Finding sensitive data in cloud storage: when DSPM earns its place
What problem does DSPM solve?
A posture scan might flag dozens of storage buckets and databases with weak settings. Some hold test fixtures; one holds a copy of the customer table. Without knowing the contents, a team either fixes everything slowly or guesses. DSPM classifies the contents so the store with real customer data rises to the top.
How does it work?
- Discovery: find every data store in connected accounts, including snapshots, backups and exports.
- Classification: sample or scan contents to recognise personal, payment, health and credential data.
- Exposure: join each store with its configuration (public, encrypted, logged) and with the identities and workloads that can reach it.
- Prioritisation: rank data risks by sensitivity and exposure together.
When should DSPM come early?
- Sensitive data is created by many teams in many stores.
- AI projects copy data into new pipelines, feature stores or training sets.
- You must answer where personal data is for a regulator, auditor or customer.
The finder gives DSPM four points when you pick sensitive data, enough to make it the starting category when data is your main concern.
What should you ask a vendor?
Whether data leaves your account during scanning, which store types are covered, which data types are recognised out of the box, and whether DSPM is in the base price. On the pages we read, Microsoft Defender for Cloud places DSPM in its paid Defender CSPM plan; Orca, Cortex Cloud, CrowdStrike, SentinelOne, Sysdig, Upwind and Wiz name DSPM; Aqua does not. See the DSPM page for all nine.
What DSPM does not do
It does not stop data leaving through email or uploads (that is data loss prevention), and it does not narrow permissions on its own. Pair it with CIEM for the who-can-reach part.