✳ Atlas Fold / DLP / DSPM

DLP / DSPM, unfolded.

Data protection & posture

← All segments Read the field guide ↗Method & limitations ↗

Atlas Fold / DLP / DSPM / First edition

Data protection & posture

Provisional editorial research based on public documentation, not tested effectiveness.

First edition · Reviewed 2026-09-21· Rubric 1.1

Six dimensions, each scored 0.0–5.0 in tenths. Gaps stay visible.

Comparable discovery, classification, and data-security posture (DSPM/access-posture) offerings. Microsoft Purview is assessed on classifiers, sensitivity labeling as classification, and Data Security Posture Management only. This cohort does not compare enterprise DLP suites or equate cloud DSPM with channel DLP enforcement. Forcepoint, Proofpoint, Symantec, Netskope, and Zscaler DLP are excluded as peers.

Download JSON

Six dimensions, with gaps listed

Each row is one 0.0–5.0 dimension. Every assessed offering has a consistent color, shape, and number. Numbers identify offerings, not rank. Unknown scores are omitted.

Separate overlapping marks

Separated marks connect to their exact positions. Separation does not change scores.

Momentum: building history. Numbers identify offerings, not rank; lines between dimensions are profiles, not time.

A position is only half the story

Momentum

Building history

Baseline recorded 2026-09-21. A second comparable review is needed to show movement.

Own movement is the score change. Relative movement subtracts the median change of matched peers, excluding this offering. Dimensions stay separate.

Microsoft Purview Data Security· movement by dimension
Dimension	Own movement	Against peers
Operational maturity	Building history	Not available yetNo direction inferred
Shipped innovation	Building history	Not available yetNo direction inferred
Capability breadth	Building history	Not available yetNo direction inferred
Ecosystem & integration	Building history	Not available yetNo direction inferred
Governance & control	Building history	Not available yetNo direction inferred
Operator enablement	Building history	Not available yetNo direction inferred

History appears as a hollow earlier mark connected to the current solid mark in Unfold and Overview. Profile lines between dimensions do not show time. Numbers identify offerings, not rank.

Review history & what changed

The 2026-09-21 baseline incorporates the six-dimension review. Decimal calibration and research corrections are not product momentum. Unknowns stay unknown.

2026-09-21 · baseline · rubric 1.1 · Starting point; no movement inferred.

How momentum is calculated →

Documented scores

Varonis Data Security Platform (medium confidence) has the highest documented score (4.7) for Operational maturity among assessed offerings in this comparison group. 2 offerings remain unknown for this dimension.

Microsoft Purview Data Security (low confidence) and Varonis Data Security Platform (low confidence) and Cyera Data Security (low confidence) and BigID (low confidence) are tied at documented score 3.0 for Shipped innovation among assessed offerings in this comparison group. No distinction is evidenced among the scored offerings.

Unknowns and gaps

Unknown is not low quality. Marks are omitted where a required score is unknown.

Microsoft Purview Data Security: no unknown dimensions.
Varonis Data Security Platform: Operator enablement
Cyera Data Security: Operational maturity, Governance & control, Operator enablement
BigID: Operational maturity, Governance & control, Operator enablement

Scenario lens

A scenario highlights priorities and validation questions only. It does not rewrite scores or claim eligibility.

Selected evidence

Microsoft Purview Data Security · Microsoft

Microsoft Purview Information Protection classifiers and current Data Security Posture Management (not classic DSPM, not DLP-suite comparison) · Assessed 2026-09-21 · Research preview

Operational maturity

How completely do public docs describe safeguards operators use to run discovery and posture without treating marketing claims as proof of reliability?

Documented operating safeguards for running discovery and posture: connector or collector permissions, tenant isolation, encryption of metadata, operator roles, and operational limits. Not vendor age, uptime, or claimed reliability.

Purview documents SITs, trainable classifiers, labels, and current DSPM objectives that correlate Microsoft 365 posture with partner-fed non-Microsoft stores. This assessment covers classification and DSPM only; DLP, Insider Risk, and encryption are adjacent and not scored as peers.

Score4.0 / 5.0medium confidence

Rationale and sources

Learn docs list supporting licenses, Purview permissions, Copilot and Fabric prerequisites, and administrative-unit scoping that hides other units from restricted admins. Inactive tenants pause Microsoft 365 DSPM refresh after 60 days and resume on return. That matches documented operational safeguards (anchor 4). Shared-responsibility residency and tenant incident notification for DSPM itself are not documented here, so not anchor 5. The Data Security Posture Agent is preview and is not used as a safeguard.

Constraints

Edition scoped to Information Protection classifiers/labels and current DSPM; DLP, Insider Risk Management, Information Barriers, Privileged Access Management, and Customer Key or Double Key Encryption are adjacent and not compared as DLP-suite peers.
Prerequisite: supporting Purview license, supported region, and Purview permissions; Copilot, Fabric, Edge, and Entra-registered AI apps have additional documented prerequisites.
Microsoft locations in asset explorer currently include Microsoft 365 only; GCP, Snowflake, Databricks and similar stores depend on partner integrations.
Data Security Posture Agent and Sentinel data lake partner setup are preview; they are not treated as GA.
Classic DSPM and DSPM for AI remain available but are not the evaluated edition.
Classification and posture coverage by workload is license-dependent and unverified in a lab.
Innovation stages reflect contemporary baseline evidence; no workflow differentiation beyond the shared baseline was established in this first edition.

Sources

Learn about Microsoft Purview Data Security Posture Management (DSPM) · documentation · Accessed 2026-09-21
Considerations for deploying Microsoft Purview Data Security Posture Management · documentation · Accessed 2026-09-21

0–5 rubric anchors

0 — Primary evidence affirmatively establishes that the evaluated scope does not provide operating safeguards for the scoped assessment workflow. Missing evidence is unknown, never zero.
1 — A concrete basic operating safeguard is documented for the evaluated edition.
2 — License or permission prerequisites and a basic administrator role for the console are documented.
3 — A connector or collector permission model plus encryption in transit or tenant isolation for metadata is documented.
4 — Operational safeguards such as admin-unit scoping, operator audit, inactivity handling, or in-network collectors that do not persist customer content are documented.
5 — An end-to-end operating program is documented, including residency choice, tenant incident notification, reversible remediations, and shared-responsibility operator controls.

Assessed offerings inDiscovery, classification, and access posture. Unknown means not scored, not low quality.
Offering	Operational maturity	Shipped innovation	Capability breadth	Ecosystem & integration	Governance & control	Operator enablement
Microsoft Purview Data Security	4.0 (medium)	3.0 (low)	3.0 (medium)	4.0 (medium)	4.0 (medium)	4.0 (medium)
Varonis Data Security Platform	4.7 (medium)	3.0 (low)	4.0 (low)	4.0 (medium)	3.0 (medium)	Unknown
Cyera Data Security	Unknown	3.0 (low)	4.0 (low)	4.0 (medium)	Unknown	Unknown
BigID	Unknown	3.0 (low)	4.0 (low)	4.0 (medium)	Unknown	Unknown

All comparison groups and evidence

Interactive controls require JavaScript. Every assessment remains available below, grouped by comparable scope.

Discovery, classification, and access posture

Discovery, classification, and access posture · independent 0.0–5.0 scores; unknown is not zero.
Offering	Operational maturity	Shipped innovation	Capability breadth	Ecosystem & integration	Governance & control	Operator enablement
Microsoft Purview Data Security	4.0 (medium)	3.0 (low)	3.0 (medium)	4.0 (medium)	4.0 (medium)	4.0 (medium)
Varonis Data Security Platform	4.7 (medium)	3.0 (low)	4.0 (low)	4.0 (medium)	3.0 (medium)	Unknown
Cyera Data Security	Unknown	3.0 (low)	4.0 (low)	4.0 (medium)	Unknown	Unknown
BigID	Unknown	3.0 (low)	4.0 (low)	4.0 (medium)	Unknown	Unknown

Microsoft Purview Data Security · Microsoft Purview Information Protection classifiers and current Data Security Posture Management (not classic DSPM, not DLP-suite comparison)

Assessed 2026-09-21 · Research preview

Edition scoped to Information Protection classifiers/labels and current DSPM; DLP, Insider Risk Management, Information Barriers, Privileged Access Management, and Customer Key or Double Key Encryption are adjacent and not compared as DLP-suite peers.
Prerequisite: supporting Purview license, supported region, and Purview permissions; Copilot, Fabric, Edge, and Entra-registered AI apps have additional documented prerequisites.
Microsoft locations in asset explorer currently include Microsoft 365 only; GCP, Snowflake, Databricks and similar stores depend on partner integrations.
Data Security Posture Agent and Sentinel data lake partner setup are preview; they are not treated as GA.
Classic DSPM and DSPM for AI remain available but are not the evaluated edition.
Classification and posture coverage by workload is license-dependent and unverified in a lab.
Innovation stages reflect contemporary baseline evidence; no workflow differentiation beyond the shared baseline was established in this first edition.

Operational maturity: 4.0 / 5.0 · medium confidence

Learn about Microsoft Purview Data Security Posture Management (DSPM) · documentation · Accessed 2026-09-21
Considerations for deploying Microsoft Purview Data Security Posture Management · documentation · Accessed 2026-09-21

Shipped innovation: 3.0 / 5.0 · low confidence

The cited pages support native sensitivity, oversharing and data-posture investigation within current DSPM, excluding adjacent DLP-policy creation, matching contemporary cohort baseline workflows (stage 3). No supported difference beyond that shared baseline is established. This is not a novelty or superiority claim; preview, beta, AI branding and unverified agentic features are excluded.

Learn about Microsoft Purview Data Security Posture Management (DSPM) · documentation · Accessed 2026-09-21

Capability breadth: 3.0 / 5.0 · medium confidence

Classifiers and DSPM cover Microsoft 365 discovery, labels, and access or oversharing assessments, and docs name Azure, Fabric, and partner-fed SaaS or IaaS such as GCP, Snowflake, and Databricks. Asset explorer currently lists Microsoft locations as Microsoft 365 only, with non-Microsoft locations depending on partner integrations. That is more than one store class (anchor 3), not independently verified native IaaS plus on-prem plus AI-store GA coverage (not 4 or 5).

Ecosystem & integration: 4.0 / 5.0 · medium confidence

DSPM consolidates signals from labels and other Purview solutions and names partner integrations with Varonis, Cyera, BigID, and OneTrust for non-Microsoft risk insights. That is a specific peer-DSPM and label partner list (anchor 4). Sentinel data lake setup for partners is described as preview and is not counted. A full operator connector matrix is not published here (not anchor 5).

Learn about Microsoft Purview Data Security Posture Management (DSPM) · documentation · Accessed 2026-09-21

Governance & control: 4.0 / 5.0 · medium confidence

Classification and DSPM use Purview role groups and least-privilege roles; administrative units restrict reports, explorers, and policies; unrestricted admins are required to create one-click policies. RBAC for AI content and audited agent actions are documented. That is segmented administration with constrained policy creation (anchor 4). Tenant residency and owner risk-acceptance workflows for DSPM findings are not documented on these pages (not anchor 5).

Considerations for deploying Microsoft Purview Data Security Posture Management · documentation · Accessed 2026-09-21
Classifiers overview · documentation · Accessed 2026-09-21

Operator enablement: 4.0 / 5.0 · medium confidence

The Purview portal walkthrough documents setup tasks, Posture and Objectives pages, asset explorer, activity explorer (including known display issues), reports, and remediation-action policies. Operators get guided outcome workflows plus known-issue notes (anchor 4). Exportable evidence and a complete public runbook kit beyond Learn articles are not verified (not anchor 5).

Varonis Data Security Platform · Varonis Data Security Platform DSPM (discovery, classification, access intelligence)

Varonis documents classification plus an access graph that includes nested groups and sharing links, with automated permission cleanup on supported stores. Public trust docs describe in-network collectors and metadata-only cloud storage. Channel DLP enforcement is an integration, not this cohort's comparison.

Assessed 2026-09-21 · Research preview

Evaluated as DSPM/discovery/access-intelligence; Varonis DLP policy enforcement is described as a Microsoft Purview integration and is not a DLP-suite comparison.
On-premises collectors are a customer-operated prerequisite; customers must patch, restrict access, and encrypt collector disks per the shared-responsibility list.
Optional File Analysis and AI Monitoring (Copilot, AgentForce, ChatGPT Enterprise) are separate roles or data sources; AI prompt retention is documented as 180 days when enabled.
Coverage logos are not a verified connector inventory; per-store permission completeness is unverified.
MDDR is a managed service overlay and is not scored as product posture.
Classification accuracy percentages are vendor claims and are not scored.
Innovation stages reflect contemporary baseline evidence; no workflow differentiation beyond the shared baseline was established in this first edition.
Unknown dimensions reflect incomplete evidence for cumulative stage requirements, not proof that capabilities are absent.

Operational maturity: 4.7 / 5.0 · medium confidence

Anchor 4 remains supported by in-network collection, metadata encryption and tenant isolation. The platform trust documentation additionally establishes tenant-location choice, tenant incident notification and customer operating responsibilities. These earn 0.7 under the shared rubric. Reversal procedures for posture remediations are not established, leaving 0.3 uncredited; backup restoration is not treated as reversing a permissions change.

Varonis Security Standards and Practices · documentation · Accessed 2026-09-21

Shipped innovation: 3.0 / 5.0 · low confidence

The cited pages support sensitivity/access correlation and permissions-remediation workflows, matching contemporary cohort baseline workflows (stage 3). No supported difference beyond that shared baseline is established. This is not a novelty or superiority claim; preview, beta, AI branding and unverified agentic features are excluded.

Varonis Data Security Posture Management (DSPM) · documentation · Accessed 2026-09-21
Varonis Data Discovery and Classification · documentation · Accessed 2026-09-21

Capability breadth: 4.0 / 5.0 · low confidence

Product pages document structured databases and warehouses, unstructured files and buckets, and semi-structured SaaS and email, plus on-prem file storage, IaaS, and named coverage for Microsoft 365, AWS, Azure, Google Cloud, Salesforce, Box, Snowflake, Databricks, and Windows file shares. That spans structured and unstructured across cloud or SaaS plus on-prem or IaaS (anchor 4). Per-connector GA depth and AI-store modules are not verified from public coverage tiles (not anchor 5).

Ecosystem & integration: 4.0 / 5.0 · medium confidence

Varonis documents Microsoft Purview Information Protection labeling and downstream DLP handoff, plus a web API for SIEM, SOAR, and data warehouses using API keys. Coverage pages name many stores. That is a named label platform plus SIEM/SOAR API (anchor 4). A public operator matrix with configuration steps for each integration is not in the reviewed pages (not anchor 5).

Governance & control: 3.0 / 5.0 · medium confidence

Customer-facing API permissions document departmental RBAC and least-privilege roles; classification guidance documents configurable policy objects and label enforcement. These support stage 3. The earlier stage-4 rationale established segmentation but not an operator audit of posture remediations together with reversal or owner approval. Provider-internal change approvals and backup restoration do not fill those customer-workflow requirements. This is a baseline research correction, not a product regression.

Varonis Data Discovery and Classification · documentation · Accessed 2026-09-21
Varonis Security Standards and Practices · documentation · Accessed 2026-09-21

Operator enablement: Unknown · low confidence

The cited product pages describe dashboards and recommended actions, but this evidence set does not verify the public setup path required by earlier cumulative stages. Operator enablement remains unknown; documentation access is not treated as product quality.

Cyera Data Security · Cyera DSPM (agentless discovery, classification, exposure, and posture remediation)

Cyera documents agentless DSPM with AI-native classification, exposure scoring, and owner-routed or security-led remediation. Omni DLP and Cyera Identity after the Oasis closing are separate modules and are not treated as DSPM completeness. Identity integration evidence remains limited to the acquisition notice.

Assessed 2026-09-21 · Research preview

Cohort is Cyera DSPM only. Omni DLP, Agent Guardian, Access Trail, and DataWatcher managed services are separate and are not DLP-suite or managed-service comparisons.
Oasis Security acquisition completed 3 September 2026; Cyera Identity is described as the going-forward identity pillar. Acquisition does not verify every identity integration as GA in DSPM.
Owner-portal OTP and SSO authentication are documented as beta.
In-place versus SaaS deployment, sampling versus full scans, and per-store API permissions are unverified.
Customer outcome metrics (precision, petabytes, issue counts) are not scored.
Email, network, and endpoint coverage on the platform page is not treated as DSPM breadth.
Innovation stages reflect contemporary baseline evidence; no workflow differentiation beyond the shared baseline was established in this first edition.
Unknown dimensions reflect incomplete evidence for cumulative stage requirements, not proof that capabilities are absent.

Operational maturity: Unknown · low confidence

The cited pages describe in-place processing and logged owner actions. They do not verify the collector permission model and metadata safeguards required by the cumulative stage rubric. These safeguards are unknown, not absent.

Cyera Data Security Posture Management · documentation · Accessed 2026-09-21
Cyera Remediation Center and remediation paths · documentation · Accessed 2026-09-21

Shipped innovation: 3.0 / 5.0 · low confidence

The cited pages support sensitivity/access context with data-owner remediation queues, matching contemporary cohort baseline workflows (stage 3). No supported difference beyond that shared baseline is established. This is not a novelty or superiority claim; preview, beta, AI branding and unverified agentic features are excluded.

Cyera Data Security Posture Management · documentation · Accessed 2026-09-21
Cyera Remediation Center and remediation paths · documentation · Accessed 2026-09-21
Cyera completes acquisition of Oasis Security · documentation · Accessed 2026-09-21

Capability breadth: 4.0 / 5.0 · low confidence

DSPM and platform pages document agentless coverage of cloud, SaaS, DBaaS, and on-prem stores, with named examples including AWS, Azure, Google Cloud, Snowflake, Databricks, and Salesforce, and structured plus unstructured classification. That matches structured/unstructured across cloud or SaaS plus on-prem or IaaS (anchor 4). Email, network, and endpoint tiles on the platform page are adjacent to Omni DLP and are not counted as DSPM breadth. Per-connector GA depth is unverified (not anchor 5).

Cyera Data Security Posture Management · documentation · Accessed 2026-09-21
Cyera platform overview · documentation · Accessed 2026-09-21

Ecosystem & integration: 4.0 / 5.0 · medium confidence

Existing multicloud/SaaS, ticketing and labeling handoffs remain supported. The official integration catalog explicitly labels Splunk and automation partners as DSPM integrations and describes their data handoffs, meeting stage 4. Omni DLP-only entries are excluded. The catalog does not supply the complete operator configuration matrix needed for stage 5.

Cyera Data Security Posture Management · documentation · Accessed 2026-09-21
Cyera Remediation Center and remediation paths · documentation · Accessed 2026-09-21
Cyera integration catalog with DSPM module labels · product · Accessed 2026-09-21

Governance & control: Unknown · low confidence

The source describes owner responses, risk acceptance and logged remediation. Console RBAC and least-privilege administration required by earlier cumulative stages were not verified; beta owner authentication is excluded. Governance remains unknown.

Cyera Remediation Center and remediation paths · documentation · Accessed 2026-09-21

Operator enablement: Unknown · low confidence

The cited pages describe scan status and owner queues, but the earlier setup-path stage and its operator prerequisites were not verified from this evidence set. Operator enablement remains unknown; certification availability alone does not fill that gap.

BigID · BigID discovery, classification, and DSPM (access-posture and delegated remediation)

BigID documents discovery and classification as the inventory for DSPM, access governance, privacy, and AI-data workflows, with policy-driven access remediation and owner delegation. Public product pages are marketing-dense; connector depth, encryption, and tenant isolation were not verified. Cloud DLP is adjacent, not this cohort.

Assessed 2026-09-21 · Research preview

Assessment is discovery, classification, and DSPM/access-posture. Listed cloud DLP, privacy automation, and catalog enrichment are adjacent modules, not DLP-suite comparison.
Connector coverage, scan completeness, and sampling versus full reads are unverified.
Tenant isolation, encryption, and console RBAC were not found on the public product pages reviewed.
Agentic remediation GA versus preview is not independently confirmed.
Classification accuracy rankings and analyst-firm placements are not scored.
Destructive actions (delete, redact) need an explicit lab check before use.
Innovation stages reflect contemporary baseline evidence; no workflow differentiation beyond the shared baseline was established in this first edition.
Unknown dimensions reflect incomplete evidence for cumulative stage requirements, not proof that capabilities are absent.

Operational maturity: Unknown · low confidence

The cited pages establish posture dashboards and remediation cases, but do not verify the permission prerequisites and administrator role required by stage 2 or the collector safeguards required by later stages. A dashboard is not evidence of those controls; the operating-safeguard assessment remains unknown.

BigID Data Security Posture Management · documentation · Accessed 2026-09-21

Shipped innovation: 3.0 / 5.0 · low confidence

The cited pages support discovery, classification, access context and delegated remediation, matching contemporary cohort baseline workflows (stage 3). No supported difference beyond that shared baseline is established. This is not a novelty or superiority claim; preview, beta, AI branding and unverified agentic features are excluded.

BigID Data Security Posture Management · documentation · Accessed 2026-09-21
BigID Data Discovery and Classification · documentation · Accessed 2026-09-21

Capability breadth: 4.0 / 5.0 · low confidence

Discovery and DSPM pages document structured, unstructured, and semi-structured sources across cloud, SaaS, on-prem, hybrid, data lakes, and AI-connected data, including PII, PHI, PCI, secrets, and IP. That is structured and unstructured across cloud or SaaS plus on-prem (anchor 4). A public GA connector inventory for IaaS, databases, and AI stores was not verified (not anchor 5).

BigID Data Security Posture Management · documentation · Accessed 2026-09-21
BigID Data Discovery and Classification · documentation · Accessed 2026-09-21

Ecosystem & integration: 4.0 / 5.0 · medium confidence

Discovery/posture sources establish multicloud and SaaS coverage with labeling/remediation handoffs. The DSPM integration overview names Microsoft Purview, Splunk and ServiceNow and describes an API-first integration model, meeting the named-partner requirement at stage 4. This does not verify installation procedures, per-connector permissions or the complete matrix required for stage 5.

BigID Data Security Posture Management · documentation · Accessed 2026-09-21
BigID Data Discovery and Classification · documentation · Accessed 2026-09-21
BigID DSPM and Microsoft Purview integration overview · product · Accessed 2026-09-21

Governance & control: Unknown · low confidence

The cited pages describe ownership and delegated remediation but do not verify console RBAC, least-privilege roles and segmented administration required by the cumulative rubric. Revoke, redact and delete actions have no verified rollback here and are not described as reversible. Governance remains unknown.

BigID Data Security Posture Management · documentation · Accessed 2026-09-21

Operator enablement: Unknown · low confidence

Product pages describe dashboards and remediation cases, but the public setup path and operator runbooks required by the cumulative rubric were not verified. Operator enablement remains unknown rather than inferred from marketing pages.

BigID Data Security Posture Management · documentation · Accessed 2026-09-21
BigID Data Discovery and Classification · documentation · Accessed 2026-09-21

Not yet assessed

Unknown is explicitly not low quality. These catalog offerings have no Atlas Fold scores.

Securiti AI within Veeam · Securiti AI
Forcepoint DLP · Forcepoint
Proofpoint Enterprise DLP · Proofpoint
Symantec Data Loss Prevention · Symantec Enterprise
Netskope One DLP · Netskope
Zscaler Data Loss Prevention · Zscaler
Nightfall AI · Nightfall AI
Rubrik Security Cloud DSPM · Rubrik
IBM Guardium Data Security · IBM
Thales Imperva Data Security Fabric · Imperva

Research notes

First edition dated 2026-09-21; no historical assessments are available.

The four selected existing-catalog offerings form one explicitly scoped cohort. Assessment applies only to named editions and documented modules; adjacent products and managed-service outcomes are excluded.

Primary sources establish documented capabilities and their prerequisites, not actual effectiveness, reliability, deployment effort, staffing savings or return on investment.

Confidence reflects evidence and inference within the stated scope, not vendor size, age or source count.

Contemporary cohort baseline: Discovery, classification, sensitivity/access/exposure correlation, data-owner context, posture prioritization, and owner-routed or automated remediation are contemporary DSPM baseline capabilities. Access graphs, risk scores, AI labels and remediation queues alone do not establish differentiation.

Innovation stage 3 indicates supported baseline workflows, not market novelty. No stage 4 or 5 differentiation is established by this first-edition evidence. Public-documentation confidence is low for cross-offering calibration.

Zero requires affirmative evidence of absence. Missing, gated or incomplete documentation remains unknown; a lower stage is not assigned merely because documentation is unavailable.

Scores were checked against cumulative stage prerequisites; selected operating/control cells remain unknown where those prerequisites could not be verified.

Rubric 1.1 divides the new maturity anchor 5 requirements into residency choice (two tenths), tenant incident notification (two), reversible remediation (three), and shared-responsibility operator controls (three). Reversibility and ongoing customer control receive the larger shares because they directly govern safe operation; these are shared editorial weights, not measured performance. Purview receives no extra credit from adjacent services or preview agents. Cyera and BigID operating safeguards remain unknown. Documented baseline innovation stays tied at 3.0.

All six dimensions were reviewed for the 2026-09-21 momentum baseline. Source-backed corrections and retained evidence gaps are recorded in docs/research/2026-09-21-momentum-baseline-a.md. These are baseline research decisions, not longitudinal vendor movement; unknowns remain unknown and the rubric/edition scopes are unchanged.

How to read these scores

Scores use tenths from 0.0 to 5.0 against published anchors. Fractional scores credit documented requirements toward the next anchor; the inspector exposes the calculation. Equal evidence can still produce a tie. Null means unknown and is never treated as zero. Views never average or blend dimensions into an overall winner. Cohort membership is the only comparison boundary.

What this edition covers.

First edition · reviewed 2026-09-21 · rubric 1.1. Historical movement will require later dated assessments; no trajectory is inferred from this snapshot.

First edition dated 2026-09-21; no historical assessments are available.
The four selected existing-catalog offerings form one explicitly scoped cohort. Assessment applies only to named editions and documented modules; adjacent products and managed-service outcomes are excluded.
Primary sources establish documented capabilities and their prerequisites, not actual effectiveness, reliability, deployment effort, staffing savings or return on investment.
Confidence reflects evidence and inference within the stated scope, not vendor size, age or source count.
Contemporary cohort baseline: Discovery, classification, sensitivity/access/exposure correlation, data-owner context, posture prioritization, and owner-routed or automated remediation are contemporary DSPM baseline capabilities. Access graphs, risk scores, AI labels and remediation queues alone do not establish differentiation.
Innovation stage 3 indicates supported baseline workflows, not market novelty. No stage 4 or 5 differentiation is established by this first-edition evidence. Public-documentation confidence is low for cross-offering calibration.
Zero requires affirmative evidence of absence. Missing, gated or incomplete documentation remains unknown; a lower stage is not assigned merely because documentation is unavailable.
Scores were checked against cumulative stage prerequisites; selected operating/control cells remain unknown where those prerequisites could not be verified.
Rubric 1.1 divides the new maturity anchor 5 requirements into residency choice (two tenths), tenant incident notification (two), reversible remediation (three), and shared-responsibility operator controls (three). Reversibility and ongoing customer control receive the larger shares because they directly govern safe operation; these are shared editorial weights, not measured performance. Purview receives no extra credit from adjacent services or preview agents. Cyera and BigID operating safeguards remain unknown. Documented baseline innovation stays tied at 3.0.
All six dimensions were reviewed for the 2026-09-21 momentum baseline. Source-backed corrections and retained evidence gaps are recorded in docs/research/2026-09-21-momentum-baseline-a.md. These are baseline research decisions, not longitudinal vendor movement; unknowns remain unknown and the rubric/edition scopes are unchanged.

Discovery, classification, and access posture

Browse every product profile ↗Download research & sources ↓

DLP / DSPM, unfolded.

Data protection & posture

Six dimensions, with gaps listed

Missing evidence for this view

Momentum

Documented scores

Unknowns and gaps

Scenario lens

Rationale and sources

How this score is built

Constraints

Sources

0–5 rubric anchors

Not yet assessed

What this edition covers.

Discovery, classification, and access posture

Find your next idea.