Netskope DSPM FAQs

DSPM is a Data Security Posture Management from the Netskope One platform that automates security and governance for data, whether on-premises or in the cloud, with end-to-end protection. It delivers real-time visibility, control, and remediation for structured (like SQL databases), semi-structured (such as JSON logs), and unstructured data (including emails and documents) across databases, data lakes, and warehouses. Powered by Data Access Governance (DAG) and Data Detection and Response (DDR), the platform enforces compliance and ensures continuous audit readiness.

Today’s complex data environments create critical security gaps. DSPM addresses these key challenges:

• Data sprawl with no visibility (increases breach risks): DSPM auto-discovers data stores across hybrid environments for full visibility.

• Error-prone manual data classification: the platform auto-classifies sensitive data, assigns sensitivity levels, business purpose tags, and maps them to known regulations.

• Sensitive data exposure from misconfiguration: identifies data stores with issues to prevent leaks.

• Overprivileged access challenges: detects excessive user privileges to sensitive data automatically.

• Undetected risky data interactions: profiles user behavior via query analysis to mitigate risks at scale and ensure regulatory compliance.

• Overwhelming security issue management: prioritizes remediation with risk scoring and policy-based workflows.

DSPM delivers comprehensive data security through these differentiated technical capabilities:

• Context-Aware Data Security: provides correlated visibility into all data interactions by continuously analyzing four critical dimensions: infrastructure (data location), data (type/sensitivity), users (access patterns), and usage (interaction methods). This contextual monitoring identifies anomalies like unauthorized access or suspicious queries in real time.

• Continuous Data Risk Monitoring: performs uninterrupted scanning across databases, file shares, and cloud storage to detect risks including misconfigurations, outdated permissions, and suspicious activity. Automatically evaluates security control effectiveness and recommends adjustments.

• Core-Data Security Automation: utilizes machine learning to classify data by sensitivity using Netskope’s extensive DLP entity library. This integration provides access to thousands of predefined data identifiers (including PHI and PCI) to enforce granular, classification-specific controls. Additionally, the system monitors active data usage to track query patterns and data movement, effectively reducing insider threats.

• On-Prem & Cloud Coverage: supports all major structured and unstructured data stores across on-premises, IaaS, PaaS, and SaaS environments. Automated workflows identify misconfigurations and optimize resources without manual intervention.

• Real-Time Compliance Monitoring: continuously analyzes data access and usage patterns to immediately detect violations of GDPR, HIPAA, or CCPA requirements. Triggers alerts for risky activities like unauthorized sensitive data exports.

• Data Query and Risk Analysis: analyzes query logs in real time to identify misuse patterns such as excessive data sampling. Generates prioritized risk scores (0-100) based on factors like privilege staleness and data sensitivity levels.

• Cross-Functional Workflows: automates incident response by alerting designated teams to potential data misuse or leaks, significantly reducing remediation time while ensuring proper mitigation actions.

• Cross-Platform Orchestration: enables unified monitoring through SIEM, SOAR, and Active Directory systems integration via API/metadata exchange. Delivers granular privilege analysis at the object level (e.g., database table permissions) across hybrid cloud environments.

You can configure these key elements of the platform:

• DLP Profiles and Rules: define custom classifications for your organization’s data. The platform automatically assigns sensitivity levels, business purpose tags, and maps them to regulations like HIPAA or GDPR. Create custom tags and DLP Profiles and Rules to monitor your most critical sensitive information at scale.

• Data Store Scanning: adjust scan frequency, schedule timing, and sampling rates for your data stores. Use regex patterns to fine-tune scanning parameters, ensuring your security insights remain current and accurate.

• Security Policies: create and modify policies to enforce your organization’s data protection standards. Implement access controls and encryption rules to prevent unauthorized data exposure. Customize alert conditions that integrate with existing notification workflows.

• Remediation Workflows: modify built-in workflows or design new ones with specific notification settings. Automate risk mitigation processes by linking workflows to your customized policies for efficient security management.

DSPM offers two deployment models:

• SaaS-Hosted Deployment

  The standard SaaS model operates entirely within Netskope’s environment. In this configuration, you connect data stores directly to the Netskope cloud for scanning and analysis. This allows you to onboard resources without deploying a sidecar or maintaining local infrastructure.
  On-Prem Architecture

• On-Prem Architecture

  This option is ideal for customers who prefer not to allowlist SaaS IPs. It combines Netskope’s central SaaS application with specific customer-deployed infrastructure to keep sensitive data processing within your environment.

  The deployment involves a combination of the following elements:

  • Sidecars: Installed near your data stores, sidecars handle the discovery of data and the transmission of metadata to the central application.
  • DLP Appliance: This appliance handles the actual content processing and classification locally.
  • Single Appliance: A unified virtual machine that bundles both the sidecar and DLP services into one image. This model simplifies on-premises deployment by eliminating the need for separate sidecar pool creation, token management, or manual DLP appliance linking. It is optimized for proof-of-value environments and mid-sized customers. To learn more: Deploy the DSPM Single Appliance.

Sidecars work in conjunction with a local DLP appliance for data classification. The key requirements are:

• Scaling Limitation: Running multiple DLP appliances behind a load balancer for horizontal scaling is not yet supported.
• Network Location: The DLP appliance must be deployed within the same network as the sidecar(s) it serves, or in directly connected networks.
• Communication: The sidecar and DLP appliance must be accessible to one another via HTTPS (port 443).
• Appliance Sharing: A single DLP appliance can serve multiple sidecars, as long as their sidecar pools are registered to the same appliance address.

The DLP appliance requires two separate keys, both retrieved within the Netskope console:

• License Key: Used during the appliance setup and regularly checked to ensure the DLP entitlement is valid. This key is automatically generated by the Netskope console and is console-specific (the same key could also be used when registering an NPA publisher).

• REST API v1 Key: Used by the appliance to call home and fetch the latest DLP configurations. It is not used during initial appliance setup. This key may already exist in your environment for other purposes; if so, you can reuse it.

DSPM supports scaling through organization-level onboarding. When you onboard an Organization, the platform automatically detects all child Accounts and Data Stores within them, enabling rapid connection and scanning across large volumes of data resources.

No. The platform minimizes performance impact by periodically copying queries from data store logs (when data-in-use monitoring is enabled) and sampling new columns during non-peak times (configurable). All operations are designed to maintain typical database/warehouse performance.

No. DSPM only stores metadata and does not retain copies of sensitive data samples. This ensures customer data remains secure and private. Some customers deploy via Sidecar to keep computing and sampling within their environment.

No. When using the on-premises deployment with sidecars and a DLP appliance, all data samples used for classification remain within your network and are never stored by Netskope. Only the classification results (not the sensitive data itself) are shared with the Netskope DSPM application.

Supported File Types:

DSPM classifies your data through the following process:

• Scanning: examines data stores across your environments.
• Machine Learning Analysis: uses heuristic signals to identify data sensitivity levels, specific data types, and confidence scores for each classification.
• Configuration Options: allows adjustment of scan frequency, schedule timing, and sampling rate (for unstructured data).

DSPM detects five core risk types with automated scoring (0-100 scale):

• Misconfiguration risk: the score reflects the vulnerability level of data store security configurations.

• Overprivileged risk: aggregated score for data stores showing multiple users with stale, excessive privileges to sensitive data. Flag users when they haven’t accessed data stores for extended periods or retain access to large amounts of sensitive data.

• Data store sensitive access risk: aggregated score for data stores where multiple users can access sensitive data.

• User behavior risk rating: score based on the severity of the user’s policy and data-in-use violations (30-day window).

• User-sensitive data access risk: score increases when users access higher-sensitivity data.

All risk scores (0-100) derive from the Last Accessed Timestamps (inactivity duration), Data Sensitivity Levels (higher sensitivity = higher risk weighting), and the Access Scope (volume of sensitive data accessible).

Yes. It goes beyond basic role retrieval to detect field or file-level user access. It provides granular insights into which users can access sensitive data, helping prioritize access issues based on true sensitive data exposure.

DSPM’s real-time detection capability depends on your configured scan frequency (adjustable from hourly to monthly) – for query-based policy violations, detection occurs when the system processes the query logs during its next scan cycle, meaning alerts trigger immediately upon identifying violations within an active scanning window but aren’t instantaneous for queries executed between scheduled scans.

DSPM provides remediation through:

• Automated workflows that send alerts via Slack, PagerDuty, SNS, Google Pub/Sub, and email.

• Native integrations with SOAR solutions like Splunk and Sumo Logic.

• Ticketing system alerts for platforms including Jira and ServiceNow – enabling rapid response to detected incidents through your existing operational channels.

It automates compliance with major regulations like GDPR, HIPAA, and CCPA. It integrates with existing tools to simplify audits and ensure continuous compliance.

DSPM integrates seamlessly through multiple, flexible methods designed to fit into your existing architecture without disruption. The integration can be achieved through the following channels:

1. Native Integrations (The easiest path):
   For quick and effortless connectivity, we offer over 90 out-of-the-box, native integrations with the leading platforms across your data ecosystem. This includes:
   • Cloud Providers & Data Stores: AWS (e.g., S3, Redshift, RDS), GCP (e.g., BigQuery, Cloud Storage), Azure (e.g., Blob Storage, SQL Database), Snowflake, Databricks, MongoDB, and more.
   • Business Intelligence (BI) Tools: Tableau, Looker, Mode, and others.
   • Enterprise Applications: Backup solutions (Cohesity, Commvault).
   • Identity Providers: For SSO with Okta, Ping Identity, OneLogin, and G Suite.
2. Custom Workflows (For full flexibility):
   If you use a proprietary or less common system, you can build powerful custom integrations using:
   • Open APIs: For deep, bidirectional integration to pull data or push alerts and policies.
   • Webhooks: To trigger actions in other systems based on specific security events detected by DSPM.
   • Lambda Functions: For serverless, event-driven custom code execution (e.g., in AWS Lambda) to handle unique processing logic.
3. Alerting and Notification Feeds:
   To operationalize findings within your existing workflows, you can send all DSPM security alerts to:
   • SIEM Solutions: Splunk, Sumo Logic, Datadog, LogRhythm.
   • Collaboration Tools: Slack, PagerDuty, and Email.
   • Cloud Messaging Services: Amazon SNS, Google Pub/Sub, Azure Event Grid.

Regardless of the method, integration provides centralized controls from a single pane of glass, giving you visibility and governance over data across on-premises and multi-cloud environments.

To determine the best integration path for your specific tools, we recommend you contact your account representative. They can provide the most current list of native integrations and guide you through any custom workflow design.

The platform has achieved SOC 2 Type 2 attestation and demonstrated HIPAA compliance. Read more about DSPM approach to Trust and Security.

You’ll receive comprehensive support through our Premium Onboarding and Long-Term Success Plan, designed to help you maximize the value of DSPM. From day one, you’ll have a dedicated team of experts, including a Customer Success Manager, Solutions Engineer, and Account Manager, working closely with you to ensure success.

Here’s what you can expect:

• Kickoff and Tailored Planning: we’ll start with a kickoff session to understand your unique priorities and goals, and your success team will create a customized roadmap aligned with your use cases and business objectives.

• Ongoing Training and Adoption Support: receive personalized training sessions, 1:1 coaching, and resources to drive user adoption across your organization. Examples include hands-on workshops and best practices tailored to your workflows.

• Proactive Account Reviews: at 90 days and 6 months, we’ll review your progress, identify new value opportunities, and optimize your configurations. These check-ins ensure you’re on track to meet your goals.

• Workflow Optimization and Integrations: we’ll help you streamline workflows, integrate with existing systems, and configure custom solutions for maximum impact.

• Executive Updates and ROI Tracking: regular updates for leadership will showcase the return on investment (ROI) and progress toward your objectives. This ensures alignment between technical implementation and business outcomes.

With the Premium Onboarding and Long-Term Success Plan, your success team becomes an extension of your organization, providing continuous support and expertise, and together, we’ll ensure high user adoption, ongoing optimization, and sustained value to meet your evolving business needs.