Organizations have made real progress in locating and classifying sensitive data.
According to the 2025 Thales Data Threat Report, 87% of respondents can classify at least half of their data.
Yet their environments remain fragmented. About 61% use 5 or more tools for data discovery, monitoring, or classification, while 76% operate across two or more clouds and 64% use 26 or more SaaS vendors.
Organizations are connecting enterprise data to copilots and AI models, while applications, APIs, and autonomous agents create new paths to sensitive information.
At the same time, regulatory and data sovereignty requirements can dictate where data resides and how it must be protected. Emerging risks such as quantum computing add another consideration for long-term data protection.
For CISOs, knowing where sensitive data exists is necessary, but it does not answer the more important question: Which exposures create the greatest business risk?
“The mistake I see is treating visibility as the finish line,” said Jay Thurston, Chief Trust Officer at Thales. “Finding sensitive data is important, but discovering that you have 20,000 potential issues doesn't necessarily make you safer. In some cases, you've just created a very large work queue.”
Answering that question requires context about the data’s sensitivity, protections, access, and movement. Security leaders can then assess what a compromise would mean for the business.
AI complicates this assessment because access is no longer limited to people. Applications, APIs, and AI agents can also access enterprise data, requiring organizations to determine whether that access is appropriate.
Finding the risk is only half the job. CISOs still need to determine which exposures matter most, address them, and verify that their actions reduced risk. Data security posture management (DSPM) connects visibility with those decisions and actions.
DSPM should turn data findings into risk-based priorities and action
Not every data exposure creates the same level of risk. Once sensitive data is discovered, security teams need to determine which findings require immediate action and which are less likely to affect the business.
Technical severity alone does not provide that answer. Teams need to consider how sensitive the affected data is and whether it is exposed externally. They also need to understand who or what has access to it and whether protections such as encryption are already in place. Business criticality provides another layer of context.
Factors that can raise the priority of a data exposure include:
- Highly sensitive or business-critical data
- External or otherwise unnecessary exposure
- Excessive access permissions
- Missing or inadequate protections
- Significant potential business impact
“If I have two identical technical findings, but one involves public marketing information, and the other involves millions of customer records accessible through an overprivileged account, those aren't equivalent risks,” Thurston said.
DSPM can bring that context together to help teams prioritize findings based on potential impact rather than simply working through a queue. The response should then address the risk itself. Excessive privileges may need to be removed, while sensitive data may require encryption, tokenization, or masking. A configuration could need to be corrected. Data that no longer serves a business purpose may need to be deleted.
“The objective shouldn't be to close the most findings,” Thurston said. “It should be to remove the most meaningful risk from the business.”
That principle also provides a better way to evaluate a DSPM program. Finding and closure counts are operational measures. For CISOs, the more consequential measure is how much meaningful exposure remains.
DSPM makes data security continuous across the environment
DSPM programs often begin with a basic question: “Where is our sensitive data?” From there, security teams can examine who has access, where the data is exposed, and which exposures create the greatest business risk. They can then determine whether remediation reduced that risk.
That cannot be accomplished through periodic assessments alone. Data is constantly created and copied. It moves between systems and is accessed by different users and services. Cloud and AI accelerate those changes, making data posture a moving target.
“A mature DSPM program isn't a quarterly scan. It's continuous,” Thurston said. “The mature organizations connect discovery, classification, identity and access, monitoring, protection and remediation into a continuous cycle.”
Keeping that cycle moving requires clear ownership. Security may identify the risk while a data owner, application owner, or another team is responsible for resolving it. Assigning responsibility helps keep significant exposures from going unresolved.
The approach also has to account for where data resides. “The security model needs to follow the data,” Thurston said.
Some organizations prioritize the operational simplicity of SaaS. Others need tighter control over data and security telemetry because of regulatory, sovereignty, or internal requirements. For large enterprises, that often means supporting both cloud and on-premises environments.
Regardless of the deployment model, organizations need consistent visibility and policy while applying the appropriate protections wherever sensitive data resides. Thales supports DSPM across cloud, on-premises, and hybrid environments, allowing organizations to apply those capabilities within their existing infrastructure instead of adopting a single deployment model.
With those practices in place, DSPM becomes part of a continuous data-risk management program. Security teams can identify changes in exposure, assign responsibility for remediation, and track the effect of those actions over time.
The real DSPM metric is whether material data risk is declining
For CISOs, DSPM should ultimately answer a straightforward question: Is the organization’s data risk decreasing?
Operational metrics such as alerts generated or repositories discovered can help manage the program, but they do not show whether the most consequential exposures are being reduced.
“Boards don't really need to know how many alerts my DSPM generated,” Thurston said. “They need to know whether the company's exposure is getting better or worse by a known and defensible denominator.”
DSPM metrics that show changes in risk
- Sensitive repositories exposed to the internet
- Excessive access to critical data
- High-value data protected by encryption or tokenization
- Time to remediate critical exposures
- Unnecessary sensitive data retained by the organization
CISOs can demonstrate that change with measurements tied to specific exposures. They can track whether fewer sensitive repositories are accessible from the internet and whether excessive access to critical data is declining. They can measure how much high-value data is encrypted or tokenized. Time to remediate critical exposures and reductions in unnecessary sensitive data provide additional indicators of progress.
Those improvements can then be translated into business terms. Limiting access to critical data can reduce the potential impact of a breach. Expanding protection can lower regulatory exposure and ease audit demands. Faster remediation reduces the time sensitive data remains at risk. These outcomes can also give leadership greater confidence as the organization expands its use of cloud and AI.
Thales’ report findings provide broader context for that focus on outcomes. The share of respondents reporting a breach within the previous 12 months declined from 23% in 2021 to 14% in 2025. While the report doesn’t attribute the decline specifically to DSPM, Thales’ Halo Effect research highlights the gap between best practices and real-world outcomes, underscoring the need for unified risk identification and policy enforcement across complex data environments.
Visibility is therefore an input, not the outcome. A mature DSPM program should enable CISOs to show more than what their teams discovered or fixed. The measure that matters is whether material data exposure is declining.
Learn how Thales CipherTrust DSPM helps organizations reduce data exposure, and explore Thales’ Halo Effect research for insights into how better data management drives stronger security outcomes.