# What Is DSPM? Data Security Posture Management, DDR, Shadow Data and Sensitive Data Risk

**URL:** https://securesys.com.tr/en/learning/data-security-and-classification/what-is-dspm-data-security-posture-management

![What Is DSPM? Data Security Posture Management, DDR, Shadow Data and Sensitive Data Risk](/images/bilgi-merkezi/covers/cover-veriguv-09.webp)

**DSPM, that is Data Security Posture Management, is the data-centric security approach used to discover the sensitive data located in the organization's different systems, to classify it, to analyze who can access this data and to evaluate continuously the security risks of the environment the data is located in. DSPM, which can be expressed in Turkish as Veri Güvenliği Duruş Yönetimi, has become one of the important components of modern Data Security Architecture especially with cloud, SaaS, database, data lake, data warehouse and artificial intelligence environments becoming widespread.**

However, in terms of modern data security knowing only where the sensitive data is and which risks it has is not sufficient. The organization at the same time wants to notice as early as possible the unusual accesses to sensitive data, bulk downloads, unexpected queries, the risky behaviors of authorized users and possible data exfiltration attempts.

**At this point the DDR – Data Detection and Response approach comes into play.**

With a simple distinction:

**DSPM → Where is our sensitive data and why is it at risk?**

**DDR → What is happening to our sensitive data right now and how must we intervene in this?**

For this reason DSPM and DDR are not alternatives to each other.

In modern data security these two approaches complement each other.

**While DSPM provides more data posture, exposure, classification and attack surface visibility DDR focuses on runtime activity, anomalous behavior, threat detection and response processes towards the data.**

DLP helps to prevent the uncontrolled movement of the data, DAM to monitor database activities, DSPM to bring out sensitive data risks and DDR to evaluate these signals with an active data threat perspective.

This structure forms the foundation of the modern Data Security Operations approach.

### What Is DSPM?

Data Security Posture Management is the data-centric security approach that aims to analyze continuously where the organization's sensitive data is located, how it is classified, who can access it and which security risks it is exposed to.

Traditional security tools mostly focus on the infrastructure.

The firewall looks at network traffic.

EDR looks at the endpoint.

CSPM looks at the cloud configuration.

Vulnerability Management looks at vulnerabilities.

DSPM, on the other hand, directly:

#### Data

thinks over this.

The fundamental question of DSPM:

**"Where is the critical data that needs to be protected and what is the real exposure level of this data?"**

can be summarized in this way.

### Why Did DSPM Appear?

The corporate data architecture has become much more complex than in the past.

A customer record at the same time:

Production Database

Data Warehouse

Backup

Developer Database

Cloud Storage

Excel Export

SaaS Platform

Data Lake

AI Vector Database

can be located inside these.

The Security Team can know the production database.

However, they may not be aware of the temporary copy created by a developer.

In this case while the sensitive data appears to be protected in reality there are uncontrolled copies.

DSPM focuses on this visibility problem.

### **"You Cannot Protect the Data You Do Not Know"**

This is one of the fundamental principles of modern Data Security.

If the Security Team does not know the existence of a dataset:

They cannot apply classification.

They cannot carry out an access review.

They cannot check the encryption status.

They cannot create a DLP policy.

They cannot apply retention.

They cannot carry out monitoring.

**For this reason the first duty of DSPM is most of the time Data Discovery.**

### Is Data Discovery the Foundation of DSPM?

Yes.

Data Discovery enables the data inside different repositories to be found.

For example:

Databases

Cloud Object Storage

File Servers

SaaS Applications

Data Warehouses

Data Lakes

Backups

Snapshots

AI Data Stores

can be scanned.

But only finding the data is not sufficient.

The next stage is to understand the sensitivity.

### What Is Sensitive Data Discovery?

Sensitive Data Discovery is the sensitive information types inside the repositories being detected.

For example:

Personal Data

PII

Financial Information

Payment Data

Credentials

API Keys

Health Information

Intellectual Property

Source Code

Contracts

Trade Secrets

data categories such as these can be detected.

This information forms the foundation for Data Classification.

### DSPM and Data Classification

DSPM can classify the discovered data according to the sensitivity level or can benefit from the existing classification model.

For example:

Public

Internal

Confidential

Restricted

a model can be used in this way.

This classification is important in terms of risk prioritization.

Because every exposure does not have the same business impact.

### What Does Data Security Posture Mean?

Data Security Posture is the holistic view of the current security state of the organization's data.

For example:

How many sensitive repositories are there?

How many of them are encrypted?

How many of them are public?

In how many of them is there excessive access?

The owner of how many of them is not known?

How many duplicate copies are present?

How many datasets have passed the retention period?

This information forms the organization's Data Security Posture.

### The Fundamental Components of DSPM

The modern DSPM approach in general brings these capabilities together:

Data Discovery

Sensitive Data Classification

Data Access Analysis

Exposure Analysis

Data Flow Visibility

Risk Prioritization

Misconfiguration Context

Shadow Data Discovery

Remediation Guidance

Continuous Monitoring

For this reason DSPM is not only a scanning technology.

It must be evaluated as a Data Security Risk Management platform.

### What Is Shadow Data?

Shadow Data is the data copies, datasets or repositories over which the organization's security or governance teams do not have sufficient visibility.

For example a developer can copy the production database for test purposes.

This copy:

may not be in the security inventory,

may not be within the scope of the backup policy,

may not be seen by DLP,

may not be under monitoring.

However, real customer data can be located inside it.

This is Shadow Data.

### Why Is Shadow Data Dangerous?

Because unprotected or unknown data can be an easy target from the point of view of the attacker.

The production database can be protected with very strong controls.

However, the forgotten copy of the same data:

weak password,

public cloud storage,

unmanaged server

can be located on these.

The attacker targets not the strongest system but the weakest copy.

For this reason Shadow Data enlarges the attack surface.

### How Is Shadow Data Created?

Shadow Data can be created for many reasons.

A developer creates a database copy.

An analyst takes a CSV export.

An employee downloads a spreadsheet.

A backup snapshot is forgotten.

During a cloud migration old storage remains.

The test environment contains production data.

A dataset is copied for an AI project.

In this way data copies multiply quickly.

### What Is Data Sprawl?

Data Sprawl is corporate data spreading to a large number of systems, cloud, SaaS and storage environments.

As Data Sprawl grows visibility can decrease.

This situation:

Shadow Data

Duplicate Data

Unknown Access

Retention Problems

can create these.

DSPM tries to make the Data Sprawl problem visible.

### What Is Dark Data?

Dark Data is data stored by the organization but not used actively or whose business value is uncertain.

For example 8-year-old unused project files can still be in cloud storage.

This data:

storage cost

and:

security exposure

can create these.

Although the business value is low the breach impact can be high.

### The Difference Between Shadow Data and Dark Data

Shadow Data is data that is outside governance visibility.

Dark Data, on the other hand, can be known but unused data.

For example if the security team knows the existence of an old backup but nobody uses it it can be Dark Data.

If the security team is completely unaware of the existence of the backup it can be evaluated as Shadow Data.

### What Is ROT Data?

ROT:

#### Redundant

#### Obsolete

#### Trivial

means data.

Redundant Data is unnecessary copies.

Obsolete Data is old data that is no longer valid.

Trivial Data is data with low business value.

Reducing ROT Data is useful in terms of both storage cost and attack surface.

### What Is Orphaned Data?

Orphaned Data is data whose owner or responsible business unit is not clear.

For example cloud storage created by a former employee can remain for years.

Nobody may know why the data is kept.

In this case taking retention and access decisions becomes difficult.

DSPM can help to identify ownerless datasets.

### What Is Stale Data?

Stale Data is data that has not been updated or used for a long time.

For example:

Last Accessed: 4 Years Ago.

If this dataset contains sensitive data it can be a deletion candidate.

Data Minimization is important here.

### Duplicate Data

Too many copies of sensitive data create risk.

A customer database's:

production,

backup,

analytics,

development,

Excel export

copies can be present.

Every copy creates a new attack surface.

For this reason data duplication visibility is important.

### Data Minimization and DSPM

DSPM can be used not only to find the data to be protected but to reduce unnecessary data too.

The question:

**"Do we really need to keep this data?"**

must be this.

When unnecessary sensitive data is deleted securely the attack surface decreases directly.

### How Does DSPM Calculate Data Risk?

Data risk must not be determined only with the sensitivity.

For example Restricted data can be under strong access controls.

Another Restricted dataset can be on public storage.

Although the two pieces of data have the same classification the risk is not the same.

For this reason the modern risk model:

#### Data Sensitivity

#### Access Exposure

#### Security Configuration

#### Identity Risk

#### Business Context

can be created over these.

### Data Risk Scoring

For example:

Restricted Data

Public Access

No Encryption

Unknown Owner

=

Critical Risk.

Another dataset:

Restricted Data

2 Authorized Users

Encryption

Monitoring

=

Lower Risk.

DSPM helps security teams to determine the remediation priority.

### What Is a Toxic Combination?

A Toxic Combination is different risks that look normal when looked at one by one creating a serious exposure together.

For example:

Sensitive Data

Public Access

No Encryption

can be a toxic combination.

Another example:

Sensitive Data

External User

No Expiry

Bulk Download Permission.

DSPM can analyze these combinations over data context.

### What Is a Data Access Graph?

A Data Access Graph is the model that aims to visualize the access relationships between identities and data resources.

For example:

User

↓

Group

↓

Cloud Role

↓

Storage

↓

Restricted Data.

This chain can be more complex than a direct permission.

DSPM can bring out hidden exposures by analyzing the access path.

### Effective Access

The configured permission and the effective access may not be the same.

A user can access the data over a nested group.

A service account can gain access with role inheritance.

An external application can reach the data over an OAuth scope.

For this reason DSPM must not look only at direct permissions.

### Excessive Access

A sensitive dataset can be accessible by more identities than necessary.

For example:

Restricted HR Data

Accessible by 3,000 Users.

The data is not public.

However, the internal exposure is very high.

This can be a high-risk finding.

### Who Can Access My Sensitive Data?

This is one of the most valuable questions of DSPM.

The Security Team must be able to ask this:

"Who are all the identities that can access Customer PII?"

The answer:

Human Users

Groups

Service Accounts

Applications

External Guests

AI Agents

can be in this way.

Modern data access analysis must cover all the identity classes.

### Identity + Data Security

IAM manages the identity.

DSPM provides the data context.

Together:

**Identity → Permission → Data**

the relationship becomes visible.

This is a critical foundation for Zero Trust Data Security.

### CIEM + DSPM

CIEM focuses on cloud entitlements.

DSPM focuses on data sensitivity.

CIEM:

"Which cloud resources can the user access?"

DSPM:

"Which sensitive data is located inside these resources?"

answers this question.

The two approaches together provide strong access risk analysis.

### DSPM and CSPM

CSPM focuses on the infrastructure configuration posture.

For example:

Storage Public.

DSPM:

Storage contains Restricted Customer Data.

When these two findings are combined the business impact is understood more clearly.

### DSPM and CNAPP

CNAPP evaluates the security of cloud workloads and infrastructure from a wide perspective.

DSPM adds the data layer context.

For example the data sensitivity a vulnerable workload can access can change the risk prioritization.

For this reason cloud-native security is gradually becoming data-aware.

### The Difference Between DSPM and DLP

DSPM:

#### Where is the data and why is it risky?

answers this question.

DLP:

#### Where is the data going and is this movement permitted?

focuses on this question.

DSPM provides posture and visibility.

DLP provides enforcement.

For this reason they are not alternatives to each other.

### How Do DSPM + DLP Work Together?

DSPM can discover a new sensitive repository.

Data Classification is applied.

DLP applies a policy according to this classification.

For example:

Restricted Data

↓

External Upload Attempt

↓

DLP Block.

This is the discovery-to-enforcement lifecycle.

### DSPM and DAM

DSPM:

Finds the sensitive database.

DAM:

Monitors the actual queries on the database.

For example DSPM:

"Database contains Restricted PII."

DAM:

"DBA exported 1.2 million records."

This combined visibility is very valuable in terms of data threat detection.

### **What Is DDR? What Does Data Detection and Response Mean?**

**DDR – Data Detection and Response is the modern Data Security approach that aims for risky, unusual or malicious activities towards sensitive data to be detected, for the event to be evaluated in the data context and for the appropriate response actions to be started.**

The focus of DDR is not only where the data is located.

The real question:

**"What is happening to this sensitive data right now?"**

is in this way.

For example:

A user is downloading much more customer records than normal.

A service account is accessing a Restricted dataset for the first time.

A DBA is querying millions of records at night.

An employee is uploading Confidential files to an external SaaS platform.

An AI Agent is retrieving a large amount of data unexpectedly.

These behaviors can be data security signals that need to be evaluated in terms of DDR.

### What Is the Difference Between DSPM and DDR?

DSPM and DDR are close concepts but are not the same.

**DSPM is more posture management focused.**

It asks these questions:

Where is the sensitive data?

Is the data public?

Is there encryption?

Who can access it?

Is there Shadow Data?

**DDR, on the other hand, is threat detection and response focused.**

It asks these questions:

Who is accessing the data right now?

Is this access normal?

Is there a bulk download?

Can there be data exfiltration?

Must this event be intervened in?

In short:

**DSPM = Data Risk Posture**

**DDR = Data Threat Detection & Response**

it can be thought of in this way.

### Why Is DDR Necessary?

An organization may have found and classified all its sensitive data.

However, even if the security posture is good today tomorrow a compromised identity can create a risk.

For example a legitimate user account is stolen.

The attacker accesses the data over normal permissions.

A CSPM finding may not be created.

A vulnerability may not be found.

However, the user behavior has changed.

DDR focuses on this runtime data activity.

### Are DDR and EDR Similar?

A similarity can be established from a logical point of view but their focuses are different.

EDR:

Endpoint Detection and Response.

DDR:

Data Detection and Response.

EDR focuses on the malicious behavior on the endpoint.

DDR focuses on the malicious or anomalous behavior on data access and data movement.

For this reason in a modern SOC architecture they can complement each other.

### The Difference Between DDR and NDR

NDR analyzes network traffic and network behavior.

DDR analyzes data-centric behavior.

For example NDR can see unusual outbound traffic.

DDR the same event:

Restricted Customer Data

can understand that it is this.

This data context changes the incident priority.

### The Difference Between DDR and DLP

DLP focuses on policy-based data movement prevention.

DDR provides a wider behavioral detection and response perspective.

For example DLP:

"A Restricted file cannot be sent to an external e-mail."

can say this.

DDR, on the other hand:

"This user has accessed 5,000 Confidential documents in the last 30 minutes and their behavior deviates seriously from their normal profile."

can carry out threat detection in this way.

DLP is policy enforcement.

DDR is closer to behavioral data threat detection.

### The Difference Between DDR and DAM

DAM focuses especially on database activity.

DDR can evaluate the activities on different data repositories with a wider data threat perspective.

DAM:

Database query visibility.

DDR:

Cross-platform data threat detection.

For example:

DAM sees a bulk database export.

DDR can relate this with endpoint download and cloud upload activity.

### Which Signals Can DDR Use?

The valuable signals for DDR can be these:

Sensitive Data Access

Bulk Download

Mass Query

External Sharing

Large Export

Unusual User Behavior

New Device Access

Privileged Data Access

Unusual Service Account Activity

AI Agent Data Access

DLP Events

DAM Events

Identity Risk

Endpoint Risk

These signals together can create a risk context.

### DDR and UEBA

UEBA analyzes user and entity behavior patterns.

DDR can combine this behavioral context with data sensitivity.

For example:

User behavior abnormal.

On its own it can be medium risk.

However:

User behavior abnormal

Restricted Data Access

Mass Download

when it is so a critical data threat can be created.

### Data-Centric Threat Detection

Traditional threat detection mostly:

IP

Endpoint

Malware

Process

User

thinks over these.

Data-centric threat detection, on the other hand, to these:

**"Which data is affected?"**

adds this question.

This is very important in terms of incident response priority.

### DDR and Insider Threat

One of the important use cases of DDR is insider threat.

An employee can have legitimate access.

For this reason an authentication bypass is not necessary.

However, the behavior can be unusual.

For example:

An employee normally sees 50 customer records.

One day they download 500,000 records.

This can be an insider risk indicator.

### Compromised Identity and DDR

An attacker can behave like a legitimate user with stolen credentials.

Even MFA may not be sufficient in some token theft scenarios.

DDR can produce signals that support an account compromise by analyzing the data access behavior.

### Data Exfiltration Detection

DDR can see the data exfiltration chain over different security layers.

For example:

Sensitive Database Access

↓

Bulk Export

↓

Endpoint File Creation

↓

Cloud Upload

This chain can be the combination of DAM, EDR and DLP signals.

DDR can make sense of the incident over the data context.

### **DDR + SIEM + SOC**

DDR findings can be transferred to the SOC workflow.

The SIEM:

Identity

Endpoint

Network

Cloud

Data

can correlate these signals.

The SOC analyst in this way not only:

"User downloaded file."

but:

"High-risk user downloaded 10 GB Restricted customer data and uploaded it to an unsanctioned cloud service."

can see a more meaningful alert such as this.

### Data Security Operations

When DSPM and DDR are used together a new operational model appears:

**Data Security Operations.**

DSPM provides posture visibility.

DDR provides runtime detection.

The SIEM provides correlation.

The SOC carries out the investigation and response.

This architecture takes data security out of being only a governance subject and makes it an operational security discipline.

### **The DSPM + DDR + DLP + DAM Architecture**

It is important to separate these concepts from each other.

#### DSPM

Discovers the sensitive data and analyzes its risk posture.

#### DDR

Detects active threats and anomalous behavior towards the data.

#### DLP

Prevents or controls the uncontrolled movement of the data.

#### DAM

Monitors the detailed activity on the database.

When thought of together:

**DSPM → Know the Data**

**DAM → Observe Database Activity**

**DDR → Detect Data Threats**

**DLP → Control Data Movement**

a strong Data Security Architecture is created in this way.

### DDR Response Actions

Detection is not sufficient on its own.

After a high-confidence data threat a response can be required.

For example:

User Session Revoke

Account Disable

Access Permission Remove

File Sharing Link Disable

Download Block

OAuth Token Revoke

Endpoint Isolation

Database Session Terminate

SOC Investigation

actions such as these can be applied.

Response automation must be designed according to the risk level.

### Is Automatic Response Always Correct?

No.

In the case of a false positive the business operation can be affected.

For example a legitimate financial reporting process can run a mass data query.

For this reason:

High Confidence + High Risk

events can receive an automatic response.

Other events can require analyst approval.

This is risk-based automation.

### SOAR and DDR

SOAR can run response workflows for DDR alerts.

For example:

DDR High-Risk Data Exfiltration Alert

↓

Enrich Identity

↓

Check EDR

↓

Check DLP

↓

Check DAM

↓

Disable Session

↓

Open Incident

This can provide automated security orchestration.

### Ransomware Detection with DSPM and DDR

Ransomware affects availability and integrity besides data confidentiality.

DDR:

Mass File Modification

Mass Encryption

Mass Deletion

Unusual Data Access

can detect ransomware activity in a supporting way over behaviors such as these.

DSPM, on the other hand, shows which critical datasets can be affected.

### Data Destruction Detection

A data threat is not only theft.

An attacker the data:

Delete

Encrypt

Modify

Corrupt

can do these.

For this reason DDR must evaluate integrity and availability threats besides confidentiality.

### AI and DSPM

Generative AI adoption is creating new data repositories.

For example:

Vector Databases

Prompt Logs

Training Datasets

Fine-Tuning Data

Agent Memory

AI Knowledge Bases.

DSPM must include these repositories in the Data Security scope.

### What Is AI-SPM?

The concept of AI Security Posture Management or AI-SPM is one of the developing approaches aimed at evaluating the security posture of AI systems.

The intersection with DSPM is especially on the data side.

For example:

Which sensitive dataset does the AI model access?

Is there PII inside the training data?

Is the vector database public?

Which data sources is the agent connected to?

These questions are important in terms of Data Security.

### DSPM and RAG

RAG architecture carries corporate data into the AI model context.

For this reason the retrieval sources must be in the inventory.

DSPM:

Sensitive Documents

Excessive Permissions

Vector Stores

Data Copies

can make risks such as these visible.

### Permission-Aware RAG

A RAG system must not retrieve a document the user does not have access permission to.

For this reason the retrieval engine:

Identity

Document ACL

Classification

Context

must evaluate this information.

DSPM can reduce the AI exposure risk by detecting existing excessive permissions.

### AI Agents and DSPM

An AI Agent can connect to different repositories.

For example:

SharePoint

Database

CRM

Cloud Storage

E-mail.

DSPM can analyze the sensitive data the agent can access.

**This will be critical for the new generation of Agentic Data Security.**

### AI Agents and DDR

An AI Agent can carry out not only data access but autonomous actions.

For this reason DDR must evaluate AI Agent behavior too.

For example:

Agent normally reads 100 documents.

Suddenly it is retrieving 100,000 documents.

This can be unusual activity.

### Agentic Data Detection and Response

In the future DDR will monitor not only human user behavior but AI Agent behavior too.

The questions:

Which data did the agent access?

On behalf of which user did it access it?

Which tool was called?

How much data was retrieved?

Was the data sent to an external destination?

This can form the foundation of the Agentic DDR approach.

### AI Agent Attribution

If an AI Agent uses a service account the actual user context must not be lost.

The ideal telemetry:

End User

↓

AI Agent

↓

Service Identity

↓

Data Resource

↓

Action

must provide a chain in this way.

This is important for accountability.

### Prompt Injection and Data Security

A malicious document or prompt can direct an AI Agent to retrieve sensitive data.

For this reason AI Security is not solved only with prompt filtering.

Agent permissions and data access controls are of critical importance.

DSPM can analyze which data is exposed, DDR the unusual retrieval behavior.

### DSPM and Data Lineage

Data Lineage shows how the data moves between systems.

DSPM can benefit from lineage information in order to understand the downstream copies of sensitive data.

For example:

Production Database

↓

Data Warehouse

↓

BI

↓

CSV Export

↓

Cloud Storage.

Every stage can create a new security risk.

### Attack Path to Data

Traditional attack path analysis:

Attacker → Server.

Data-centric attack path:

Attacker

↓

Compromised Identity

↓

Cloud Role

↓

Storage Permission

↓

Restricted Data.

This model can be more meaningful in terms of Data Security.

### Data Attack Surface Management

DSPM can make the organization's data attack surface visible.

The data attack surface can contain these:

Sensitive Repositories

Public Exposure

Excessive Access

Shadow Copies

Unmanaged Data

Third-Party Access

AI Access

For this reason DSPM can also be evaluated as the data-centric extension of Attack Surface Management.

### Data Exposure Management

The Exposure Management approach takes into account risks other than vulnerabilities too.

DSPM provides data exposure context.

For example:

Vulnerable server

No Sensitive Data

and:

Vulnerable server

Restricted Customer Database

may not have the same remediation priority.

### Data Breach Risk Prioritization

Security teams can meet thousands of findings.

DSPM provides prioritization with data context.

For example:

Critical:

Public + Restricted Data.

High:

External Access + Confidential Data.

Medium:

Internal Excessive Access.

This provides business-driven remediation.

### DSPM and Vulnerability Management

Vulnerability Management finds the technical weakness.

DSPM shows the impacted data.

When these two contexts are combined the vulnerability risk can be calculated more accurately.

### DSPM and Attack Surface Management

External Attack Surface Management finds internet-facing assets.

DSPM finds data assets.

For example an internet-facing database has been found.

If DSPM shows that this database contains Restricted Data the priority increases.

### Third-Party Data Risk

Sensitive data can be inside a third-party SaaS.

DSPM or Data Discovery integrations can take these repositories into the visibility scope.

Third-party access is an important part of data governance.

### External User Risk

An external consultant can access sensitive data.

This can be legitimate.

However, if the access continues after the project finishes a risk is created.

DSPM can identify excessive external access.

DDR can detect unusual external activity.

### OAuth Applications and DSPM

OAuth applications can receive broad permissions to cloud data.

DSPM can evaluate applications as an identity inside the access graph.

This provides machine identity visibility.

### Non-Human Identity Data Risk

Service Accounts

API Clients

Automation Bots

AI Agents

are non-human identities.

These identities can carry out large-scale data access.

A modern DSPM and DDR architecture must definitely cover these.

### The Data Security Posture Changes Continuously

DSPM is not a one-off assessment.

A repository that is secure today tomorrow:

Can be made public.

A new user can receive access.

Sensitive data can be uploaded.

Encryption can be disabled.

For this reason Continuous Data Security Posture Management is required.

### Continuous DSPM

Continuous DSPM analyzes environment changes regularly or continuously.

New Data Store

New Sensitive Data

New External Access

New Public Exposure

New AI Connection

can be detected.

This is important for cloud-native environments.

### How Is a DSPM Project Started?

The first step is to determine the scope.

The priority environments:

Cloud Storage

Databases

SaaS

Microsoft 365

Data Warehouses

Data Lakes

Backups

AI Data Stores

can be these.

Then data discovery is carried out.

### DSPM Implementation Roadmap

A practical DSPM roadmap can be in this way:

#### \1. Data Sources Inventory

Which repositories are present?

#### \2. Sensitive Data Discovery

Which sensitive data types are located there?

#### \3. Classification

How critical is the data?

#### \4. Access Analysis

Who can access it?

#### \5. Exposure Analysis

Is there public, external or excessive access?

#### \6. Risk Scoring

Which findings must be fixed first?

#### \7. Remediation

Permissions, encryption, sharing and retention problems are resolved.

#### \8. Continuous Monitoring

New risks are monitored continuously.

#### \9. DDR Integration

Active data threats are detected at runtime.

#### \10. SOC Integration

Critical events are connected to the operational response process.

### How Must DSPM and DDR Be Established Together?

DSPM can first create the data context.

For example:

Dataset = Restricted.

Owner = Finance.

Access = 12 Users.

Normal Activity = Daily Reporting.

DDR afterwards evaluates the runtime activity over this context.

If a user downloads 3 million records the alert is not only:

"Large Download"

it does not become this.

It turns into this:

**"Data extraction activity of 3 million records outside the normal behavior on the Finance Restricted Dataset."**

This context is much more valuable for the SOC analyst.

### Data Security Risk Register

DSPM findings can be transferred to the risk register.

For example:

Sensitive Data Public Exposure

Unknown Data Owner

Unencrypted Restricted Data

Excessive External Access

Shadow Data

risks such as these can be followed.

This creates a bridge between GRC and technical Data Security.

### KVKK and DSPM

DSPM as a compliance tool does not provide KVKK compliance on its own.

However, personal data being discovered technically where it is located, the access exposure being analyzed and uncontrolled copies being detected can support the data security work within the scope of KVKK.

Especially personal data inventory work and technical Data Discovery can support each other.

However, the legal personal data inventory and the technical data inventory are not the same concept.

This distinction is important.

### KVKK and Shadow Data

The organization can be managing personal data in the official systems.

However, Excel copies created by employees or forgotten backups can remain outside the inventory.

This situation creates a risk in terms of data governance.

Sensitive Data Discovery can help to bring out these hidden copies.

### GDPR and DSPM

In a similar way technical data discovery can be useful in data mapping, minimization, access governance and retention work within the scope of GDPR.

However, a DSPM deployment does not provide legal compliance on its own.

Technology supports the governance process.

### DDR and Data Breach Response

DDR can speed up understanding which data may have been affected during a security incident.

For example:

Which dataset was accessed?

How many records?

Which classification?

Which user?

Did the data go outside?

This information is important for the breach investigation.

### Data Breach Blast Radius

Blast Radius expresses the area of effect of a security incident.

In data-centric incident response these questions are asked:

Which data was affected?

How many people?

Which systems?

Which copies?

Which identities?

The DSPM inventory and DDR telemetry can support this analysis.

### DSPM KPIs

The DSPM programme must be measurable.

Example KPIs:

Sensitive Data Repositories

Sensitive Data Volume

Public Sensitive Data

Externally Shared Sensitive Data

Unencrypted Sensitive Data

Excessive Access Findings

Unknown Data Owners

Shadow Data Repositories

Dark Data Volume

Stale Data Volume

Duplicate Sensitive Data

High-Risk Toxic Combinations

Data Risk Remediation Time

AI Data Stores Discovered

AI Agents with Sensitive Data Access

metrics such as these can be these.

### DDR KPIs

On the DDR side different metrics can be used:

High-Risk Data Events

Bulk Data Access Events

Mass Download Alerts

Unusual Sensitive Data Access

Data Exfiltration Incidents

Insider Threat Data Events

AI Agent Anomalies

Mean Time to Detect

Mean Time to Investigate

Mean Time to Respond

False Positive Rate

Automated Response Rate

These metrics show the Data Security Operations maturity.

### Mean Time to Detect – MTTD

How quickly is a data threat detected?

If an attacker downloads sensitive data for 6 hours the damage can grow.

DDR targets reducing the MTTD.

### Mean Time to Respond – MTTR

How quick is the containment after the detection?

Was the user session revoked?

Was the token disabled?

Was the external sharing closed?

This response speed can reduce the breach impact.

### The Most Frequently Made Mistakes in DSPM

The first mistake is seeing DSPM only as a sensitive data scanner.

Data Discovery is the beginning; the real value is in the access and exposure context.

The second mistake is evaluating all the sensitive data at the same risk level.

The third mistake is ignoring Shadow Data and duplicate copies.

The fourth mistake is isolating DSPM from IAM, DLP, DAM and the SIEM.

The fifth mistake is not determining remediation ownership.

The sixth mistake is looking only at the cloud infrastructure and leaving SaaS and AI data stores out of scope.

The seventh mistake is not including machine identities and AI Agents in the access analysis.

The eighth mistake is creating posture visibility and not establishing a DDR approach for active data threats.

### The Most Frequently Made Mistakes in DDR

The most common mistake in DDR is looking only at the high data volume.

A mass download is not always malicious.

Context is required.

The second mistake is not adding data sensitivity to the behavioral detection.

The third mistake is not creating a baseline for legitimate service accounts.

The fourth mistake is focusing only on human users.

The fifth mistake is not combining DLP, DAM, EDR, IAM and SIEM signals.

The sixth mistake is applying automatic blocking for every anomaly.

The seventh mistake is evaluating the data actions AI Agents can carry out at very high speed with traditional human thresholds.

### DSPM + DDR Checklist

- Are the corporate data repositories in the inventory?
- Are cloud data sources being discovered?
- Are SaaS data sources in scope?
- Is Microsoft 365 data visible?
- Are databases in the inventory?
- Are data warehouses in scope?
- Are data lakes in scope?
- Are backups and snapshots being scanned?
- Is Sensitive Data Discovery being applied?
- Is PII Detection present?
- Is Data Classification being applied?
- Have Data Owners been determined?
- Is public sensitive data being detected?
- Is external sharing being analyzed?
- Is excessive access being detected?
- Are effective permissions being calculated?
- Is Shadow Data being found?
- Is Dark Data being analyzed?
- Is ROT Data being reduced?
- Is Stale Data being detected?
- Is duplicate sensitive data visible?
- Is Orphaned Data being detected?
- Is the encryption posture being checked?
- Is a Data Access Graph being created?
- Are toxic combinations being analyzed?
- Does the risk scoring contain data sensitivity?
- Is DSPM integrated with CSPM?
- Is DSPM integrated with CIEM?
- Is DSPM integrated with DLP?
- Is DSPM integrated with DAM?
- Is a DDR capability present or being evaluated?
- Is bulk sensitive data access being detected?
- Are mass download events being monitored?
- Is unusual data access being analyzed?
- Are there insider threat use cases?
- Is compromised identity context being used?
- Are DAM events being transferred to DDR?
- Are DLP events being transferred to DDR?
- Are EDR risk signals being used?
- Are identity risk signals being used?
- Are DDR alerts being transferred to the SIEM/SOC?
- Are SOAR response workflows defined?
- Is automated containment risk-based?
- Are AI data stores in the inventory?
- Are vector databases being scanned?
- Are prompt logs within the governance scope?
- Are AI Agents visible as an identity?
- Is AI Agent data access being monitored?
- Is agent bulk retrieval being detected?
- Is End User → AI Agent → Data attribution present?
- Can the Data Breach Blast Radius be analyzed?
- Are DSPM KPIs being followed?
- Are DDR KPIs being followed?

### DSPM and DDR Maturity Model

**Level 1 – Lack of Data Visibility: The organization does not know where all of the sensitive data is. Shadow Data is common and access visibility is limited.**

**Level 2 – Data Discovery and Classification: Critical repositories are scanned, sensitive data is discovered and a classification model is applied.**

**Level 3 – Data Security Posture Management: Access exposure, encryption, external sharing, Shadow Data and toxic combinations are analyzed continuously. Risk-based remediation starts.**

**Level 4 – Data Detection and Response: The DSPM context is combined with DAM, DLP, IAM, EDR and SIEM telemetry. Active data threats are detected behaviorally and connected to the SOC processes.**

**Level 5 – Adaptive Data Security Operations: Human, machine and AI Agent data access is evaluated continuously. DSPM + DDR + DLP + DAM + IAM + SIEM + SOAR work together and adaptive response is applied for high-confidence threats.**

The maturity transformation can be summarized in this way:

#### Data Discovery

↓

#### Data Classification

↓

#### DSPM

↓

#### DDR

↓

#### Adaptive Data Security Operations

### Frequently Asked Questions

#### What is DSPM?

DSPM is the abbreviation of the expression Data Security Posture Management. It is the data-centric security approach that analyzes where corporate sensitive data is located, who can access it and which security exposures it has.

#### What does Data Security Posture Management do?

It provides Sensitive Data Discovery, Data Classification, access analysis, Shadow Data discovery, exposure detection and risk prioritization.

#### What is DDR?

DDR is the abbreviation of the expression Data Detection and Response. It is the Data Security approach that focuses on unusual access to sensitive data, bulk data extraction, insider threat and possible data exfiltration activities being detected and response processes being started.

#### What is the difference between DSPM and DDR?

DSPM analyzes where the data is and why it is at risk. DDR, on the other hand, supports the response processes by detecting active and unusual behaviors towards sensitive data.

#### What is the difference between DSPM and DLP?

DSPM provides sensitive data posture and exposure visibility. DLP focuses on detecting or preventing the uncontrolled movement of the data.

#### What is the difference between DDR and DLP?

While DLP provides more policy-based data movement control DDR focuses on behavioral data threat detection and response.

#### What is the difference between DAM and DDR?

DAM monitors database activity in detail. DDR evaluates the threat signals on different data sources including the database in a wider data-centric detection and response context.

#### What is Shadow Data?

Shadow Data is data repositories or data copies over which the security or governance teams do not have sufficient visibility.

#### What is Dark Data?

Dark Data is data stored by the organization but not used actively or whose business value is uncertain.

#### What is ROT Data?

ROT Data is the general name of Redundant, Obsolete and Trivial data.

#### What is a Data Access Graph?

A Data Access Graph is the model that shows the permission relationships between users, groups, applications, service accounts and data resources.

#### What is a Toxic Combination?

It is sensitive data meeting more than one risk such as public access, excessive permission or no encryption at the same time.

#### What is the difference between DSPM and CSPM?

While CSPM focuses on the cloud infrastructure configuration posture DSPM focuses on data sensitivity, data location and access exposure.

#### What is the difference between DSPM and CIEM?

CIEM analyzes cloud identities and entitlements. DSPM helps to understand which sensitive data these permissions provide access to.

#### Does DSPM provide KVKK compliance?

It does not provide it on its own. However, it can support personal data being discovered technically, uncontrolled copies being found, the access exposure being analyzed and data minimization work.

#### Can DDR be used in insider threat detection?

Yes. Events such as an authorized user deviating from their normal behavior and accessing a large amount of sensitive data or extracting data can be evaluated within the DDR scope.

#### Does DDR take the place of the SIEM?

No. DDR produces data-centric threat signals. The SIEM can support the SOC operation by correlating these with endpoint, network, identity and other security telemetry.

#### Why is DSPM important in AI systems?

AI applications can create new datasets, vector databases, prompt logs and knowledge bases. DSPM can make the sensitivity and exposure risk of these data repositories visible.

#### Is DDR necessary for an AI Agent?

Because AI Agents can retrieve and transfer data at a very high speed agent behavior monitoring is one of the important use cases of the new generation of DDR.

#### Must DSPM and DDR be used together?

**In terms of modern Data Security this is the strong approach. DSPM makes visible which data is at risk, DDR the active risky behaviors towards that data.**

### Conclusion: DSPM Makes the Risk of the Data Visible, DDR the Active Threat Towards the Data

The biggest problem of modern Data Security is not only that there is too much data.

The real problem is the data's:

where it is located,

how many copies of it there are,

who can access it,

which applications use it,

which AI Agents can process it

not being known exactly.

DSPM focuses on solving this visibility problem.

First the sensitive data is found.

Then it is classified.

The access relationships are analyzed.

Shadow Data is brought out.

Public exposure is found.

Excessive permissions are detected.

The encryption posture is evaluated.

Toxic combinations are prioritized.

However, Data Security does not end here.

Because even if the posture is secure the identity can be compromised.

An insider can behave maliciously.

A service account can be taken over.

An AI Agent can carry out an unexpected action.

**For this reason the second stage is the DDR – Data Detection and Response approach.**

DDR asks this question:

**"What is happening to our sensitive data right now?"**

For this reason it is possible to say that modern Data Security Architecture is gradually proceeding towards this structure:

#### Data Discovery

↓

#### Data Classification

↓

#### DSPM

↓

**DAM + DLP + Identity Telemetry**

↓

#### DDR

↓

#### SIEM / SOC

↓

#### SOAR / Response

**In this architecture DSPM provides the security team with the data risk posture.**

DAM shows the database behavior.

DLP controls the data movement.

Identity Security shows who accesses it.

EDR provides the endpoint context.

DDR helps to detect active threats over all these data-centric signals.

The SIEM and the SOC, on the other hand, carry out the investigation and response process of the event.

With AI and Agentic AI systems becoming widespread this model will become even more critical.

Because the data security of the future will not answer only:

**"Which employee accessed which file?"**

this question.

At the same time:

**"Which AI Agent working on behalf of which user accessed which sensitive dataset over which service identity, how much data did it retrieve, which action did it carry out with this data and was the behavior normal?"**

it will have to answer this question too.

For this reason the Data Security approach of the future is not static data protection but:

**Continuous Data Security Posture + Continuous Data Threat Detection + Automated Response**

it is proceeding towards this model.

And the most important sentence of this chapter:

**While DSPM makes visible where the sensitive data is, who can access it and why it is at risk; DDR – Data Detection and Response forms the detection and response layer of modern Data Security Operations by detecting the unusual access, bulk data extraction, insider threat, compromised identity and AI Agent originated active threats towards this data.**