Two dates bracket the short history of DataSecOps. On 4 August 2021, Ben Herzberg — chief scientist at Satori Cyber — published the definition: an agile method of protecting data that assumes both the data and its users will keep changing, and embeds security into that churn rather than fighting it. On 28 August 2025, Commvault announced it was buying Satori Cyber outright, for a preliminary USD 28.3 million. Five years from blog post to acquisition is quick work in enterprise software, and the deal tells you where budgets are heading. The stakes on the other side of the ledger are not abstract either: IBM’s 2026 study put the average breach at USD 4.99 million, the highest figure the survey has recorded. This piece walks through what changed, why the money moved, and what a sensible buyer should ask vendors this year.
A vendor’s word, not a standard
A vendor’s word, not a standard
Straight talk first: no standards body recognises the term. Herzberg minted it for his company’s market, and the practice it describes has run for years under the drier title of data security governance. Gartner went its own way, filing the tooling under a category named data security platforms in its 2025 market guide. When a founder names a category and an analyst names a different one, procurement teams get whiplash; the useful move is to treat the catchy name as shorthand for a scope you can actually specify: discovery and classification, query-time policy on rows and columns, masking and its cousins, egress control, and the audit trail behind all of it. If a vendor cannot map their pitch onto that list, the pitch is decoration.
Why the DataSecOps label stuck anyway
Names win on rhythm, not accuracy, and this one filled a real gap. DataOps owned the pipelines, SecDataOps spoke to security telemetry, and nobody had a handle for the question every board started asking once regulations bit: who may read which row of which table, and how do we prove it? A single word gave vendors a flag to plant and conference organisers a track title. The convenience is real; the risk is that a slick name slide-decks a committee into buying before anyone has classified the data. Watch for that sequence in reverse — classification first, platform second — and the label does no harm at all.
Consolidation arrived on schedule
The Commvault purchase was less a surprise than a marker. Three firms — Commvault with Satori, Immuta and Privacera — had been selling the same overlay idea: sit a policy layer across warehouses, translate one rule set into each engine’s native controls, and give auditors one report. Buying one of the three was the fastest way for a backup-and-recovery incumbent to own that layer. For customers the practical lesson is unglamorous: overlays help, but they are proxies. A direct connection, a share between accounts or a clone can step around the proxy entirely, so native policies still have to carry real weight. Anyone signing a multi-year contract in 2026 should ask exactly which paths bypass the overlay and what covers them.
The incidents that moved the budgets
Consider the 2024 campaign tracked as UNC5537, which hit Snowflake customers rather than Snowflake itself. Stolen credentials did the damage: roughly 79.7 percent of the affected accounts had prior infostealer exposure, multifactor authentication was absent, and some credentials had gone unrotated for as long as four years. About 165 organisations ended up notifying, and the stolen data left through COPY INTO exports. The platform itself was not breached — a hundred different tenants had simply left the same front door wide open. The older lesson points the same way. Capital One, 2019: about 100 million US individuals exposed, an USD 80 million penalty from the OCC, and the root cause was a misconfigured infrastructure path rather than broken cryptography. Regulators priced the governance gap, not the math.
From console clicks to DataSecOps code review
The second trend is quieter but lasts longer: rules are moving into repositories. Under the DataSecOps style, a masking or row-filter rule lands as code, gets reviewed in a pull request by the data’s owner, runs through the same continuous-integration tests as application changes, and then applies itself. Grants stop being forever; each one carries an expiry, and a quarterly walk-through retires what nobody used. Standard requests turn around the same day, while exceptions require a filed ticket, someone senior accepting the risk in writing, and a hard end date. For a finance director, this trend converts an invisible cost — hand-maintained console settings nobody dares touch — into a versioned asset with authors, dates and an undo path. Auditors notice the difference immediately, because sampling a git history takes minutes while reconstructing who changed what in a console takes a forensic engagement.
Four questions to put to every 2026 vendor
Demos are staged; questions are cheap. Bring these to the next meeting and watch which answers wobble.
- Which of your controls survive a direct connection, a clone and a table share? Anything that only works through your proxy is a discount feature.
- What do your scanners do about the columns they cannot classify? Every vendor concedes scanners miss things — the honest ones say who confirms the residue.
- Can a grant expire without an engineer remembering to revoke it? Expiry should be a property of the grant, not a calendar reminder.
- Where does your audit report come from — the engine’s own history or your own log? Engines keep the authoritative record; ask how yours reconciles with theirs.
Notice what is absent from that list: branding. Whether the box says DataSecOps, data security governance or a platform category matters far less than whether the four answers hold up under follow-up questions.
The state of play, compressed
A small team got a term in 2021; the term’s creator got acquired in 2025; the analysts kept their own category; and the buyers are left with a practice that works the same regardless of vocabulary — classify what you hold, decide who may see which rows and columns, watch what leaves, keep the receipts, and prune access on a schedule. Organisations that want the engineering side of this transition can start with our roadmap to DataOps engineer and architect roles, which covers the pipeline discipline DataSecOps inherits; the governance instincts transfer neatly from our guide on choosing compliance expertise for a business; and readers mapping the wider craft should see how the DevOps career path stacks its skills. For the term’s own record — definition, scope and the tools counted under it — the Ops Atlas page on DataSecOps is the citation to keep. Budgets moved once already. The teams who can say precisely what they protect will be the ones the next round of money finds.
