> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-security-posture-management.md). # Data Security Posture Management Data Security Posture Management (DSPM) continuously discovers data assets, classifies their contents, and assesses configuration and access risk for data at rest across every environment: cloud storage, SaaS applications, on-premises file shares and databases, DBaaS environments, and AI pipelines. It gives you a single, classification-aware view of where your sensitive data lives, how exposed it is, and how to reduce that risk. ## Continuous compliance monitoring Cortex DSPM provides the tools to address complex compliance requirements and avoid regulatory penalties for security standards such as GDPR, PCI DSS, NIST, HIPAA, and others. The platform automates the verification of data residency and sovereignty to ensure data stays within its required geographic boundaries. ## Comprehensive data discovery and classification The platform enables you to discover and visualize all data assets across cloud service providers, SaaS applications, and on-premises data stores. This visibility allows you to understand exactly where sensitive data is, how it is used, and how it moves across the organization. * **Multidimensional classification:** Identify sensitive information including PII, regulated data (PHI, PCI, SOX), and corporate secrets using hundreds of out-of-the-box classifiers. * **AI-powered discovery:** Leverage LLM-based classification for high-context accuracy and OCR (Optical Character Recognition) to detect sensitive data within images and PDFs. * **Deep inspection:** Support for structured, semi-structured, and unstructured data formats across over 100+ file types. * **Centralized visibility:** The Data Security Dashboard and Data Inventory provide a single pane of glass to investigate each individual asset. ## Identity and access intelligence Utilizing the Identity Security module, the platform provides deep insights into which entities, both human and non-human (service accounts and AI agents), have access to your sensitive information. This capability calculates **effective permissions** to ensure data remains in trusted hands and enforces a strict model of least privilege. ## Proactive risk assessment and remediation Reduce the attack surface by identifying and eliminating data threat vectors early in the kill chain. The platform detects critical vulnerabilities such as publicly accessible sensitive data, insecure data movement, and a lack of mandatory encryption or versioning. * **Guided Remediation:** When risks are identified, the platform provides step-by-step instructions or triggers automated playbooks to resolve exposures, such as masking sensitive data, enforcing encryption, or rightsizing over-privileged permissions. * **Unified Policy Engine:** Create a centralized view of exposure issues across multiple cloud deployments, allowing security teams to prioritize measures based on content type and protect data in real time. ## Cloud storage cost optimization The platform helps significantly reduce cloud overhead by identifying "shadow data" that contributes to unnecessary storage expenses. * **Asset rationalization:** Locate orphaned snapshots, shadow backups, and stale assets. * **Freshness analysis:** Automate data retention policy analysis to remove outdated assets and prevent excessive storage costs. * **Financial prioritization:** Manage large inventories by focusing financial efforts on critical resources and optimizing overall cloud utilization. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-security-posture-management.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.