Data security posture management (DSPM) has emerged as the next “must have” requirement for organizations to protect their data. Still an emerging data protection “need”, organizations have only begun focusing on how to best implement DSPM.
In doing so, many may reach the following conclusions about DSPM as they currently exist. The DSPM offerings may not meet their desired technical requirements, may exceed acceptable price points, or both. These trade-offs dictate that organizations proceed carefully in selecting a DSPM solution that best meets their current and future needs.
The Motivation Behind DSPM Adoption
The motivation to adopt DSPM comes out of at least three challenges that nearly all organizations face:
- The ever-increasing amounts of data that they must manage and protect.
- Organizations store data in multiple locations that have varying levels of security to protect it.
- More sophisticated forms of ransomware powered by artificial intelligence (AI) that can attack and compromise organizational data.
AI-powered Ransomware the X-factor
This last challenge, AI-powered ransomware, represents the X-factor that often causes organizations to prioritize implementing DSPM. Modern strains of ransomware have evolved well beyond data encryption or deletion with hackers asking for a ransom.
Rather, modern ransomware warfare has become more of a cat-and-mouse game as both bad actors and organizations now use AI. Hackers utilize AI to create ever more sophisticated forms of ransomware to permeate organizations and access their data.
A recent Threat Intelligence Report released by Anthropic provided insights into how cybercriminals already use AI in their ransomware attacks. While Anthropic creates obstacles to stop cybercriminals from using their AI tool (Claude) to create ransomware, organizations should remember one fact. Cybercriminals are criminals.
As such, cybercriminals attempt to find ways around these barriers that Anthropic and other AI providers put up. Here are at least four ways Anthropic has found cybercriminals trying to circumvent these defenses:
- Weaponizing agentic AI systems to perform cyberattacks. Agentic AI does more than advise cybercriminals on how to create ransomware. It creates ransomware that helps them carry out attacks.
- It has lowered the technical sophistication threshold required of cybercriminals. Prior to AI, cybercriminals had to have the technical skills and prowess to write and create ransomware. Using AI, cybercriminals with fewer technical skills can now write and create ransomware code.
- Use AI to perform victim profiling. An attack now begins well before cybercriminals ever get inside an organization’s IT environment. Cybercriminals may use AI to create organizational profiles, identify vulnerable VPN endpoints, and collect information about their IT infrastructure.
- Identify the optimal options for attack and exploitation. Once inside an organization, the ransomware can use AI to analyze the optimal way or ways to attack an organization. It may still delete, encrypt, and/or copy data. However, it may also find administrators with weak security credentials or identify weak points in the organization’s security posture. Further, the ransomware may shift how it attacks as an organization responds to each attack.
The ways in which bad actors utilize AI to create ransomware and perform attacks should put organizations on high alert. Minimally, they should seek out and ideally implement equally robust solutions to protect their data.
Two DSPM Choices: Neither One Ideal
Organizations will currently find DSPM solutions available in distinct categories.
- Purpose-built DSPM solutions that scan, categorize, evaluate, and potentially remediate identified vulnerabilities represent the first category.
- Broader security suites of which DSPM represents one of multiple security features that the security suite offers.
Purpose-built DSPM providers currently have the most robust set of DSPM features across these two categories of providers. They have already implemented features that analyze data permissions and user behaviors, perform AI-driven data classifications and cataloguing, and may correlate data risk to infrastructure vulnerabilities.
However, in many if not all cases, purpose-built DSPM tools still have at least two weaknesses.
- First, they often specialize in performing their analysis in specific types of IT environments. For example, organizations that store data both on-premises and in the cloud may need different DSPM tools to protect them.
- Second, even if they identify vulnerabilities, they may only include recommendations on how to remediate them and cannot automate it. Further, if data loss has already occurred, they cannot help with restoration.
This inability to restore data or permissions would argue for organizations to consider implementing a security suite. These security suites increasing include data protection software as a component which can perform these needed restores. However, these solutions generally lack the robust ability to detect vulnerabilities that the purpose-built solutions possess. As a result, organizations may need to use both to address the shortcomings of the other.
Two-pronged Defense May Still Not Suffice
Unfortunately, this two-pronged defense may still not suffice to protect all organizational data. This defense may work to various degrees to protect data stored in the cloud, on-premises, and in hybrid environments.
However, it still leaves the data that organizations store in software-as-a-service (SaaS) applications exposed to these attacks. Depending on the SaaS application, organizations may access and store data in one in multiple ways. Further, organizations may access many of these SaaS applications using standardized Internet protocols.
Therefore, one can only assume that bad actors and hackers will eventually turn their attention to attacking SaaS applications. This presents some real concerns as many SaaS applications already contain a great deal of organizational data. Further, these SaaS applications may not possess all the security levels found in the cloud or on premises.
This makes SaaS applications potentially tempting targets for bad actors and hackers to try to find their weaknesses. While in the past probing SaaS applications to find these weaknesses may have seemed like a fool’s game. However, today’s combination of agentic AI, lower technical competency, and the ability to AI-powered ransomware to learn make this possibility less far-fetched. If anything, it seems likely one or more SaaS applications will eventually come under attack.
Best Next Moves with DSPM
I do not mean to instill fear with this blog post. However, I certainly intend it as a wake-up call for organizations to remain cognizant of the new risks that AI-powered ransomware presents.
Admittedly, a bad actor cannot easily open a browser window, go to Claude, and instruct it to generate this ransomware code. However, AI exists in private clouds that bad actors and hackers utilize to create increasingly sophisticated ransomware.
No organization, regardless of its size, should consider itself immune to AI-powered ransomware attacks. AI has become the X-factor for hackers as they can instruct AI to create code, manage attacks, and pick the most susceptible targets.
In response, organizations must minimally begin to identify and bring in DSPM tools that protect them against these attacks. While they must account for AI-powered ransomware attacks in the cloud and on premises, they cannot dismiss the possibility of attacks on the SaaS applications they use.
Unfortunately, this ability to deliver DSPM on all three fronts has yet to fully come to fruition, leaving SaaS applications in particular an underserved market. Further, it seems major gaps persist between what DSPM providers can do and what backup companies can offer on all three fronts. This may require a data protection provider such as HYCU that can focus across all three fronts to enter the DSPM market and fill this void.
KEEP UP TO DATE WITH DCIG
To be notified of new DCIG articles, reports, and webinars, sign up for DCIG’s free weekly Newsletter.
To learn about DCIG’s future research and publications, see the DCIG Editorial Calendar.
Technology providers interested in licensing DCIG TOP 5 reports or having DCIG produce custom reports on their behalf, please contact DCIG for more information.
Editor’s note: HYCU is a client of DCIG.