DSPM tools that find the row you forgot (2026)

The DLP rule was on the laptop. The copy lived in a forgotten bucket. DSPM is find and classify. DLP is the channel. Privacy is the person. GRC is the evidence. This page is the map of the row.

Six maps. One open catalog. Two first-party classifiers. Two DSPM specialists. One CNAPP module. Public docs. Not a bake-off.

Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.

1

OpenMetadata

Best for open catalog you can host

OpenMetadata · Apache-2.0

OpenMetadata is an open data catalog. It is not a full DSPM marketing suite. It is a catalog you can query.

Key features

• Open catalog
• Connectors
• You host it
• Apache-2.0

Why we like it

This is the hidden gem. A catalog you operate beats a slide that says DSPM.

Limits

You still classify. It is not Macie’s ML story. You staff the connectors.

2

Amazon Macie

Best for first-party S3 classifier

Amazon · consumption

Macie looks at S3 for sensitive data. It is AWS-native. It is not multi-cloud DSPM.

Key features

• S3 discovery
• Managed data identifiers
• Findings in AWS
• Consumption

Why we like it

If the forgotten copy is an S3 bucket, start with the native classifier.

Limits

S3-shaped. Cost follows data scanned. Not Azure.

3

Microsoft Purview

Best for first-party map on a Microsoft estate

Microsoft · commercial

Purview is Microsoft’s catalog and governance suite. Data map, labels, and more than DSPM-the-acronym.

Key features

• Data map
• Sensitivity labels
• Microsoft 365 hooks
• Licensed by SKU

Why we like it

If the row lives in M365 or Azure, start here before a fourth vendor.

Limits

SKU splits. Not a multi-cloud specialist. Link GRC if the job is the audit.

4

BigID

Best for known DSPM and data discovery shelf

BigID · commercial

BigID is a known discovery and DSPM name. Sales-led. Public pages sell coverage across stores.

Key features

• Discovery
• Classification
• Privacy and security stories they publish
• Commercial

Why we like it

Known shelf. We list it so the open catalog has a neighbor.

Limits

Commercial. We did not run a tenant.

5

Cyera

Best for commercial DSPM specialist

Cyera · commercial

Cyera sells DSPM as the product, not a module. Cloud data they can see with the roles you grant.

Key features

• Cloud data discovery
• Risk on the store
• Commercial
• Agentless stories they publish

Why we like it

When the RFP says DSPM and nothing else, this is that category name.

Limits

Commercial. We did not run it. Still need an owner for each finding.

6

Wiz DSPM

Best for dSPM view on a CNAPP you may already have

Wiz · commercial

Wiz DSPM is a module. The cloud platforms list already rows Wiz. We will not reprint that page.

Key features

• Data findings on the graph
• Same tenant as CSPM if you bought it
• Commercial
• Cloud stores they document

Why we like it

If Wiz is already in the account, ask for the data view before a fifth agent.

Limits

Commercial. Overlap declared. Not an open catalog.

What the internet thinks about DSPM tools

Catalog threads treat inventory as the unglamorous control. DSPM that cannot name a store is a slide.

sushi30 on Hacker News, Jul 2024: “We used to have everything scattered all over the place. With OpenMetadata everything is one place.”

Prove OpenMetadata still ships Apache-2.0

Confirm OpenMetadata still publishes Apache-2.0. Do not scan a bucket you do not own.

curl -fsS https://raw.githubusercontent.com/open-metadata/OpenMetadata/main/LICENSE | head -n 5

FAQs

Is DSPM DLP?

No. DSPM finds the row. DLP watches the channel. Different door.

Is this privacy?

Finding the person is adjacent. DSAR tools live on the privacy pillar.

Does Wiz DSPM replace Macie?

Only if it covers the store you care about. On AWS-only S3, Macie is still the native check.

Is this a scored bake-off?

No. Order is editorial.