Shiri Margel | Senior Director of Product Management, Data Security & AI
More About This Author >
Shiri Margel | Senior Director of Product Management, Data Security & AI
More About This Author >
Imagine a fire department with a state-of-the-art, fully equipped response system. They've got fire marshals, engines, extinguishers, rehearsed protocols, and a plan for when something starts to burn.
But that same fire department has no way to spot a fire before someone calls it in. No smoke detectors wired to dispatch, no patrol routes through high-risk buildings, no early warning of any kind. They only find out a building's on fire once it's already spread past the point where a quick response would have contained it.
This is the other failure mode of a Data Security Posture Management (DSPM) program that only does half the work. In part one of this series, we covered what happens when a program can detect but not suppress. This post covers what happens when a program can extinguish fires but can’t find them — the shadow data problem — or can’t tell which ones are worth fighting first — the risk prioritization problem.
Key Takeaways:
- A DSPM program that can remediate but not detect leaves shadow data — data copied, exported, or created outside the reach of monitoring tools — unprotected.
- Only 34% of organizations know where all their data resides, and just 39% can fully classify it (2026 Thales Data Threat Report).
- Detection without risk prioritization is almost as damaging: the exposure that threatens customer data queues behind trivial ones.
- Clean dashboards from an incomplete DSPM program give the board false confidence; the gap surfaces only after an incident.
- A complete DSPM program detects, prioritizes, and remediates — all three, everywhere the data lives.
All the Response Capability, None of the Visibility
In part one, analysts had all the alerts, but none of the response capability. In this scenario, the security team has all the response capability, but none of the alerts.
They've got access keys, automated playbooks, and rehearsed response scenarios. If they spot a compromised database or a leaked API key, they can remediate it immediately. Proactive controls and response workflows have been put in place to reduce risk and accelerate action when issues arise. Every now and again, they get to flex their muscles and demonstrate the value of all that preparation. Their strength lies in responding quickly and effectively to known risks, once those risks have been discovered.
In this scenario, ignorance is bliss. The DSPM solution isn’t producing many alerts, so the security team assumes their environment is safe. When the DSPM does produce alerts, they act on them quickly. They feel secure, even proud of the work they’re doing.
But for every fire they put out, there are three more they don’t know about.
Two Paths to the Same Blind Spot: Shadow Data
Teams that fall into this trap tend to fall into one of two categories.
The first is legacy organizations that built protection first but failed to follow up with visibility. They still rely on the traditional security approach of building a strong perimeter with firewalls, access controls, and remediation teams to lock things down and respond when necessary.
However, as data moved into the cloud, it scattered into places those perimeter tools can’t track. The result is shadow data: copies, backups, exports, and test datasets created outside the reach of the security tools meant to monitor them. This data sprawl is now the norm. The 2026 Thales Data Threat Report found that only 34% of organizations know where all their data resides, and just 39% can fully classify it. So, the response team sits idle while risks go undetected.
The other category is newer, cloud-native organizations. They tend to go all in on response tooling, assuming that they have total coverage, even when they don’t.
Either way, the result is the same: there are fires burning somewhere in their environment, and they have no way to find out about them.
But let’s say the visibility gap gets solved. The team invests in coverage, closes the blind spots, and now sees every exposed database, every leaked key, every misconfigured bucket across the environment.
Now what?
No Risk Prioritization: When Everything’s a Priority, Nothing Is
Picture a city fire department fielding calls at the same time for a fire tearing through an apartment building, a cat stuck in a tree, someone locked out of their house, and a child locked in a car on a hot day.
That's what happens to a security team that can detect and respond, but not prioritize.
A leaked credential for a decommissioned test environment and a leaked credential for a live production database can arrive in the queue looking identical. Without risk prioritization — a way to weigh data sensitivity, likelihood, and blast radius against each other — everything reads as equally urgent, or equally easy to deprioritize.
So a rehearsed, well-resourced response capability ends up spent on the wrong things. Engineers get pulled onto exposures that pose little real risk, while the one that actually threatens customer data sits in the same queue, waiting its turn.
The fire department in the earlier example didn't fail because they lacked equipment or training. They failed because nobody decided which call to answer first. The same is true here: a DSPM program without prioritization doesn't run out of capability. It runs out of the ability to point that capability at what actually matters.
Incomplete DSPM Reports Give the Board False Confidence
When a DSPM program can detect but not actually reduce risk, the reports that reach leadership are alarming. In some ways, that's a good thing because the leadership recognizes a problem and can ask for the support needed to address it.
But reports from a DSPM program that can respond but not detect, or that can't tell which detections actually matter, are much more dangerous. They lull the C-suite into a false sense of security.
The reports the board sees look clean, but that comfort might come from blind spots the tooling never covered, or from a response team that closed out a hundred low-stakes tickets while the one critical exposure sat untouched in the queue. Either way, it's not a true picture of data security posture.
That means both the security team and the board only realize they have a problem when they suffer an incident and it's too late. They have to admit they thought, but didn't know, they were covered.
A Complete DSPM Program Must Detect, Prioritize, and Remediate
The solution is a DSPM program that can detect, prioritize, and remediate.
If a fire starts anywhere, you need to know about it and you must be able to do something about it. The same is true for DSPM. If your data is exposed, you need to know what it is, where it is, and how you can minimize or eliminate the exposure.
Detection, prioritization, and remediation need to work together, everywhere. Because only doing half the job is as bad as not doing the job at all.
The Thales vision for the future of DSPM is one solution that does all three, turning visibility and analytics into action.
That’s why we’ve built CipherTrust Data Security Posture Management (DSPM) that helps CISOs understand risk across their environment, improve operational efficiency and ROI, cut costs, support secure AI adoption, and, most important of all, ensures security teams can respond to exposures.
Halfway is no way.
To find out more about the complete Thales DSPM solution, contact us today.
Frequently Asked Questions
What is shadow data?
Shadow data is data that exists outside the visibility and control of an organization’s security tools: forgotten backups, copies in unsanctioned cloud buckets, exports in analytics sandboxes, or test databases seeded with production records. Because nothing is monitoring it, it is rarely encrypted, classified, or included in remediation workflows.
Why does DSPM need risk prioritization, not just detection and remediation?
Because not every exposure matters equally. Risk prioritization weighs data sensitivity, exposure likelihood, and blast radius so the response team fixes the leaked production credential before the decommissioned test one. Without it, a well-resourced team spends its effort in queue order rather than risk order.
Can a DSPM program succeed if it can remediate but not detect?
No. Remediation only acts on what has been found. If discovery misses shadow data across cloud, SaaS, and on-premises stores, the program reports a clean posture while unknown exposures sit untouched, and leadership learns about the gap only after an incident.
What does a complete DSPM program include?
Three capabilities working together everywhere data lives: continuous discovery and classification to detect exposures, risk-based prioritization to rank them by business impact, and built-in remediation and protection — encryption, access control, tokenization — to reduce them. CipherTrust DSPM is designed to deliver all three in one solution.