Topic starter
07/06/2026 8:48 pm
TL;DR: Gartner’s 2025 Market Guide for Data Security Posture Management says DSPM helps organizations discover, classify, and catalog sensitive data across environments, with AI data visibility and operationalization emerging as the hardest problems, according to Cyera. The governance gap is no longer just data location, but proving who and what can reach it as AI and non-human access expand.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “2025 Gartner® Market Guide for Data Security Posture Management”.
Key questions
Q: What breaks when DSPM finds sensitive AI data but identity context is missing?
A: You can catalogue the data without being able to govern who can reach it.
Q: Why does AI adoption create an identity governance problem?
A: AI adoption creates an identity governance problem because the system that accesses data is often only loosely visible to IAM.
Q: How do organizations know if DSPM is actually reducing data exposure?
A: They should measure whether high-risk datasets are becoming less accessible, whether misclassified data is being corrected faster and whether repeat violations are declining.
Practitioner guidance
- Link DSPM outputs to identity inventories Correlate sensitive-data findings with service accounts, workload identities, tokens, and application permissions so exposure can be traced to real access paths.
- Prioritise AI-facing datasets for entitlement review Start with repositories used in retrieval, training, analytics, and automation workflows, then verify which non-human identities can reach them.
- Constrain overbroad non-human access paths Reduce the number of identities that can reach sensitive AI data by tightening scopes, separating environments, and removing unused credentials.
Bottom line: AI data governance now depends on both data discovery and identity visibility, because access paths are increasingly defined by non-human actors.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
08/06/2026 8:30 am
DSPM has crossed from data discovery into identity governance. The market guide framing matters because AI data exposure is determined less by where data resides than by which identities can touch it. That makes service accounts, workloads, API keys, and automation paths part of the governance model, not just the data model. Practitioners should treat data visibility and identity visibility as one control problem.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own accountability for AI data access risk?
A: Accountability should sit with the teams that own identity, data governance, and security operations together. If AI can access enterprise data, then ownership must cover entitlement design, monitoring, and incident response across the full workflow. The governance gap is not just technical, because without a named owner, no one can prove who approved or contained the access.
👉 Read our full editorial: DSPM visibility for AI data is now an identity governance issue
This post was modified 3 days ago by NHI Mgmt Group