Gartner defines data loss prevention (DLP) as a technical control designed to prevent data loss in order to comply with personal data regulations, prevent unintended disclosure, minimize insider risk and ensure that sensitive data is not overly accessible. DLP controls are typically applied to reduce the data risk for two states of unstructured data: data at rest and data in motion. Depending on the state of the data, DLP applies detective, preventive or corrective controls, including alerting, quarantining, blocking, redaction or access restriction.
Data security posture management (DSPM) discovers previously unknown data across on-premises data centers and cloud service providers (CSPs). It also helps categorize and classify previously unknown and discovered unstructured and structured data. As data rapidly proliferates, DSPM assesses who has access to it to determine its security posture and exposure to privacy, security and AI-usage-related risks. DSPM is delivered as software or as a service.
Gartner defines document management as the tools and practices used to capture, store, process, and access documents and content in support of personal, team and enterprise needs. It is used for a wide range of collaborative and operational purposes, enabling the digital workplace, content collaboration, content-centric processes, content services for enterprise applications and content governance. Gartner estimates that 70% to 80% of enterprise information is unstructured, posing a significant challenge for organizations that must unlock the potential and mitigate the risks of content. Document management tools are critical to enterprise application strategies that need to support unstructured information or content.
Gartner defines an email security platform as a product that secures email infrastructure. Its primary purpose is the removal of malicious (phishing, social engineering, viruses) or unsolicited messages (spam, marketing). Other functions include email data protection, domain-based message authentication, reporting and conformance (DMARC), investigation, and remediation through a dedicated console. These solutions may integrate as a secure email gateway (SEG) for predelivery protection or as an integrated cloud email security (ICES) solution for postdelivery protection. Email security platforms protect an organization’s email infrastructure from social engineering, phishing, business email compromise, spam, malware attacks and data theft. These platforms are deployed independently but integrated with other network and endpoint security controls to improve the overall risk posture of the organization. They offer cybersecurity teams visibility into email-related security incidents for investigation and remediation.
File analysis (FA) products analyze, index, search, track and report on file metadata and file content, enabling organizations to take action on files according to what was identified. FA provides detailed metadata and contextual information to enable better information governance and organizational efficiency for unstructured data management. FA is an emerging solution, made of disparate technologies, that assists organizations in understanding the ever-growing volume of unstructured data, including file shares, email databases, enterprise file sync and share, records management, enterprise content management, Microsoft SharePoint and data archives.
Gartner defines the insider risk management (IRM) market as solutions that use advanced analytics, monitoring, and behavior-based risk models to detect, analyze and mitigate risks posed by trusted insiders within an organization. These solutions monitor the activities of employees, service partners and key suppliers to ensure their behavior aligns with corporate policies and risk tolerance levels. IRM platforms can be delivered as cloud-based services or on-premises solutions, or in hybrid forms. When effectively implemented alongside proper governance, they provide comprehensive visibility, real-time detection, and proactive intervention to safeguard against data theft, fraud and other malicious or unintentional insider threat activities.
Mobile threat defense (MTD) products protect organizations from malicious threats on iOS and Android devices, at the device, network and application levels. To successfully attack a mobile device, mobile malware must circumvent the controls built into mobile OSs, such as those for app store curation and native mobile OS hardening. MTD products tend to focus on preventing and detecting anomalous behavior by collecting and analyzing indicators of compromise, as well as expected behavior. MTD products gather threat intelligence from the devices they support, as well as from external sources, and use an analysis engine that resides in the cloud, on-premises or on an MTD app installed on devices.