Normalyze is a data security company that helps enterprises find their sensitive data, see who and what can reach it, and fix the riskiest exposures first. Its Data Security Posture Management (DSPM) platform covers data held in cloud, SaaS, PaaS, on-premises and hybrid environments, and it scans without installing agents.
The platform is aimed at security and data teams that have lost track of where regulated or valuable data sits as it spreads across cloud accounts, collaboration tools and databases. It helps them see which of those stores carry real risk.
At A Glance
| Vendor | Normalyze |
|---|---|
| Category | Data security posture management (DSPM) |
| Identities covered | Access paths to sensitive data, IAM roles and policies, user activity |
| Deployment | Agentless scanning functions that run inside the customer’s cloud environment |
| Customers | Grant Thornton, Albertsons, ChargePoint, Snowflake, Informatica |
| Certifications | SOC 2 Type II |
| Ownership | Acquisition by Proofpoint announced October 2024 |
| Market classification | Data Security |
What Normalyze Does
Data rarely stays in one place. It moves into object storage, data warehouses, SaaS file shares and, increasingly, into prompts sent to large language models. Normalyze tackles this by discovering and classifying data continuously, then linking each sensitive data store to the identities, roles and attack paths that lead to it. That combination lets a team decide which exposure matters most, rather than working through a flat list of findings. Compliance reporting draws on the same inventory, so audits and risk work use one picture of the data estate.
Products
Normalyze DSPM Platform
The core platform handles discovery, classification, access analysis and risk prioritisation in one place. Security teams use it to answer three questions: what sensitive data do we have, who can get to it, and what should we fix first. Its main components are:
| One-Pass Scanner | Discovers and classifies data in a single pass, scaling to about 1TB per hour |
|---|---|
| Data Classification | Ready-made and custom classifiers, continuous classification and OCR for scanned documents and images |
| Data Access Graphs | Visualise access and trust relationships, showing IAM roles and policies in real time |
| Data Risk Navigator | Maps the attack paths that could end in a breach or data loss |
| Signature Builder | Lets analysts review and tune the signatures behind detections |
| Anomaly Detection | Baselines user activity to spot possible exfiltration or account takeover |
| LLM security API | Analyses data flowing into and out of large language models |
| DataValuator | Assigns a monetary value to data so teams can see which stores carry the highest potential loss |
DSPM For Snowflake
Organisations that hold much of their analytics data in Snowflake get a dedicated module. It applies discovery, access graphs and anomaly alerts to Snowflake specifically, so data owners can see which accounts reach sensitive tables and be warned when usage looks unusual.
How It Works
The architecture is fully agentless, and there is nothing for the customer to deploy or manage on endpoints or servers.
| Component | What it does |
|---|---|
| In-environment scanning | Normalyze places scanning functions inside the customer’s own cloud environment, where they discover data, access and permissions. Data is not copied outside that environment. |
| Classification engine | Discovery and classification rely on machine learning, which adapts based on user feedback and actions over time. |
| Remediation | Each risk comes with suggested remediation steps, and the remediation validator checks that a fix has actually taken effect. |
| APIs and automation | Outbound webhooks push findings into ticketing, notification and automation platforms, open APIs bring third-party data into the graph, and everything visible in the interface is also available through the API. |
Identities And Systems Covered
| Access paths | Every route to sensitive data, including IAM roles and policies |
|---|---|
| User activity | Behaviour baselines used to flag exfiltration or account takeover |
| IaaS and PaaS | AWS, GCP, Azure, Snowflake, Databricks |
| SaaS | Google Drive, Microsoft 365, Teams, Dropbox, Slack, Salesforce, ServiceNow |
| On-premises | Redis, Microsoft SQL Server, MongoDB, MySQL, Oracle and file shares |
| LLM data flows | Microsoft Copilot, ChatGPT, Google DeepMind and Hyperwrite |
Company Background
| Founders | Ravi Ithal, cofounder and Chief Technology Officer |
|---|---|
| Funding | Lightspeed led the seed round and committed to invest again in the Series A |
| Acquisition | Proofpoint signed a definitive agreement to acquire Normalyze on 29 October 2024, with the technology to be integrated into Proofpoint’s human-centric security platform |
Note: This overview is compiled from Normalyze’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.