# DSPM will find data you did not know existed, in places you did not know it was stored. The finding is fast. The remediation is not.

*DSPM & Data Discovery — a TechBag decision guide. Last reviewed 2026-10-03.*

> A DSPM product connects to your stores, scans what is in them, classifies it and maps who can reach it. The first scan typically returns thousands of findings within days — and every one of them needs an owner, a decision and a change made by someone who has other work.

**The checkable fact:** The check before you shortlist: ask where your sensitive data is. If the answer is a guess, the first deliverable of any product here is the map — and the second, larger project is doing something about what the map shows.

- Canonical: https://www.thetechbag.com/browse/data-security-privacy/dspm
- Category: [Data Security & Privacy](https://www.thetechbag.com/browse/data-security-privacy)
- Products compared: 18

## What dspm & data discovery actually is

Data security posture management finds data at rest, decides what it is, and maps who can reach it. It is the answer to the question almost no organisation can answer unaided — where is our sensitive data — and it is the prerequisite for writing any credible DLP policy or rights-management rule.

The eighteen products below differ most in what they can physically scan. Cloud-native tools are agentless and fast and stop at the cloud boundary. Hybrid platforms reach on-premises file shares and cost more to deploy. Two are modules of platforms carded elsewhere — Wiz in cloud security, Rubrik in backup, where the scan runs over a copy production never notices.

**The most common mis-purchase.** What it can **actually scan**. Cloud object storage is universal; managed databases are common; SaaS varies; **on-premises file shares are the usual gap**. Estates whose sensitive data lives on shares and whose business case assumed coverage discover the mismatch after signature. Ask for the specific store list, not the category.

## Four terms, resolved

These are adjacent controls at different points in the data’s life, not tiers. A product that classifies perfectly may block nothing, and a product that secures the cloud account may know nothing about what is inside it.

### DSPM vs CSPM

Are you securing the cloud account, or what is inside it?

### DSPM vs DLP

Do you need to find data at rest, or stop it moving?

### Discovery vs classification

Finding the file, or deciding what it is?

### Classification vs cataloguing

Is the audience security, or the data team?

The practical consequence: these four sit in sequence rather than in competition. Discover, classify, then decide whether the control you need watches the exit, governs the access, or travels with the file.

## The decision variables

Six variables move the shortlist. Everything else is preference.

**What it can scan.** Cloud object storage, managed databases, SaaS applications, on-premises file shares, large unstructured estates. Coverage varies enormously and on-premises is where business cases break.

**Agentless or connector-based.** Agentless is fastest to first finding. Connector catalogues decide coverage — confirm your specific stores are on the list before signature.

**Access-path depth.** Reporting permissions is not the same as computing effective access through nested groups, inherited rights and share links. This is Varonis's differentiator and where several cloud-first tools are visibly thinner.

**Remediation or reporting.** Acting on a finding, raising a workflow, or producing a report. The further right you sit, the more headcount the programme needs.

**Indian data-type accuracy.** PAN, Aadhaar, GSTIN. Undocumented across every vendor here — prove it in a proof of concept, because a US-tuned classifier returns nothing useful in an Indian estate.

**Scanning cost.** Metered on stores or scanned volume rather than headcount, so a small team with large object stores can cost more than a large workforce.

## The 18 products

Every product carries one stated limitation. Prices are USD with an indicative INR conversion, tier- and term-matched where the vendor publishes one.

### Varonis DSPM — Varonis

- **Who it's for:** Estates whose real question is who can actually reach this — through every nested group, inherited permission and share link — and whose data lives partly on file shares that cloud-first tools do not scan.
- **The honest limitation:** The most complete answer here and priced accordingly; quote-only, and deployment is a programme rather than a connector. The breadth that makes it strong on file shares also makes it heavier than an agentless cloud scan.
- **Price:** Quote — quoted per user or per data store; discovery and classification across Microsoft 365, cloud stores, databases and on-premises file shares, with effective-permission mapping and automated remediation
- **Details:** https://www.thetechbag.com/varonis/varonis-dspm

### Varonis Data Access Governance — Varonis

- **Who it's for:** Estates that already know roughly where the data is and whose finding is that far too many people can reach it — the remediation half rather than the discovery half.
- **The honest limitation:** Governance over unstructured data specifically: it is not a cloud posture tool and not a DLP. Assumes the Varonis platform underneath.
- **Price:** Quote — quoted within the Varonis platform; least-privilege enforcement over unstructured data — finding and removing excessive access rather than only reporting it
- **Details:** https://www.thetechbag.com/varonis/varonis-data-access-governance

### Varonis DDR — Varonis

- **Who it's for:** Estates that have the map and now need a motion sensor on it — detecting the account that suddenly reads ten thousand files it has never touched.
- **The honest limitation:** Detection over data Varonis already classifies: it is the response half of a posture investment, not a standalone monitoring product.
- **Price:** Quote — quoted within the Varonis platform; alerting and automated response on abnormal access to data at rest, rather than on a cloud configuration
- **Details:** https://www.thetechbag.com/varonis/varonis-ddr

### Cyera DSPM — Cyera

- **Who it's for:** Cloud-first estates that want an accurate map quickly without deploying anything — the fastest time-to-first-finding on this page.
- **The honest limitation:** Cloud-scoped: on-premises file shares are the usual gap, and buyers whose business case assumed them discover it after signature. Access-path analysis is present but shallower than Varonis.
- **Price:** Quote — quoted per environment or scanned volume; agentless AI-native discovery and classification across cloud object storage, managed databases and SaaS applications
- **Details:** https://www.thetechbag.com/cyera/cyera-dspm

### Cyera Data Access Governance — Cyera

- **Who it's for:** Cyera estates whose next question after discovery is access — and who want that answered inside the platform that did the classification.
- **The honest limitation:** Cloud and SaaS scope, following the platform's coverage; on-premises shares are outside it. Assumes Cyera DSPM underneath.
- **Price:** Quote — quoted within the Cyera platform; who can reach which classified data across cloud stores and SaaS, with entitlement analysis over the discovered map
- **Details:** https://www.thetechbag.com/cyera/cyera-data-access-governance

### Securiti DSPM — Securiti

- **Who it's for:** Estates whose driver is privacy operations as much as security — where the same map has to serve a DPDP or GDPR obligation and a security finding.
- **The honest limitation:** Connector-based, so coverage is a function of the catalogue: confirm your specific stores are supported before signature. Acquired by Veeam (about $1.725B, closed December 2025) and continuing under its own brand.
- **Price:** Quote — quoted within the Data Command Center; discovery, classification and posture across cloud, database, SaaS and on-premises sources through a connector catalogue
- **Details:** https://www.thetechbag.com/securiti/securiti-dspm

### Securiti Data Discovery — Securiti

- **Who it's for:** Organisations at the very start of a privacy programme whose first deliverable is a defensible data map rather than an enforcement control.
- **The honest limitation:** Discovery and cataloguing rather than posture: it produces the inventory and does not analyse access paths or remediate. The right first step, not the whole answer.
- **Price:** Quote — quoted within the Data Command Center; the discovery and cataloguing layer — what personal and sensitive data exists, where, and whose it is
- **Details:** https://www.thetechbag.com/securiti/securiti-data-discovery

### Securiti Data Privacy Automation — Securiti

- **Who it's for:** Estates whose obligation is operational privacy — honouring data-principal requests and evidencing consent — rather than a security posture finding.
- **The honest limitation:** Privacy operations, not a security control: it does not block, encrypt or detect. It answers a regulator's question, not an attacker's.
- **Price:** Quote — quoted within the Data Command Center; consent records, data-principal request handling and privacy reporting built on the discovered map
- **Details:** https://www.thetechbag.com/securiti/securiti-data-privacy

### Securiti Data Governance — Securiti

- **Who it's for:** Organisations where the data map has to serve analytics governance as well as security — one inventory, two audiences.
- **The honest limitation:** Governance tooling rather than a security control, and its audience is the data team rather than the security team. Buying it to satisfy a security finding answers a different question.
- **Price:** Quote — quoted within the Data Command Center; policy, quality and lineage over the catalogued data estate for governance and analytics teams
- **Details:** https://www.thetechbag.com/securiti/securiti-data-governance

### Forcepoint DSPM — Forcepoint

- **Who it's for:** Estates buying discovery and enforcement together, where the classification that finds the data should be the one the DLP acts on.
- **The honest limitation:** The strongest case assumes Forcepoint DLP alongside it; as a standalone DSPM it is less specialised than the cloud-native tools. India residency is not documented.
- **Price:** Quote — quoted within the Forcepoint data-security portfolio; discovery and classification that feed the same policy engine driving Forcepoint DLP
- **Details:** https://www.thetechbag.com/forcepoint/forcepoint-dspm

### Forcepoint DDR — Forcepoint

- **Who it's for:** Forcepoint estates that want the posture map to raise alerts when someone actually touches what it found.
- **The honest limitation:** Detection over data Forcepoint classifies — it is the response half of a portfolio purchase rather than a standalone product.
- **Price:** Quote — quoted within the Forcepoint portfolio; detection and response on access to classified data at rest, rather than on cloud configuration drift
- **Details:** https://www.thetechbag.com/forcepoint/forcepoint-ddr

### Seclore DSPM — Seclore

- **Who it's for:** Indian estates that want the discovery and the protection from one India-built vendor, with the remediation being protect-the-file rather than only report-the-finding.
- **The honest limitation:** Narrower connector coverage than the global platforms and documented deployments are Indian mid-market and BFSI. Indian data-type classification is not documented despite the India-built positioning — prove it.
- **Price:** Quote (INR) — quoted per environment in INR from the Mumbai-built vendor; discovery and classification that can hand off directly to Seclore's rights management for protection
- **Details:** https://www.thetechbag.com/seclore/seclore-dspm

### Wiz DSPM — Wiz

- **Who it's for:** Wiz estates that want to know whether the public bucket the CSPM found actually holds sensitive data — the finding and the consequence in one view.
- **The honest limitation:** Cloud-native only and a module, not a standalone product: no on-premises coverage at all, and the case assumes Wiz is already the cloud security platform.
- **Price:** In the platform — a module of the Wiz platform, licensed with the cloud security graph; data findings joined to the same graph that carries the misconfiguration and vulnerability context
- **Details:** https://www.thetechbag.com/wiz/wiz-dspm

### Rubrik DSPM — Rubrik

- **Who it's for:** Rubrik estates that want a data map without a second scan of production — the backup copy is already a complete, quiescent snapshot of everything.
- **The honest limitation:** Scope is whatever Rubrik backs up, which is a real constraint if some stores are not protected. Reporting-oriented: it finds and classifies rather than remediating.
- **Price:** In the platform — a module of the Rubrik platform; classification run over data the backup already holds, so discovery does not touch production systems
- **Details:** https://www.thetechbag.com/rubrik/rubrik-dspm

### Seqrite Data Privacy — Seqrite

- **Who it's for:** Indian mid-market estates whose driver is DPDP readiness and whose data sits mostly on endpoints and file shares rather than cloud object storage.
- **The honest limitation:** Endpoint and share oriented: cloud object storage and managed database coverage is thin, and there is no access-path analysis. Reports rather than remediates.
- **Price:** Quote (INR) — quoted per endpoint or per user in INR; personal-data discovery across endpoints and shares with DPDP-shaped reporting, from the India-built vendor
- **Details:** https://www.thetechbag.com/seqrite/seqrite-data-privacy

### LinkShadow DSPM — LinkShadow

- **Who it's for:** Estates ALREADY deploying LinkShadow NDR that want data-exposure context in the same console — the consolidation argument is the real one here, not standalone DSPM depth.
- **The honest limitation:** The newest and least-proven of LinkShadow’s three products, in a crowded field: Varonis, Cyera, Securiti and Wiz all have far deeper track records, more India presence and named references. LinkShadow’s 2026 Gartner Visionaries placement is for its NDR, NOT for DSPM — there is no independent analyst recognition of this module at all. No India data residency (their privacy policy allows storage anywhere in the world) and no DPDP reporting. Buying it standalone is a materially weaker case than buying it to extend an existing LinkShadow deployment.
- **Price:** Quote — quoted as a module on the CyberMeshX platform; discovery, classification, exposure analysis and least-privilege recommendations, correlated with the vendor’s NDR and ITDR signal rather than sold as a standalone data-security programme
- **Details:** https://www.thetechbag.com/linkshadow/linkshadow-dspm

### IBM Guardium Data Security Center (DSPM) — IBM

- **Who it's for:** Guardium database-monitoring estates that want cloud data discovery and posture in the same console rather than a second vendor.
- **The honest limitation:** DSPM is one module of a platform that is mostly database monitoring; IBM publishes no DSPM depth (access paths, SaaS coverage) or price, so prove it in a PoC against a pure-play.
- **Price:** Quote — quoted; DSPM (from the Polar Security acquisition) is one module beside Data Protection, Vulnerability Assessment and Cryptography Manager in one console
- **Details:** https://www.thetechbag.com/ibm/ibm-guardium-data-security-center

### Fortra DSPM — Fortra

- **Who it's for:** Estates whose sensitive data is split between cloud, SaaS and Windows file shares, especially those already running Fortra DLP or Data Classification that want one vendor to find, label and enforce.
- **The honest limitation:** Remediation runs through integrations such as DLP rather than natively, data detection and response is not named, and DPDP-shaped reports are not documented. How file shares and databases are reached is not stated, the hosting region is not published, and the product joined Fortra with Lookout Cloud Security in May 2025.
- **Price:** Quote — quoted with no published meter, after an optional 30-day Data Risk Assessment; discovery and classification across cloud services, SaaS apps, on-network file shares and databases, with Box and SharePoint scanned over API without an agent
- **Details:** https://www.thetechbag.com/fortra/fortra-dspm

## Why each constraint rules out what it does

The full narrowing logic, as prose. Nothing here is hidden behind an interaction.

**on-premises shares.** Rules out Cyera DSPM, Cyera Data Access Governance, Securiti Data Governance, Wiz DSPM and LinkShadow DSPM — cloud-scoped: on-premises shares are not covered. That leaves Varonis DSPM, Varonis Data Access Governance, Varonis DDR, Securiti DSPM, Securiti Data Discovery, Securiti Data Privacy Automation, Forcepoint DSPM, Forcepoint DDR, Seclore DSPM, Rubrik DSPM, Seqrite Data Privacy, IBM Guardium Data Security Center (DSPM) and Fortra DSPM.

**managed databases.** Rules out Varonis Data Access Governance, Varonis DDR, Forcepoint DDR, Seclore DSPM, Rubrik DSPM and Seqrite Data Privacy — database contents are not a documented scan target. That leaves Varonis DSPM, Cyera DSPM, Cyera Data Access Governance, Securiti DSPM, Securiti Data Discovery, Securiti Data Privacy Automation, Securiti Data Governance, Forcepoint DSPM, Wiz DSPM, LinkShadow DSPM, IBM Guardium Data Security Center (DSPM) and Fortra DSPM.

**SaaS applications.** Rules out Wiz DSPM — SaaS application data is not covered. That leaves Varonis DSPM, Varonis Data Access Governance, Varonis DDR, Cyera DSPM, Cyera Data Access Governance, Securiti DSPM, Securiti Data Discovery, Securiti Data Privacy Automation, Securiti Data Governance, Forcepoint DSPM, Forcepoint DDR, Seclore DSPM, Rubrik DSPM, Seqrite Data Privacy, LinkShadow DSPM, IBM Guardium Data Security Center (DSPM) and Fortra DSPM.

**unstructured shares.** Rules out Varonis DDR, Cyera DSPM, Cyera Data Access Governance, Securiti DSPM, Securiti Data Privacy Automation, Securiti Data Governance, Forcepoint DSPM, Forcepoint DDR, Seclore DSPM, Wiz DSPM, Rubrik DSPM, LinkShadow DSPM and IBM Guardium Data Security Center (DSPM) — not documented for large unstructured share estates. That leaves Varonis DSPM, Varonis Data Access Governance, Securiti Data Discovery, Seqrite Data Privacy and Fortra DSPM.

**effective access paths.** Rules out Cyera DSPM, Securiti DSPM, Securiti Data Governance, Forcepoint DSPM, Forcepoint DDR, Seclore DSPM, Wiz DSPM, Rubrik DSPM, LinkShadow DSPM, IBM Guardium Data Security Center (DSPM) and Fortra DSPM — reports permissions, but not effective access through nested groups and inherited rights; Securiti Data Discovery, Securiti Data Privacy Automation and Seqrite Data Privacy — no access analysis at all. That leaves Varonis DSPM, Varonis Data Access Governance, Varonis DDR and Cyera Data Access Governance.

**acting on findings.** Rules out Cyera DSPM, Cyera Data Access Governance, Securiti DSPM, Securiti Data Privacy Automation, Securiti Data Governance, Forcepoint DSPM, Wiz DSPM, IBM Guardium Data Security Center (DSPM) and Fortra DSPM — raises a workflow or ticket; the change is made elsewhere; Securiti Data Discovery, Rubrik DSPM, Seqrite Data Privacy and LinkShadow DSPM — reporting only. That leaves Varonis DSPM, Varonis Data Access Governance, Varonis DDR, Forcepoint DDR and Seclore DSPM.

**data detection and response.** Rules out Varonis Data Access Governance, Cyera DSPM, Cyera Data Access Governance, Securiti DSPM, Securiti Data Discovery, Securiti Data Privacy Automation, Securiti Data Governance, Forcepoint DSPM, Seclore DSPM, Wiz DSPM, Rubrik DSPM, Seqrite Data Privacy, LinkShadow DSPM and Fortra DSPM — posture only, no data detection and response. That leaves Varonis DSPM, Varonis DDR, Forcepoint DDR and IBM Guardium Data Security Center (DSPM).

**agentless deployment.** Rules out Varonis DSPM, Varonis Data Access Governance, Varonis DDR, Forcepoint DSPM, Forcepoint DDR and IBM Guardium Data Security Center (DSPM) — hybrid deployment with components to install; Securiti DSPM, Securiti Data Discovery, Securiti Data Privacy Automation, Securiti Data Governance, Seclore DSPM, Rubrik DSPM, Seqrite Data Privacy, LinkShadow DSPM and Fortra DSPM — connector-based: coverage depends on the connector catalogue. That leaves Cyera DSPM, Cyera Data Access Governance and Wiz DSPM.

**a standalone product.** Rules out Wiz DSPM, Rubrik DSPM, LinkShadow DSPM and IBM Guardium Data Security Center (DSPM) — sold inside a cloud-security or backup platform licence, not as a discovery product on its own. That leaves Varonis DSPM, Varonis Data Access Governance, Varonis DDR, Cyera DSPM, Cyera Data Access Governance, Securiti DSPM, Securiti Data Discovery, Securiti Data Privacy Automation, Securiti Data Governance, Forcepoint DSPM, Forcepoint DDR, Seclore DSPM, Seqrite Data Privacy and Fortra DSPM.

**DPDP reporting.** Rules out Varonis DSPM, Varonis Data Access Governance, Varonis DDR, Cyera DSPM, Cyera Data Access Governance, Forcepoint DSPM, Forcepoint DDR, Wiz DSPM, Rubrik DSPM, LinkShadow DSPM, IBM Guardium Data Security Center (DSPM) and Fortra DSPM — no DPDP-specific reporting documented (the underlying discovery may still serve the obligation). That leaves Securiti DSPM, Securiti Data Discovery, Securiti Data Privacy Automation, Securiti Data Governance, Seclore DSPM and Seqrite Data Privacy.

**Indian data types.** Rules nothing out on published terms. It flags Varonis DSPM — Indian data-type classification is not documented by the vendor, Varonis Data Access Governance — Indian data-type classification is not documented by the vendor, Varonis DDR — Indian data-type classification is not documented by the vendor, Cyera DSPM — Indian data-type classification is not documented by the vendor, Cyera Data Access Governance — Indian data-type classification is not documented by the vendor, Securiti DSPM — Indian data-type classification is not documented by the vendor, Securiti Data Discovery — Indian data-type classification is not documented by the vendor, Securiti Data Privacy Automation — Indian data-type classification is not documented by the vendor, Securiti Data Governance — Indian data-type classification is not documented by the vendor, Forcepoint DSPM — Indian data-type classification is not documented by the vendor, Forcepoint DDR — Indian data-type classification is not documented by the vendor, Seclore DSPM — Indian data-type classification is not documented by the vendor, Wiz DSPM — Indian data-type classification is not documented by the vendor, Rubrik DSPM — Indian data-type classification is not documented by the vendor, Seqrite Data Privacy — Indian data-type classification is not documented by the vendor, LinkShadow DSPM — Indian data-type classification is not documented by the vendor, IBM Guardium Data Security Center (DSPM) — Indian data-type classification is not documented by the vendor and Fortra DSPM — Indian data-type classification is not documented by the vendor — marked, not removed.

**India residency.** Rules nothing out on published terms. It flags Varonis DSPM — India residency for the classification index is not documented, Varonis Data Access Governance — India residency for the classification index is not documented, Varonis DDR — India residency for the classification index is not documented, Cyera DSPM — India residency for the classification index is not documented, Cyera Data Access Governance — India residency for the classification index is not documented, Securiti DSPM — India residency for the classification index is not documented, Securiti Data Discovery — India residency for the classification index is not documented, Securiti Data Privacy Automation — India residency for the classification index is not documented, Securiti Data Governance — India residency for the classification index is not documented, Forcepoint DSPM — India residency for the classification index is not documented, Forcepoint DDR — India residency for the classification index is not documented, Wiz DSPM — India residency for the classification index is not documented, Rubrik DSPM — India residency for the classification index is not documented, LinkShadow DSPM — India residency for the classification index is not documented, IBM Guardium Data Security Center (DSPM) — India residency for the classification index is not documented and Fortra DSPM — India residency for the classification index is not documented — marked, not removed.

**On-premises is the usual gap.** Cloud-native DSPM is fast and agentless because it scans cloud APIs. Estates whose sensitive data sits on file shares discover this after signature. Confirm on-premises coverage explicitly if the business case assumed it.

**Two of these fifteen are modules.** Wiz and Rubrik sell DSPM inside their platforms. If you already run either, the discovery may be a licence change rather than a purchase — and Rubrik's runs over the backup copy, so production carries no scan load.

**Classification accuracy on Indian records is unproven.** No DSPM vendor here documents PAN, Aadhaar or GSTIN support. We mark it per product rather than assume it, and never eliminate on it. Scan a representative sample of your own records during the proof of concept — an empty finding list is the usual symptom of a US-tuned classifier.

**Finding is fast; remediation is not.** A scan returns thousands of findings in days. Every one needs an owner and a decision. Estates that treat the scan as the deliverable end up with a report nobody actions and a renewal nobody can justify.

## Eight situations, and what each one buys

If one of these is your sentence, the shortlist is short.

### Most of our sensitive data is on file shares

**Shortlist:** Varonis DSPM, Securiti Data Discovery, Seclore DSPM, Seqrite Data Privacy

**Why:** On-premises unstructured coverage is the dividing line here, and the cloud-native tools do not cross it.

**Trade-off:** Deployment is heavier than an agentless cloud scan — a programme rather than a connector.

### Cloud-first, and we need a map this quarter

**Shortlist:** Cyera DSPM, Wiz DSPM

**Why:** Agentless discovery across cloud object storage, databases and SaaS with nothing to install.

**Trade-off:** On-premises shares are outside scope entirely; confirm that matches your estate before signature.

### Too many people can reach the data we found

**Shortlist:** Varonis Data Access Governance, Cyera Data Access Governance, Varonis DSPM

**Why:** Effective access-path analysis through nested groups and inherited permissions, plus least-privilege enforcement.

**Trade-off:** Both assume their platform underneath; this is the remediation half of a discovery investment.

### The CSPM found a public bucket and nobody knows if it matters

**Shortlist:** Wiz DSPM, Cyera DSPM

**Why:** This is exactly the CSPM-to-DSPM handoff: configuration finding, data consequence.

**Trade-off:** Wiz DSPM is a module — the case assumes Wiz is already your cloud security platform.

### We cannot put scan load on production

**Shortlist:** Rubrik DSPM

**Why:** Classification runs over the backup copy, which is a complete quiescent snapshot production never notices.

**Trade-off:** Scope is whatever Rubrik backs up. Stores outside the backup are outside the map.

### DPDP readiness started and the data map does not exist

**Shortlist:** Securiti Data Discovery, Securiti Data Privacy Automation, Seqrite Data Privacy, Seclore DSPM

**Why:** All four document DPDP-shaped reporting, and personal-data discovery is the first practical step of any readiness programme.

**Trade-off:** Privacy automation is not a security control — read the DPDP section below before assuming one product covers both.

### We have the map and want alerts when someone touches it

**Shortlist:** Varonis DDR, Forcepoint DDR, Varonis DSPM

**Why:** Data detection and response alerts on access to classified data at rest, not on configuration drift.

**Trade-off:** Both are the response half of a posture investment and assume the classification is already there.

### We are buying discovery and enforcement together

**Shortlist:** Forcepoint DSPM, Varonis DSPM, Seclore DSPM

**Why:** The classification that finds the data is the one the enforcement acts on — one definition of sensitive, not two.

**Trade-off:** Ties you to one vendor across two routes; the specialists are deeper at each individual job.

## At scale

DSPM is metered on stores and scanned volume, so scale here means data, not headcount.

### 1 data stores — A handful of cloud stores

- Agentless scanning is fast and cheap at this size
- One person can action the findings
- Wiz or Rubrik may already cover it

**The test:** Check whether an existing platform already includes DSPM.

### 2 data stores — Cloud plus SaaS, tens of stores

- Connector coverage becomes the deciding variable
- Findings need a triage process, not one person
- Classification accuracy starts to matter commercially

**The test:** Confirm your specific stores appear on the connector list.

### 3 data stores — Hybrid, with on-premises shares

- The cloud-native tools stop being candidates
- Deployment becomes a programme
- Access-path analysis earns its price

**The test:** Prove on-premises coverage in the proof of concept, not in the datasheet.

### 4 data stores — Petabyte-scale unstructured

- Scanning cost becomes a material line item
- Incremental and targeted scanning matters more than raw speed
- Remediation needs automation, not tickets

**The test:** Model the scanning bill on your actual volume before signature.

Where a vendor does not publish deployment scale evidence, this page says so rather than implying it.

## Getting out

The map is easier to leave than the tuning behind it.

**The inventory** — Findings and classifications export to CSV or API almost everywhere *(Portable)*

**Classification tuning** — Custom classifiers and thresholds are vendor-specific and are rebuilt *(Not portable)*

**Connector configuration** — Each platform models stores differently; the connections are re-made *(Rebuilt)*

**Remediation history** — Who decided what about which finding — exportable, but rarely in a form the next tool ingests *(Partly portable)*

The practical consequence: a second DSPM re-scans and re-classifies from scratch. Switching is cheaper than switching DLP, and still not free.

## What it costs

Metered on stores, environments or scanned volume — not per user, which changes the budgeting shape entirely.

### Do you already own one?

Four checks, in the order most likely to return a yes.

- **Microsoft Purview — Already scanning, if your data is in Microsoft 365.** E5 includes data classification and scanning across Microsoft 365. **Its scope is the Microsoft estate** — strong there, and not a map of your cloud object storage or file shares.

- **Your cloud security platform — Wiz sells DSPM on the same graph as its CSPM findings.** If Wiz is already deployed, the data half is a licence change rather than a new tool to run.

- **Your backup platform — Rubrik sells DSPM over the copy it already holds.** Discovery with no production scan load — scope is whatever is backed up.

- **Your DLP vendor — Forcepoint, Varonis and Seclore sell both halves.** Buying discovery from the vendor that will enforce means one definition of sensitive rather than two.

None of these is automatically right, and each covers a different slice. The Microsoft answer in particular is strong inside its own estate and silent outside it.

### What the rest actually cost

Quote-led across the board, and the meter is the thing to negotiate.

### What isn't in the licence price

- **Remediation headcount.** Thousands of findings need owners and decisions. This is the line that decides whether the map becomes a fix.

- **Scanning costs on large stores.** Cloud egress and compute for scanning petabyte-scale object storage is a real and separate bill.

- **Indian data-type proof of concept.** Undocumented across every vendor. Budget the time to prove it against your own records.

- **Connector gaps.** Stores outside the catalogue need custom work or stay unscanned — and unscanned stores are exactly where surprises live.

## What goes wrong

Five ways this purchase goes wrong. Each is recoverable if caught before signature.

- **Findings nobody owns.** The scan returns thousands of results in days and stops there. Without a named owner and a triage process, the map is a report and the renewal has no case behind it.

- **On-premises shares out of scope.** The business case assumed them; the agentless tool cannot see them. This is the single most common mismatch in this category — confirm it explicitly.

- **Classification tuned for US data types.** A classifier looking for social security numbers finds nothing useful in an Indian estate. Undocumented across every vendor here, so prove it with your own records.

- **Scanning costs nobody modelled.** Volume-metered scanning on large object stores produces a bill that has nothing to do with headcount. Model it before signature.

- **Buying DSPM when the requirement was DLP.** Or the reverse. One finds data at rest; the other stops it moving. The boundary section above resolves it in one question.

## Questions this guide answers

### What is the difference between DSPM and CSPM?

CSPM reads cloud configuration and tells you the bucket is public. DSPM reads contents and tells you the public bucket holds customer records. One finds misconfigurations, the other finds consequences — and a CSPM report of 400 public buckets cannot tell you which three actually matter. They are complementary, and CSPM is covered on the Cloud & Workload Security guide rather than repeated here.

### Does DPDP require DSPM?

No. Rule 6 of the DPDP Rules, 2025 (notified 13 November 2025) requires reasonable security safeguards to prevent personal data breaches, and lists measures including encryption, obfuscation, masking, access control and log retention. It does not name DSPM, DLP or any product category. The practical inference — that you cannot apply access control to personal data you cannot locate — is an implication we label as one. Any vendor claiming DPDP mandates their product category is overstating the instrument. Confirm the schedule applicable to your class of fiduciary with counsel.

### Can DSPM scan on-premises file shares?

Some can and many cannot, and this is the most common mismatch in the category. Varonis, Securiti, Seclore and Seqrite document on-premises coverage; the cloud-native agentless tools including Cyera and Wiz are scoped to cloud stores, databases and SaaS. If your business case assumed on-premises shares, confirm coverage explicitly before signature — it is discovered after the fact more often than any other constraint here.

### Do DSPM tools recognise PAN, Aadhaar and GSTIN?

No vendor on this page documents support for Indian data types. We mark that as unknown per product rather than assuming it either way, and we never eliminate a product on it. It must be proven in a proof of concept against your own records: a classifier trained on US formats returns nothing useful on Indian identifiers, and this is the most common reason an expensive scan produces an empty finding list.

### How is DSPM priced?

Per environment, per data store or on scanned volume — not per user. That means an organisation with a small team and large object stores can pay more than one with a large workforce and little data. Varonis, Cyera and Securiti are quote-led. Seclore and Seqrite quote in INR and are the two India-built options. Wiz and Rubrik include DSPM inside their platform licences. Ask each vendor to model the bill against your actual store inventory, because the meter matters more than the rate.

---

*Vendor-neutral. Nothing gated. Figures marked [TechBag to confirm] are team-owned and deliberately not guessed.*
*TechBag — India-based software reseller and advisory. https://www.thetechbag.com/browse/data-security-privacy/dspm*