Three years ago, Data Security Posture Management was the most fashionable category in cybersecurity. Every CNAPP platform wanted one. Every venture firm was funding one. The pitch was irresistible: enterprises had lost track of their own data across a sprawl of clouds, SaaS apps, and shadow data stores, and DSPM promised to find it, classify it, and lock it down.
Today, DSPM is no longer a category you can casually enter by acquisition. The buyers who were going to buy have largely bought. What was a crowded field of pure-play specialists has been thinned by a consolidation wave that ran hard from 2023 through 2025, and the companies still standing are now either too big to be acquired cleanly, too small to matter, or repositioning themselves into something the market still calls a category.
This is a map of where that leaves things: the deals that happened, the companies that survived, and what an acquirer or a seller should understand about a market in its endgame.
The consolidation wave: roughly 13 deals in three years
DSPM consolidation didn't happen gradually. It happened in a concentrated burst, as established security vendors realized that "data-layer visibility" was a hole in their platforms that customers were increasingly asking them to fill.
By BrimWall's count, the public record shows roughly thirteen acquisitions of DSPM or directly DSPM-adjacent companies between 2023 and 2025. The notable ones, in rough order:
- IBM acquired Polar Security (2023), one of the first major DSPM tuck-ins, folding into IBM's Guardium data security line.
- Palo Alto Networks acquired Dig Security (December 2023), a marquee deal, reportedly in the $300–400 million range, that anchored Palo Alto's DSPM capability inside Prisma Cloud.
- Rubrik acquired Laminar (2023), the backup and cyber-resilience vendor moving into data security posture.
- CrowdStrike acquired Flow Security (2024), extending CrowdStrike's reach from endpoint into data-in-motion.
- Fortinet acquired Next DLP (2024), a data loss prevention play with posture-management overlap.
- Netskope acquired Dasera (2024), strengthening Netskope's data security story ahead of its public listing.
- Cyera acquired Trail Security (2024), notable because it's a pure-play buying rather than being bought.
- Forcepoint acquired GetVisibility (2025), AI-driven data classification folded into Forcepoint's data security portfolio.
- Fortra acquired Lookout's enterprise business (2025), consolidating data protection capability under the Fortra umbrella.
- Concentric AI acquired Swift Security and Acante (2025), two tuck-ins in a single year, again a pure-play consolidating rather than exiting.
- Veeam announced its acquisition of Securiti AI (late 2025), the data backup giant moving decisively into DSPM, privacy, and AI governance in one of the largest moves in the category.
That is not an exhaustive list of every transaction that touched data security in three years, and reasonable analysts will draw the category boundary in slightly different places. But as a directional count, thirteen is defensible, and the pattern it reveals matters more than the exact number.
Notice who the buyers were: CNAPP platforms (Palo Alto, CrowdStrike), backup and resilience vendors (Rubrik, Veeam), broad security incumbents (IBM, Fortinet, Forcepoint, Fortra), and SSE/SASE players (Netskope). Almost every major platform category in cybersecurity sent at least one buyer into DSPM. That is what the end of a category land-grab looks like.
The survivors: roughly 7 independents still standing
Strip out the acquired and the absorbed, and the field of genuinely independent DSPM or DSPM-centric vendors of real scale has narrowed to a short list. By BrimWall's reckoning, about seven names still matter as standalone businesses:
Cyera is the outlier at the top. It raised a $400 million Series F in January 2026 led by Blackstone, bringing total funding past $1.7 billion and tripling its valuation in a year to $9 billion. Cyera is no longer an acquisition candidate in any normal sense: it is too large, too well-capitalized, and on what looks like a pre-IPO trajectory. It has also been buying, not selling.
BigID remains independent and mature, with a privacy-and-governance heritage that gives it a distinct position from the cloud-native pure-plays.
Sentra sits among the strongest of the mid-stage independents, well-funded, fast-growing, and the kind of profile a platform buyer would naturally find attractive. A mid-stage independent of the right size and growth trajectory is exactly what the remaining strategic buyers would look for.
Varonis is the public-market incumbent. Not a pure-play DSPM vendor, but a data security platform that has folded DSPM into a much broader offering, and large enough to be a consolidator or an independent rather than a target.
Symmetry Systems, Concentric AI, and Cyberhaven round out the field, smaller and more specialized, each with a differentiated angle (cloud data access, AI-driven classification, and data lineage respectively). These are the names most exposed to the dynamics described below.
Seven is, again, a directional figure rather than a precise one; the exact list depends on where you draw the line between "DSPM company" and "security platform with DSPM in it." But the shape of the survivor set is clear: one runaway leader, a couple of mature independents, one strong mid-stage target, and a tail of specialists.
The three forces now shaping the endgame
For anyone evaluating a DSPM transaction in 2026, as a buyer or a seller, three dynamics matter more than any individual company's pitch.
1. The buyer pool has collapsed
This is the single most important fact about DSPM M&A today. In 2023, a DSPM founder contemplating a sale could plausibly imagine a dozen strategic acquirers competing for the asset. In 2026, most of those acquirers have already bought. Palo Alto, CrowdStrike, IBM, Fortinet, Forcepoint, Fortra, Netskope, Rubrik, Veeam: all have their DSPM story.
The remaining logical strategic buyers are a much shorter list: large security players who sat out the first wave and may now feel the gap. But a thin buyer pool changes everything about a sell-side process. Competitive tension is what produces premium valuations, and competitive tension requires multiple credible bidders. A DSPM company going to market in 2026 may find three interested parties where it would have found ten in 2023, and that compression flows directly into price.
2. The category is being absorbed into platforms
DSPM is increasingly not a product you buy: it's a feature you expect your CNAPP, your data security platform, or your backup vendor to already have. Cyera itself was the first to converge DSPM, DLP, and identity into a single platform, and that convergence is now the market direction, not the exception.
For a seller, this is the existential question: is your company a category or a feature? A pure-play DSPM vendor with no broader platform and no defensible data moat is, increasingly, a feature, and features get acquired at feature multiples, not category multiples. The difference between those two outcomes can be 3 to 5x on the revenue multiple.
3. The category is repositioning toward AI data security
The DSPM label itself is quietly evolving. Through 2026 the conversation has moved decisively toward AI security, AI data governance, AI-agent oversight, and data detection and response, securing data in motion and in use, not just cataloguing it at rest. Cyera's latest raise was explicitly framed around AI security, not DSPM in the classic sense.
This is both a threat and an opportunity for the survivors. The companies that can credibly tell an AI data security story are refreshing their narrative and their multiple. The companies still pitching "we find and classify your sensitive data" are pitching 2023's category in 2026's market.
What's left to buy
So what does the remaining opportunity actually look like?
For strategic acquirers, the honest answer is: not much, cleanly. The pure-play pickings are thin. A strong mid-stage independent like Sentra is the kind of asset that would draw real interest and command a healthy price. Symmetry Systems, Concentric AI, and Cyberhaven are acquirable but each comes with the question of whether you're buying a category position or just a capability. The mega-assets (Cyera, BigID, Varonis) are not realistic acquisition targets for most buyers. A strategic that genuinely needs DSPM in 2026 is mostly looking at a tuck-in of a smaller specialist, and should price it as a feature acquisition unless there's a real data moat or vertical depth to justify more.
For private equity, the more interesting question is the long tail. Below the seven survivors sits a scatter of smaller DSPM and data security vendors: sub-scale, often growth-challenged, frequently the companies that didn't get acquired in the 2023–2025 wave for a reason. There is a roll-up thesis there for a sponsor willing to assemble a data security platform out of several specialists. It is not an easy thesis to execute, but it is a real one, and it is where much of the remaining deal volume will sit.
For sellers, the message is the most pointed. If you are a DSPM company that has not been acquired, the window of the easy strategic exit has largely closed. That does not mean there is no exit; it means the exit now requires either genuine differentiation (a defensible data moat, deep vertical specialization in regulated industries, a credible AI data security repositioning) or a realistic acceptance that you are a tuck-in priced as a feature. The founders who do best from here will be the ones who repositioned early and can tell a 2026 story, not a 2023 one.
The takeaway
DSPM is a useful case study in how cybersecurity categories now move: from venture darling to consolidation target to absorbed feature in roughly thirty-six months. The thirteen deals compressed into three years, the collapse of the buyer pool, the absorption into platforms, the quiet rename toward AI data security: this is the full arc of a category, and it ran fast.
For acquirers, the lesson is that timing a category entry by acquisition is unforgiving: the window between "too early to tell" and "everyone already bought" is short. For sellers, the lesson is that category timing is not something you can wait out; the difference between exiting into a crowded buyer field and exiting into a thin one is a matter of a year or two, and it is worth more than almost any operational improvement.
The DSPM endgame is not over. But it is visibly an endgame, and both sides of the table should be playing it as one.
This analysis is based on publicly available deal data and BrimWall's market analysis as of mid-2026. Deal values, where stated, are based on public reporting and may not reflect final terms. Company funding figures and valuations are drawn from public announcements. The "13 deals" and "7 survivors" counts are BrimWall's directional framing of a market whose category boundaries are necessarily a matter of analytical judgment.