DR: Data Security Posture Management is gaining traction because it finds sensitive data, maps who can reach it, and surfaces shadow data across hybrid environments, according to Netwrix and Gartner. The real governance issue is not visibility alone, but whether identity, access, and compliance controls can keep pace with data sprawl and over-permissioning.
NHIMG editorial — based on content published by Netwrix: Insights on DSPM: Key Trends and Recommendations
By the numbers:
- Only 20% of organizations are expected to deploy DSPM technology by 2026.
- 72% of organizations have experienced or suspect they have experienced a breach of non-human identities.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems.
Questions worth separating out
Q: How should security teams use DSPM to improve least privilege in hybrid cloud environments?
A: Start by correlating discovered sensitive data with the identities, roles, and service accounts that can reach it.
Q: Why do shadow data and unmanaged repositories create governance risk?
A: Shadow data bypasses normal ownership, classification, and review processes, so nobody can confidently say who should access it or whether that access is still appropriate.
Q: How do organizations know if DSPM is actually reducing risk?
A: Look for fewer unknown repositories, fewer excessive entitlements on sensitive datasets, and shorter remediation time from discovery to access correction.
Practitioner guidance
- Map sensitive data to entitlement owners Build a repeatable inventory that links each high-value dataset to a business owner, system owner, and identity owner so access decisions have accountable reviewers.
- Prioritise shadow data remediation first Use discovery results to find unmanaged repositories such as personal drives, email attachments, and ad hoc SaaS exports, then move the highest-risk holdings into governed storage.
- Tie access reviews to data sensitivity Base recertification on the sensitivity and exposure of the data itself, not just the group or role that grants access.
What's in the full article
Netwrix's full blog covers the operational detail this post intentionally leaves for the source:
- Practical DSPM deployment guidance for discovering sensitive data across cloud, SaaS, and on-prem environments.
- Examples of how the vendor positions DSPM alongside IAM, SIEM, SOAR, and DLP in an existing stack.
- Recommended evaluation criteria for scalability, automation, and compliance reporting in enterprise use.
- The vendor's detailed explanation of how its DSPM features map to visibility, context, and remediation workflows.
👉 Read Netwrix's analysis of DSPM trends and implementation considerations →
DSPM and shadow data: what IAM teams need to fix next?
Explore further
25/06/2026 6:03 am
DSPM is becoming the missing inventory layer between data sprawl and access governance. The article is right to treat shadow data as more than an inconvenience, because data scattered across cloud drives, SaaS, and unmanaged stores cannot be governed by infrastructure controls alone. The practical consequence is that identity teams need data visibility before they can claim meaningful least privilege.
A few things that frame the scale:
- 72% of organizations have experienced or suspect they have experienced a breach of non-human identities, according to the 2024 ESG Report: Managing Non-Human Identities.
- A compromised NHI is rarely a one-off event, with enterprises that experienced one averaging 2.7 separate incidents in the past 12 months.
A question worth separating out:
Q: When should DSPM be prioritized over broader cloud security controls?
A: Prioritise DSPM when the main risk is not infrastructure compromise but untracked sensitive data exposure across multiple systems. If you can secure the platform and still not answer where the sensitive data lives or who can reach it, DSPM should move up the roadmap.
👉 Read our full editorial: DSPM exposes the data governance gap in hybrid cloud estates
