Launch prototype. Scores, references, and figures shown are illustrative until first publication.
VendorAudit
VendorAudit
Market Pulse Profiles Compare How to buy Reviews Methodology Newsletter
Subscribe
Category Data Security AI Security Cloud Security Coming Identity Coming
Data security category · Live · 21 vendors covered · Updated continuously

Data security: the cyber category most enterprises buy badly.

Independent research on the twenty-one data security platforms — DSPM, DLP, AI-SPM, and access governance — that protect every enterprise's most valuable asset. Vendor by vendor, score by score, sharp where it needs to be.

21 vendors profiled 11 capability criteria 8 company-health signals Editorially independent
What practitioners are saying
More practitioner commentary →
Covered vendors
Microsoft Purview Cyera Varonis BigID Sentra Securiti Immuta Privacera AWS Macie Google CDLP Symantec Forcepoint Trellix Proofpoint Concentric AI Normalyze Rubrik Palo Alto Dig IBM Guardium Wiz DSPM Microsoft Purview Cyera Varonis BigID Sentra Securiti Immuta Privacera AWS Macie Google CDLP Symantec Forcepoint Trellix Proofpoint Concentric AI Normalyze Rubrik Palo Alto Dig IBM Guardium Wiz DSPM
All 21 profiles →
Quick shortlist · 3 questions · 30 seconds

Which vendor should you look at first?

What's your primary use case?

Explore the landscape

Three views of the same data. Click any vendor to see strengths, weaknesses, and best-fit guidance — then read the full profile.

EMERGING / RISING CATEGORY LEADERS CHALLENGED ESTABLISHED INCUMBENTS CAPABILITY STRENGTH → COMPANY HEALTH → 40 55 70 85 100 40 55 70 85 100 Microsoft Purview AWS Macie Google CDLP Cyera Wiz DSPM Securiti Sentra BigID Immuta Normalyze Concentric AI Privacera Rubrik Varonis* disclosed IBM Guardium Palo Alto Dig Symantec Forcepoint Trellix Proofpoint
Click any vendor on the chart above to see strengths, weaknesses, and best-fit guidance.
Microsoft Purview
Microsoft's integrated data governance and security suite, native to the Microsoft 365 and Azure ecosystem.
Capability
71 / 100
Health
96 / 100
Strengths
  • Unmatched native integration with the Microsoft 365 estate
  • Best-in-class labelling, audit, and compliance reporting (350+ frameworks)
  • Ahead of the field on AI data security (Copilot prompt-level DLP)
Weaknesses
  • Structural gaps in non-Microsoft data source coverage (no native SAP/Oracle)
  • On-premises scanning experience degraded by design
  • Remediation primitive is label-and-DLP, not access revocation
Best fit forMicrosoft 365 E5 customers with predominantly Microsoft estates, mature Microsoft administration teams, and the budget for a partner-led implementation.
Read full profile
⚡ Negotiation leverage
July 2026 E5 price increase (5.3%) compounds with EA volume discount removal — combined 15-23% effective increase for large enterprises. Negotiate a 3-year lock before July 2026. Copilot purchase unlocks 50% Purview Compliance suite discount. Demonstrate a live DSPM POC to trigger FastTrack deployment credits.
Cyera
The first AI-native pure-play data security platform, founded out of Israel's Unit 8200 and now positioned as the leading challenger.
Capability
79 / 100
Health
72 / 100
Strengths
  • AI-native classification with 95%+ precision on unstructured data
  • Exceptional time-to-value through agentless deployment (days, not months)
  • Most comprehensive AI-SPM and AI Protect capability among pure-plays
  • Vendor-included implementation reduces total cost of ownership
Weaknesses
  • Sampling-based classification incompatible with full-inventory compliance
  • Private-company opacity limits visibility into renewal economics
  • Cyberstarts incubation context warrants disclosure
  • $9bn valuation at ~90x revenue creates pricing pressure at renewal
Best fit forCloud-native enterprises adopting AI at scale, prioritising fast time-to-value and a low-touch operational model over deep customisation.
Read full profile
⚡ Negotiation leverage
$9bn valuation at ~90x revenue creates renewal pricing risk — negotiate a hard 2-3% annual cap at first contract. Bringing Varonis, Sentra, or Wiz into a live POC typically unlocks 20-30% first-year discount. Contractually define the scope of included implementation services before signing.
Varonis Atlas AI RSAC 2026 keynote
Deep access governance heritage plus AllTrue.ai acquisition (Feb 2026, ~$150M) adding AI system visibility, shadow AI discovery, and real-time behavioural guardrails. Now covers both data security ant pivot toward AI security.
Capability
80 / 100
Health
78 / 100
DISCLOSURE — coverage held to a higher process bar Coverage of this vendor is held to a higher evidence bar during the current employment of VendorAudit's founding editor at Varonis. The summary below is constructed exclusively from public sources — Forrester Wave Q1 2025, public 10-K filings, public earnings call commentary, Gartner Peer Insights — not from VendorAudit's primary research. Full profile coverage will commence following a defined cooling-off period after the conclusion of current employment, and the first full profile will be reviewed by an independent advisor. Read full methodology disclosure →
Public-source themes — strengths
  • Forrester Wave Q1 2025: Leader and Customer Favorite, named for "deep data insights to automate remediation"
  • Mature data access governance heritage — direct permission revocation as primary remediation primitive
  • 20-year track record of behavioural analytics for insider threat detection
  • Recent Atlas AI security platform (March 2026) shows continued investment in AI category
Public-source themes — weaknesses
  • G2 reviews consistently cite deployment complexity ("resource intensive", "learning curve")
  • Forrester Wave Q1 2025 customer feedback noted tuning burden in initial deployment
  • Public 10-K shows revenue growth slowing as SaaS transition completes
  • Pricing reported by reviewers as "significant investment compared to point solutions"
Public-source best fitPer Forrester and Gartner Peer Insights commentary: large enterprises with hybrid file share / SaaS / cloud estates needing direct access governance and behavioural threat detection.
Read disclosure
⚡ Negotiation leverage (public sources)
Varonis stock fell nearly 49% after a surprise renewal miss in Q3 2025 — the company cut 5% of its workforce weeks later. This is a buyer's market for Varonis contracts. Leverage the SaaS migration (76% ARR now on SaaS) as a point of renegotiation — push for multi-year SaaS pricing that locks in current rates while the on-premises decline gives Varonis additional incentive to sign long-term SaaS customers.
BigID
Data intelligence platform combining DSPM with privacy and governance heritage. Mature reference base, slowing growth.
Capability
73 / 100
Health
64 / 100
Strengths
  • Best-in-class breadth of data source connectors (200+)
  • Mature privacy and data subject rights workflows
  • Long-tenured leadership and stable customer base
Weaknesses
  • Innovation pace has slowed since 2024; reorganisations and layoffs reported
  • AI-SPM capabilities lag pure-play competitors
  • Heavyweight deployment relative to cloud-native alternatives
Best fit forPrivacy-led security programmes; multi-jurisdictional regulated organisations needing privacy + security in one platform.
Read profile
Sentra
Pure-play DSPM with cloud-native architecture, strong on classification and recent AI security expansion.
Capability
75 / 100
Health
65 / 100
Strengths
  • Smart-sampling classification engine with strong cloud coverage
  • Agentless architecture with very fast time-to-value
  • Adversary-simulation approach to risk prioritisation is differentiated
Weaknesses
  • Smaller scale than Cyera limits enterprise deployment evidence
  • Compliance framework breadth lighter than incumbents
  • Relatively shallow on-premises and SaaS coverage outside of major platforms
Best fit forCloud-first organisations seeking pure-play DSPM depth; mid-market budget profile.
Read profile
Securiti
Acquired by Veeam for $1.725B in Dec 2025. Broadest compliance and AI governance framework coverage. Known scanning limitations for large unstructured data stores.
Capability
76 / 100
Health
82 / 100
Strengths
  • Privacy + security + AI governance unified — strong fit for multi-regulation environments
  • Strong AI governance framework support (NIST AI RMF, EU AI Act)
  • Mature data subject rights workflows from privacy heritage
Weaknesses
  • Platform breadth creates implementation complexity for narrower use cases
  • Less technically deep than pure-play DSPM in cloud classification
  • Customer evidence is weighted toward privacy-led rather than security-led buyers
Best fit forMulti-jurisdictional regulated organisations needing privacy + security + AI governance in one platform.
Read profile
Immuta
Data access governance platform with deep Snowflake and Databricks integration. Analytics-led rather than security-led.
Capability
71 / 100
Health
60 / 100
Strengths
  • Best-in-class data access governance for Snowflake and Databricks environments
  • Policy-as-code approach scales for analytics-heavy organisations
  • Strong attribute-based access control (ABAC) implementation
Weaknesses
  • Narrow scope — analytics platforms only, not broader DSPM
  • Reduced relevance outside of Snowflake/Databricks-heavy environments
  • Recent layoffs and slowed growth
Best fit forSnowflake & Databricks heavy estates; analytics platform-led organisations needing column-level access governance.
Read profile
AWS Macie
AWS's native data security service, deeply integrated into AWS Security Hub and IAM. Strong inside AWS, almost no value outside it.
Capability
64 / 100
Health
92 / 100
Strengths
  • Deep native S3 and AWS environment integration
  • Cost-effective for AWS-only customers using Security Hub
  • Backed by AWS organisational scale and continuity
Weaknesses
  • Limited to AWS — no native multi-cloud or SaaS coverage
  • Classification depth significantly less than pure-play alternatives
  • No DLP, no access governance, no AI security capability
Best fit forAWS-only data estates; organisations standardised on AWS Security Hub looking for foundational PII detection.
Read profile
Google Cloud DLP
Google's Sensitive Data Protection (formerly Cloud DLP), native to Google Cloud and Workspace.
Capability
58 / 100
Health
90 / 100
Strengths
  • API-first with strong programmatic integration into Google Cloud workloads
  • Mature classification primitives for structured PII detection
  • Cost-effective consumption-based pricing for Google-native estates
Weaknesses
  • Google-only — no multi-cloud coverage
  • Lacks the breadth of a true DSPM (no posture management, no remediation workflows)
  • Workspace coverage less mature than Microsoft's equivalent
Best fit forGoogle Cloud and Workspace-heavy organisations; developers building data-aware workflows.
Read profile
Wiz DSPM
CNAPP leader with DSPM bolted on. Holistic cloud risk context, but broader rather than deeper on data security specifically.
Capability
70 / 100
Health
88 / 100
Strengths
  • Best-in-class cloud security graph correlating data with identity, misconfig and exposure paths
  • Single-pane consolidation when paired with existing Wiz CNAPP deployment
  • Recently acquired by Google — strong organisational backing and continuity
Weaknesses
  • DSPM is a recent module addition — depth lags pure-play DSPM specialists
  • Classification accuracy and coverage less mature than Cyera or Sentra
  • Limited value for organisations not already running Wiz CNAPP
  • Weaker on AI-SPM and AI Protect than dedicated AI security players
Best fit forExisting Wiz CNAPP customers seeking a single-pane data security extension. Less compelling as standalone DSPM.
Read profile
Rubrik DSPM
DSPM extension to Rubrik backup and recovery platform. Leverages existing data scans for differentiated discovery economics.
Capability
72 / 100
Health
81 / 100
Strengths
  • Backup-data leveraged for classification — minimal additional infrastructure required
  • Strong public-company financial trajectory (NYSE: RBRK)
  • Differentiated approach to ransomware-aware data security
Weaknesses
  • Maximum value only for existing Rubrik backup customers
  • Real-time discovery less mature than agentless competitors
  • AI-SPM and runtime DLP capabilities less developed
Best fit forExisting Rubrik backup customers seeking add-on data security; ransomware recovery-focused organisations.
Read profile
IBM Guardium
Long-running database activity monitoring and data security platform. Deep on databases, weaker on cloud-native and AI.
Capability
65 / 100
Health
80 / 100
Strengths
  • Best-in-class database activity monitoring (DAM)
  • Mature compliance reporting for regulated industries
  • Backed by IBM organisational continuity and global support
Weaknesses
  • Cloud-native and SaaS coverage materially behind modern DSPM
  • Heavyweight deployment with significant operational overhead
  • Innovation pace slower than pure-play competitors
Best fit forDatabase-heavy regulated organisations; existing IBM customers; on-premises database security.
Read profile
Palo Alto Dig
Palo Alto's data security extension via Dig Security acquisition. Integrated into Cortex platform.
Capability
70 / 100
Health
78 / 100
Strengths
  • Integrated with Palo Alto Cortex for security operations
  • Strong cloud-native discovery from Dig heritage
  • Backed by Palo Alto organisational scale (NASDAQ: PANW)
Weaknesses
  • Most value requires existing Palo Alto Cortex deployment
  • Standalone DSPM capability less differentiated than pure-plays
  • Integration churn from Dig acquisition still ongoing
Best fit forPalo Alto Cortex customers seeking an integrated DSPM module; consolidation-led security strategies.
Read profile
Symantec / Broadcom
Legacy network and endpoint DLP product line under Broadcom. Investment-starved; declining trajectory.
Capability
62 / 100
Health
55 / 100
Strengths
  • Mature network DLP enforcement at scale
  • Long-standing customer relationships in regulated industries
  • Broadcom organisational financial stability
Weaknesses
  • Limited investment in cloud-native and AI-era capability
  • Customer experience reports significant support and pricing degradation post-Broadcom acquisition
  • Modern DSPM and AI security capabilities largely absent
Best fit forExisting Symantec DLP customers prioritising retention and migration runway over modernisation. Most current customers should evaluate alternatives.
Read profile
Forcepoint
DLP and data security platform under Francisco Partners ownership. Strong in government and regulated industries; weaker innovation pace.
Capability
60 / 100
Health
52 / 100
Strengths
  • Strong government and federal compliance certifications
  • Mature endpoint and network DLP
  • Established customer base in regulated industries
Weaknesses
  • Private equity ownership creates investment-vs-extraction tension
  • Cloud-native capabilities materially behind market
  • AI security capability minimal
Best fit forGovernment and regulated organisations with existing Forcepoint footprint; FedRAMP-led requirements.
Read profile
Trellix
McAfee/FireEye legacy DLP under Symphony Technology Group ownership. Investment-starved, declining trajectory.
Capability
58 / 100
Health
50 / 100
Strengths
  • Endpoint DLP heritage from McAfee customer base
  • Existing customer migration runway
Weaknesses
  • Private equity ownership prioritising cost reduction over innovation
  • Cloud-native and AI capabilities materially absent
  • Steady customer attrition reported in industry commentary
Best fit forExisting Trellix DLP customers managing migration runway. Most current customers should evaluate alternatives.
Read profile
Proofpoint
Email-led DLP and information protection. Private equity owned by Thoma Bravo; recent expansion via Normalyze acquisition.
Capability
64 / 100
Health
58 / 100
Strengths
  • Best-in-class email DLP and information protection
  • Recent Normalyze acquisition adds DSPM depth
  • Mature insider threat management capability
Weaknesses
  • Private equity ownership creates pricing pressure
  • Integration churn from Normalyze acquisition still resolving
  • AI-SPM capabilities lag pure-plays
Best fit forEmail-led DLP buyers; existing Proofpoint customers seeking platform extension.
Read profile
Concentric AI
AI-led data security with deep-learning classification, focused on unstructured data and content security.
Capability
68 / 100
Health
58 / 100
Strengths
  • Strong unstructured data classification using deep-learning models
  • Focused use case — content security in mid-market environments
  • Lightweight deployment relative to enterprise alternatives
Weaknesses
  • Smaller scale limits enterprise reference base
  • Compliance reporting and DLP enforcement breadth limited
  • Limited visibility into long-term company trajectory
Best fit forMid-market organisations seeking strong unstructured data classification without enterprise platform overhead.
Read profile
Normalyze
Data-first cloud security platform with strong Snowflake and AWS coverage. Recently acquired by Proofpoint.
Capability
70 / 100
Health
62 / 100
Strengths
  • Strong analytics platform classification (Snowflake, Databricks, BigQuery)
  • Lightweight cloud-native architecture
  • Now backed by Proofpoint scale
Weaknesses
  • Acquisition integration still resolving — product roadmap uncertainty
  • SaaS coverage less mature than pure-play DSPM
  • Limited AI security capability
Best fit forAnalytics-platform-heavy organisations evaluating DSPM; potentially attractive bundled with Proofpoint email/insider risk.
Read profile
Privacera
Unified data access governance built on Apache Ranger heritage. Strong policy-as-code; analytics-platform-led.
Capability
67 / 100
Health
61 / 100
Strengths
  • Mature Apache Ranger-derived data access governance for analytics platforms
  • Strong attribute-based access control (ABAC) implementation
  • Open-source heritage attractive to engineering-led buyers
Weaknesses
  • Narrower scope than full DSPM
  • Smaller scale limits enterprise reference base
  • Significant overlap with Immuta competitive positioning
Best fit forEngineering-led organisations needing analytics platform access governance; alternative to Immuta.
Read profile
Divisional product (Microsoft, AWS, Google)
Pure-play data security
Enterprise platform
Legacy DLP
Higher disclosure bar — see methodology
Market intelligence · Updated April 2026

Pricing signals and company risks

The intelligence analyst firms won't publish — because the vendors being assessed are paying clients. Why our analysis is different →

⚡ Pricing leverage
Microsoft Purview
E5 price increase + EA discount removal = 15–23% effective increase for large enterprises in July 2026
Microsoft raised E5 list price 5.3% effective 1 July 2026, compounding with the November 2025 EA volume discount removal. Buyers renewing before July can lock in current rates. Copilot purchase unlocks 50% Purview Compliance suite discount. Demonstrate a live DSPM POC to trigger FastTrack deployment credits.
Source: Microsoft Dec 2025 pricing announcement · SAMexpert Feb 2026
Full Purview profile →
📉 Company risk
Varonis
Stock fell ~49% after surprise renewal miss. Current buyer's market.
Varonis shares dropped nearly 49% after a sharp decline in renewal rates sent earnings well below expectations in Q3 2025, followed by a 5% workforce reduction. The SaaS migration (76% ARR now on SaaS) is creating a natural renegotiation window — push for multi-year SaaS pricing that locks in current rates while Varonis has incentive to secure long-term SaaS customers. Public-source analysis only — see methodology disclosure.
Source: Public earnings calls, VRNS SEC filings · Q3 2025
Varonis summary →
⚠ Renewal risk
Cyera
$9bn valuation at ~90x ARR creates material renewal pricing pressure
Cyera's December 2025 Series F closed at a ~90x ARR multiple. At valuations this elevated, pricing pressure intensifies significantly at renewal. Buyers should negotiate explicit multi-year price caps (2–3% annual escalator maximum) at first contract. Verbal assurances are not sufficient. A live competitor POC typically unlocks 20–30% first-year discount.
Source: Cyera Series F announcement Dec 2025 · Contrary Research ARR estimate
Full Cyera profile →
📊 Trajectory watch
Symantec · Forcepoint · Trellix
Legacy DLP platforms under PE/Broadcom ownership showing accelerating customer attrition
All three legacy DLP platforms score declining trajectory in VendorAudit's company health signals. Symantec/Broadcom and Trellix (STG) show limited investment in cloud-native capability; Forcepoint (Francisco Partners) is government-focused with limited innovation. Buyers on these platforms should start a parallel evaluation immediately — particularly given migration timelines for complex DLP deployments.
Source: VendorAudit research · public channel intelligence · Q1 2026
Compare legacy DLP alternatives →
View all market signals and what's trending in the category →
Vendor risk tracker · Updated quarterly · Q1 2026

Which vendors carry the most buyer risk?

Financial health, renewal trends, PE ownership, and acquisition risk — the signals that analyst firms won't publish because the vendors are paying clients.

Full risk tracker →
HIGH RISK
Trellix
PE · STG Partners · McAfee/FireEye legacy
PE-owned with no clear exit path
Declining trajectory · Cap 58 / Health 50
Customer attrition accelerating
Product investment stalled post-merger
HIGH RISK
Forcepoint
PE · Francisco Partners · Gov-focused
PE-owned, declining trajectory
Limited commercial enterprise investment
GetVisibility acquisition (2025) = integration risk
Support degradation reported in reviews
WATCH
Cyera
Private · Series F · $9bn valuation
~90x ARR valuation at last round
Renewal pricing risk at contract 2+
Strong capability trajectory
$1.7B raised — 2+ years runway
WATCH
Varonis
Public · VRNS · Disclosed
Renewal miss Q3 2025 · stock −49%
SaaS transition headwinds
Strong product (Cap 80 public sources)
Public-source analysis only
See all 21 vendors ranked by buyer risk →
AI Analyst

Ask the analyst

Interrogate the VendorAudit dataset. Ask about specific vendors, use cases, buying scenarios, or deployment considerations. Responses are grounded in published VendorAudit scores and research — not generic market commentary.

VA
VendorAudit Analyst
Ask me anything about the 21 vendors we cover. I can compare vendors, recommend shortlists for specific environments, explain scores, surface negotiation leverage, or walk through deployment considerations. My responses cite VendorAudit's published research.
Try asking:
Responses are grounded in VendorAudit's published research and methodology. Not investment advice. Vendor scores are illustrative at prototype stage.
The newsletter

A weekly briefing on the data security category

Every Tuesday: one vendor's score updated, one analytical piece, three short notes on what changed in the category in the last seven days.

Free weekly briefing. Paid subscription unlocks full vendor profiles, scoring detail, and the quarterly buyer survey data.

Have you deployed one of these platforms? Share your experience with other buyers.
Submit a practitioner review →