DSPM Architecture Fit Tool

Question 1 of 4

Where does the majority of your sensitive data estate live?

Primarily cloud and SaaS

AWS, Azure, GCP, Snowflake, Salesforce, Microsoft 365 — data is almost entirely in cloud infrastructure and SaaS applications

Significant mix of cloud and on-premises

Cloud environments alongside Windows file servers, NAS, SharePoint on-premises, or on-premises databases that contain sensitive data

Primarily on-premises

The majority of sensitive data is in on-premises systems: file servers, NAS, legacy databases, mainframes

Question 2 of 4

What is the primary threat scenario driving this evaluation?

Data exposure and misconfiguration

Finding sensitive data in overly permissive, publicly accessible, or ungoverned locations — before an incident occurs

Behavioral threat detection

Detecting anomalous access patterns, insider threat, ransomware staging, or compromised credentials acting on sensitive data in real-time

Compliance and privacy operations

Meeting regulatory requirements, supporting DSAR workflows, producing audit evidence, or managing a formal data governance program

Question 3 of 4

Is there an existing CNAPP (like Wiz or Prisma Cloud) already deployed?

Yes — Wiz is the primary CNAPP

The organization is already a Wiz customer; Wiz is the main cloud security platform

Yes — another CNAPP is deployed

Prisma Cloud, Orca, SentinelOne, or another CNAPP is in use; DSPM is a separate evaluation

No CNAPP is deployed

DSPM is being evaluated independently; no existing CNAPP integration to consider

Question 4 of 4

What is the team's capacity to manage an agent or collector deployment?

Low — prefer minimal deployment overhead

No capacity for agent lifecycle management; need a platform that connects without deploying software on managed systems

Moderate — some deployment overhead is acceptable

The team can manage a limited collector deployment if the coverage benefits justify it

High — full agent deployment is feasible

Infrastructure operations team can deploy and manage collectors across the environment; this is not a constraint