Why Cybersecurity Giants Are Rushing to Acquire DSPM Startups

Standalone data security posture management providers must expand from cloud visibility to security controls and policy enforcement or risk being overtaken by broad security platforms.

See Also: Cloud Security and the Evolving Role of the Firewall

The rise of DSPM in 2020 and 2021 was driven by enterprises’ need to discover, classify, and assess risk for sensitive data across cloud environments, according to Forrester Principal Analyst Heidi Shey. But the initial wave of DSPM solutions were visibility-driven, not control-driven, meaning they could surface security risks but didn’t directly enforce security policies, Shey said.

By 2023, DSPM had become one of the most rapidly consolidating markets in cybersecurity since clients didn’t want another standalone security tool that lacked enforcement capabilities and needed additional manual integrations, according to Shey. The answer instead lies in either building or buying a unified data security platform where DSPM, data loss prevention and access governance work together, she said.

“The companies that acquired these DSPM vendors already have a control capability, but by acquiring DSPM, it turbocharges what they can do,” Shey told Information Security Media Group. “It gives them more visibility and insight so they can either more accurately apply those controls or do it in a more targeted way. And really being able to say, ‘We can go deeper into cloud environments,’ was a big push.”

Seven DSPM startups have ended up in the hands of broader security or technology vendors since May 2023, with IBM, Rubrik, Palo Alto Networks, CrowdStrike, Tenable, Netskope and Proofpoint all entering this red-hot market. This wave of consolidation has left Cyera as the largest standalone DSPM firm, and the New York-based firm has cashed in by notching a $3 billion valuation, raising $600 million, and buying DLP startup Trail (see: Data Protection Startup Cyera Raises $300M on $3B Valuation).

“Many times, customers are telling us, ‘I had a breach. I have no idea what data was taken, and I’m on a very, very like short clock to be able to answer that. It’s a really, really stressful time,'” Rubrik Chief Product Officer Anneka Gupta told ISMG. “And I don’t know what data was in the account that was taken over the server that was breached. That’s why I think it’s super important in a response.”

Why DSPM Burst Onto the Scene

Before DSPM, Shey said enterprises struggled with untracked sensitive data spread across cloud storage, databases and applications, with cloud security posture management providing security insights at an infrastructure level but lacking deep data classification. The rise of cloud services and SaaS apps made manual data tracking impossible, creating a need for automated data discovery and risk assessment (see: Balancing Employee Privacy and Security for Remote Workers).

“It was one of those things where it was in response to a direct need, a pain, that enterprises had – just visibility,” Shey said. “Because the focus for a lot of these in the early days was all about your cloud environments, understanding what data you have there, what are the risks. So, the whole thing about like data security posture, like, what’s the posture of these environments that you have?”

Unlike CSPM, which Shey said focused on securing workloads, early DSPM solutions focused on data discovery, classification and risk assessment. Organizations realized understanding their data was the foundation for security actions, leading to increased demand for DSPM solutions, said Cyera co-founder and Chief Technology Officer Tamar Bar-Ilan.

“Every CISO we spoke with said that knowing your data is the first step in the journey,” Bar-Ilan told ISMG. “After that, then you’re able to take action. You’re able to understand who has access to the sensitive data and remediate exposures or unencrypted sensitive data, or find sensitive data that’s in production or data that’s in a lower environment, accessible to all your developers.”

DSPM and DLP are deeply interconnected, Bar-Ilan said, with the former improving data classification and risk assessment, thereby making the later more effective by reducing false positives and improving policy enforcement. DSPM is bringing DLP and CSPM close by classifying sensitive data automatically, reducing manual tagging, and improving policy precision so security teams can enforce stricter controls.

“The problem with DLP is not being able to classify sensitive data leaving the organization accurately,” Bar-Ilan said. “Companies with DLP teams aren’t able to build the policies, and the policies are riddled with false positives. So these two challenges are solved when you combine DSPM with DLP, because the data classification is much more accurate and much more contextualized.”

What Makes DSPM Startups Such Appealing Acquisition Targets

Since 2023, large security vendors have bought DSPM startups to obtain better data visibility, which enhances the control capabilities of existing security platforms. As a result, Shey said standalone DSPM solutions face a tough choice: Expand both visibility into access governance, DLP and compliance to differentiate, or get acquired and become a feature within larger security platforms.

“Eventually, DSPM was going to be a capability within something else. And if these standalone startups wanted to really stand alone, they really needed to start expanding their control functionality. And one of the clearest paths to do that, was to do something around data access governance, like control the access first before maybe expanding to have some other data security controls.”

The debate between standalone versus integrated DSPM centers on two key trade-offs, with standalone DSPM seen as more specialized, flexible and tailored for data security teams, while integrated DSPM is easier to deploy and reduces complexity, but lacks deep data security specialization. Integrated security platforms such as Palo Alto Networks and CrowdStrike provide DSPM as part of a broad cybersecurity suite.

“With a single platform, you’re already consolidating many of those different technologies,” Netskope Global Privacy and Data Protection Officer Neil Thacker told ISMG. “So, there’s a huge advantage in terms of the operational efficiency aspect of that. As a security practitioner, as a data protection professional, I’ve always looked to simplify where possible.”

Despite the acquisition spree, some DSPM startups remain independent, notably Cyera, which stands out because of to its AI-based classification and cloud-native scalability. Ben-Ilan said the company can detect complex data patterns beyond standard identifiers, deploy quickly against petabytes of enterprise data in the cloud, and integrate access governance and DLP capabilities to be a true data security platform.

“We’re able to go into a new company – whether that’s Paramount, or another customer of ours – and deploy in minutes across tens or hundreds of petabytes of data to build out that picture in a matter of days,” Bar-Ilan said. “That was something that was never possible before. Cyera has seen so much growth because we’re able to provide results and value that was never possible before.”

How Rubrik, Netskope Have Benefitted from Their DSPM Buys

Rubrik has integrated DSPM into its cyber recovery solutions to more effectively prioritize sensitive data protection in disaster recovery scenarios, Gupta said. By integrating DSPM with backup and recovery, organizations can prioritize critical data protection based on sensitivity and reduce data exposure risks in cloud environments, Gupta said (see: Rubrik Buys Startup Laminar to Unify Cyber Posture, Recovery).

“Now, you’re not just giving someone a host of new problems that they’ve got to go solve,” Gupta said. “You’re giving them problems and solutions together. No security team wants more alerts that they just have to go triage through. They want solutions that are going to help them.”

Netskope, meanwhile, has embedded DSPM into its SASE platform to improve data access governance by preventing excessive permissions and misconfigurations, Thacker said. Adding DSPM will enhance DLP effectiveness and reduce false positives by aligning data classification with security policies, and simplify security operations by providing DSPM, DLP and security service edge in a single platform (see: Netskope Purchases Dasera to Strengthen Cloud Data Security).

“The challenge in having standalone and, in some cases, isolated technologies is that it just adds a layer of latency in terms of making decisions and responding to actions and events,” Thacker said. “Lots of organizations correlate this information into a SIEM platform, which is great, but somebody then has to go through a review and look at events and incidents.”

Enterprises adopting DSPM often face challenges such as a lack of automated remediation, sufficient scale to work across cloud, SaaS and on-prem environments, and ease of integration with existing security tools. On-prem DSPM differs from cloud DSPM in terms of how data is scanned and classified, with organizations prioritizing solutions that offer not just discovery but also security enforcement.

“The value proposition is the integrated platform to be able to solve holistically for cyber recovery and cyber posture together,” Gupta said.

Generative AI is fueling DSPM adoption by boosting the need for monitoring AI applications and shadow AI usage as applications like ChatGPT and Micrsoft Copilot process and generate vast amount of security data. DSPM is being used to monitor what AI models employees are using and what data is being fed into AI systems, and DSPM is also being integrated into AI governance strategies to ensure privacy.

“Are you trying to implement controls around Gen AI that is built into the existing technologies you have in your tech stack, like Office or Copilot, for example,” Shey asked. “That’s a really different use case than if you were trying to build your own enterprise AI application, and now you need to embed other types of controls in that process.”