Data discovery shows where sensitive files sit. DSPM goes further by mapping who owns them, who can read them, which shares are open to everyone, and which files are stale—so security teams can fix overexposure before a breach happens.
Platform · Data Discovery & DSPM
Find Sensitive Data. Understand Where Risk Exists.
Sensitive data sprawls across file shares, employee endpoints, mailboxes, and cloud drives. GuardStance discovers where sensitive files live, maps who can access them, and highlights overexposed or stale data before it leaks.
Book a demoA payroll export sits on an open share.
- Data
- Payroll export with salaries and IBANs
- User
- Finance team (owner)
- Destination
- NAS folder shared with everyone
- Policy
- Payroll data: owners only
- Decision
- Warn owner notified
Finding Data Is the First Step. Understanding Exposure Is the Next.
How does DSPM work?
-
Discover
Scan endpoints, SMB/NFS network shares, SharePoint, mailboxes, and cloud drives.
-
Classify
Identify sensitive content using exact data match, document fingerprinting, checksum-validated patterns, and OCR.
-
Assess Exposure
Map file ownership, open shares, external links, and access permissions across your repositories.
-
Take Action
Remediate risks by notifying owners, quarantining or encrypting files, or restricting access.
What does it show?
-
Inventory
Where personal, financial and confidential data sits, file by file.
-
Owners and access
See who owns each file, who has read or write access, and how it is shared.
-
Open shares
Files shared with everyone or through external links.
-
Stale data
Spot sensitive files that have not been opened or modified in years so you can archive or purge them.
-
Mailbox archives
Find forgotten sensitive attachments and records inside Exchange and Microsoft 365 mailboxes.
-
Personal-data inventory
Maintain a live inventory of PII and special-category data by location for GDPR and audit readiness.
Questions about DSPM
How is this different from Data Classification?
Data Classification determines the sensitivity and context of information. Data Discovery identifies where that information exists, while DSPM evaluates exposure and access risks. These capabilities work together to help security teams understand which information needs attention and why.
Does discovery move or copy our data?
Endpoint agents inspect files on the device, and network shares (SMB and NFS) are scanned from the management appliance. Scanned content and detected values stay on that appliance, which runs in infrastructure you designate in on-premises and private cloud deployments. Data handling for connected cloud sources depends on the configured integration and deployment architecture.
What happens after a finding?
Security teams can notify the data owner, move or quarantine the file, apply encryption, update labels, or open an investigation case—with every remediation step logged for audit.