Data Security
DSPM Tools in 2026: 6 Data Security Posture Management Platforms
Find and classify the copy in an account nobody owns. A privacy ticket is not that map.
Expertise: Data Security · Level: Intermediate · 6 min read
GDPR Article 30 requires each controller to maintain a record of processing activities under its responsibility: purposes, categories of data subjects, and categories of personal data. That record is the processing someone already declared.
A warehouse catalog of tables you were told about is the same kind of list. It is not a map of copies in accounts nobody owns, snapshots in another region, or a bucket that inherited a public ACL. DSPM is discovery and classification of those forgotten stores, not a rewrite of the Article 30 spreadsheet.
An open catalog you can query, a commercial estate scanner, and a file classifier you point at one share all find stores. They do not fulfill a person. When the request is access or delete, that ticket already lives on DSAR tools. When a PAN paste hits chat, the gate is on DLP tools.
How we evaluated
We read first-party docs, source, licenses, and release notes, and we treat a marketing page as a claim, not as proof that two products do the same work.
We cared about whether the product catalogs stores you own, whether you operate it, whether classification is the product or a module, and whether we were honest that OpenMetadata is a catalog. A fifth CNAPP brochure missed.
We read first-party docs, licenses, and release notes. Unless a write-up says otherwise, we did not run a paid tenant.
| Tool | Best for | What to check |
|---|---|---|
| OpenMetadata | Open catalog you can host | Open catalog · Apache-2.0 · you host it |
| Amazon Macie | First-party S3 classifier | S3 discovery · AWS consumption · AWS only |
| Microsoft Purview | First-party map on a Microsoft estate | Data map plus labels · Microsoft licensing · Microsoft estate |
| BigID | Known DSPM and data discovery option | Discovery plus classification · commercial |
| Cyera | Commercial DSPM specialist | Cloud data discovery · commercial · agentless stories they publish |
| Wiz DSPM | DSPM view on a CNAPP you may already have | Data findings on the graph · commercial · same tenant as CSPM |
OpenMetadata
Best for open catalog you can host
OpenMetadata is an open data catalog. It is not a full DSPM marketing suite. It is a catalog you can query.
A catalog you operate beats a slide that says DSPM. You still classify. It is not Macie’s machine-learning story. You staff the connectors. The DSAR list rows it again as the way to find the person.
Key features
- Open catalog
- Connectors
- You host it
- Apache-2.0
Why we like it
A catalog you can query is the map. Everything else is a finding on top of it.
Limits
You still classify. It is not a hosted ML classifier. You staff the connectors.
Amazon Macie
Best for first-party S3 classifier
Macie looks at S3 for sensitive data. It is AWS-native. It is not multi-cloud DSPM.
If the forgotten copy is an S3 bucket, start with the native classifier. Cost follows data scanned. It is not Azure.
Key features
- S3 discovery
- Managed data identifiers
- Findings in AWS
- Consumption
Why we like it
The classifier on the store you already pay for is the first-party AWS row.
Limits
S3-shaped. Cost follows data scanned. Not Azure.
Microsoft Purview
Best for first-party map on a Microsoft estate
Purview is Microsoft’s catalog and governance suite. Data map, labels, and more than DSPM as an acronym.
If the row lives in Microsoft 365 or Azure, start here before a fourth vendor. SKU splits hide features. It is not a multi-cloud specialist. If the job is evidence, open audit automation.
Key features
- Data map
- Sensitivity labels
- Microsoft 365 hooks
- Licensed by SKU
Why we like it
The map on the estate you already license is the Microsoft starting point.
Limits
SKU splits. Not a multi-cloud specialist. If the job is evidence, open audit automation.
BigID
Best for known DSPM and data discovery option
BigID is a known discovery and DSPM name. Sales-led. Public pages sell coverage across stores.
A familiar commercial option. We list it so the open catalog has a neighbor. You still need an owner for each finding.
Key features
- Discovery
- Classification
- Privacy and security stories they publish
- Commercial
Why we like it
A specialist that already shows up in discovery RFPs is the commercial neighbor the catalog needs.
Limits
Commercial. Findings still need owners.
Cyera
Best for commercial DSPM specialist
Cyera sells DSPM as the product, not a module. Cloud data they can see with the roles you grant.
When the RFP says DSPM and nothing else, this is that category name. Still need an owner for each finding.
Key features
- Cloud data discovery
- Risk on the store
- Commercial
- Agentless stories they publish
Why we like it
A product whose only job is the data map is the specialist row next to the CNAPP module.
Limits
Commercial. Still need an owner for each finding.
Wiz DSPM
Best for DSPM view on a CNAPP you may already have
Wiz DSPM is a module. The cloud platforms list already covers Wiz.
If Wiz is already in the account, ask for the data view before a fifth agent. Overlap is declared. It is not an open catalog.
Key features
- Data findings on the graph
- Same tenant as CSPM if you bought it
- Commercial
- Cloud stores on the public docs
Why we like it
Opening the data pane on a graph you already bought beats a parallel DSPM you will not staff.
Limits
Commercial. Overlap declared. Not an open catalog.
What we left out
- Varonis. Data security teams already know the name from file-share programs. BigID and Cyera already cover the commercial discovery option on this page.
- Sentra. RFPs that say DSPM and nothing else already include another specialist. Two DSPM specialists already sit here, and a third would reprint a vendor roundup.
Catalog threads treat inventory as the unglamorous control. DSPM that cannot name a store is a slide.
Questions before you buy
Ask these before the trial clock starts. Vague answers usually mean a neighboring category.
- Can this catalog name the store that holds production email if it is not in CMDB?
- Is this a map, a channel control, or a privacy request runner, and which of those do we already pay for?
- Who owns a finding when the classifier flags a bucket nobody claimed?
Name the store, then assign an owner. Use DSAR when a person asked. Use DLP when the paste already left.
FAQs
Is DSPM DLP?
No. DSPM finds the row. DLP watches the channel. Different door.
Is this privacy?
Finding the person is adjacent. DSAR tools live on the privacy pillar.
Does Wiz DSPM replace Macie?
Only if it covers the store you care about. On AWS-only S3, Macie is still the native check.
Is this a scored bake-off?
No. Order is editorial.
