Data security posture management (DSPM) is software that searches every system in a company for sensitive data, labels what it finds, and checks whether that data is properly protected. The finding and labelling part is called data discovery and classification. Posture here means the security state of the data: where it is, who can open it, and whether it is encrypted.
A company cannot protect data that it does not know it has, and copies multiply. A database is copied for testing. A report is exported to a spreadsheet. A file is shared to a personal drive. DSPM connects to databases, cloud storage, file servers, email and business apps, and reads what is inside them. Data in database tables is called structured data. Documents, emails and chat messages are called unstructured data.
Here is a typical case. A microfinance lender in Bhubaneswar runs a DSPM scan across its cloud account and its shared drives. In a storage folder created two years ago for testing, the scan finds a full copy of the loan database: 3.4 lakh borrowers' names, Aadhaar numbers and bank account numbers. Nobody in the current team knew that this copy existed. The scan also finds 620 spreadsheets on the shared drive that contain Aadhaar numbers.
How does DSPM recognise an Aadhaar number? A 12-digit number alone is not enough, because phone numbers, order numbers and amounts are also made of digits. So the tool checks more. A real Aadhaar number does not begin with 0 or 1, and its last digit is a check digit, calculated from the other eleven. Words such as "Aadhaar" or "UID" near the number raise the tool's confidence further. For documents such as contracts, newer tools use language models, which recognise a contract from its content without anyone writing a pattern for it.
After labelling, DSPM checks the posture. The test copy is not encrypted, and 85 employees can open it. UIDAI, the authority that issues Aadhaar, requires every company that verifies customers through Aadhaar authentication or e-KYC, as this lender does, to keep Aadhaar numbers only in a separate, encrypted store, called an Aadhaar Data Vault. So the lender's team deletes the test copy, and replaces the Aadhaar numbers in the spreadsheets with tokens.
DSPM's labels are used by other tools. Data loss prevention (DLP) uses them to decide what must not leave. Data protection uses them to decide which fields to encrypt, tokenise or mask. Privacy management uses them to build its map of personal data. The part of DSPM that maps who can open each folder is data access governance.
DSPM is often compared with cloud security posture management (CSPM). CSPM checks the settings of cloud accounts, such as a storage bucket left open to the internet. DSPM checks the data inside: what it is and who can reach it. DSPM can also read a data catalog, the list of tables that analysts use, to find databases faster.