Sensitive-data inventory
Show where classified data is stored and where classification or ownership is missing.
← Exposure ManagementPreviewDSPM · Built on Skyreach Orion
Connect sensitive data to the identities, workloads and paths that can reach it.
DSPM extends Orion from knowing that a data store exists to understanding what it contains, how it is classified, who owns it and how it can be accessed. It reuses classifications from tools organisations already operate and connects them to infrastructure exposure.
Evidence in
What Orion connects
The exact coverage depends on the integrations and authorised evidence available in your environment. Every record retains where it came from.
Example sources
- Cloud object storage and databases
- Native classifications from Purview, Macie and Google
- Database schemas, tables and permissions
- SaaS repositories and file-sharing metadata
- Labels, catalogues and governance platforms
- Authorised metadata or content classification
What the ontology models
- Data stores, datasets, tables and files
- Sensitivity and business classifications
- Owners, custodians and data policies
- Identities and workloads with access
- Replication, lineage and data movement
- Infrastructure hosting each data asset
Intelligence out
What visibility and insight you gain
The module uses the shared Orion model, so its findings can be understood through evidence collected by other security disciplines.
Access exposure
Connect public access, IAM, database grants and workload identities to the data they permit.
Governance context
Assess region, encryption, retention, duplication and available policy evidence.
Data attack paths
Reveal how a compromised workload or identity could reach a sensitive dataset.
Connected analysis
An example of the exposure Orion can reveal
This is an illustrative relationship chain, not a claim that every path represents a confirmed compromise. Orion preserves evidence and confidence so teams can validate what is effective.
Exposed application→Service identity→Data-store permission→Sensitive dataset
Risks made visible
What the module is looking for
- Sensitive data in public or broadly accessible stores
- External identities able to read confidential datasets
- Unclassified, unowned or shadow data stores
- Data copied into development or unapproved regions
- Weak encryption, retention or auditing controls
- Application and identity paths to high-impact data
Questions it helps answer
Move from findings to decisions
- Where is customer or regulated data stored?
- Which identities and applications can read it?
- Could a public workload reach a sensitive dataset?
- Which important stores lack classification or ownership?
Why Orion matters
This discipline does not operate in isolation
Data Security Posture Management contributes its evidence to the same ontology used by the rest of Exposure Management. That allows a finding to inherit network reachability, identity privilege, data sensitivity, software, application and business context where those facts exist.
See the complete Exposure Management productDSPM evidence+Shared ontology+Cross-domain context=Prioritised exposure
See what this means in your environment
Tell us which sources you use and the questions your teams struggle to answer today.