3 Takeaways from Forrester’s 2026 Data Security Platforms Landscape Report

Forrester published a new report, The Data Security Platforms Landscape, Q3 2026, this week. It profiles 31 vendors and confirms what buyers already feel in their bones: As AI reshapes how data is accessed, created, and moved, the DSP has become the load-bearing wall of enterprise security.

Forrester calls the DSP category “mature.” Read that as necessary. The DSP has spent a decade earning its place at the center of the security stack, and it is now the layer everything else in AI security must plug into.

Three takeaways worth internalizing.

1. Agentic AI expanded what a DSP is for

Forrester names agentic AI as both the “main trend” and the “top disruptor” of this category. AI agents are a new class of identity: They access data at machine speed, generate data of their own, and act autonomously. That is not a marginal update to the DSP charter. It is a step change.

The buying group also changed with it. It is no longer just the CISO. Data leaders, AI leaders, and CTOs are in the room, because a DSP must fit inside the data and AI architecture their teams are building.

2. Buyers face a remediation gap, not a visibility gap

The most useful line in the report has to do with actioning what a DSP discovers: Buyers face a persistent gap between fragmented visibility and accountable remediation while keeping data usable.

Translation: Dashboards are cheap, actions are hard. Buyers want DSP findings to trigger real outcomes. Automated remediation at scale is the holy grail in data security. The vendors who win from here are the ones who close the remediation loop without a human in the loop.

3. DSPM is table stakes, enforcement is the platform

The most important move Forrester makes in this report is refusing to conflate DSPM with the full job of keeping data secure. DSPM tells you what data you have, where it lives, and whether there are basic security posture issues that put the data at risk. But data discovery is not data security.

Forrester’s DSP definition goes further, and it is the right frame:

Read the last clause again: enforce policies for data access, use, and lifecycle management. That is the line between a report and a control plane. Between “you have exposed customer data in this SharePoint site please go fix it” and “we revoked 1M excessive permissions automatically and nothing broke.”

Customers do not need another dashboard telling them their data is at risk. They need a platform that will do something about it. Forrester’s broader definition finally puts the enforcement half of the job on the same page as the discovery half, where it belongs.

Forrester's Landscape also folds in functionality such as database activity monitoring and data-centric threat detection into the category, which should be core capabilities of a DSP, not adjacent tools.

Where Varonis lands

Last year, Forrester named Varonis a Leader in The Forrester Wave™: Data Security Platforms, Q1 2025. If the market is moving toward continuous, integrated, action-taking data controls that keep humans and agents inside the guardrails, that is the fight we picked years ago. One platform, delivered as multitenant SaaS, doing both discovery and enforcement in the AI era.

If you have a Forrester subscription, you can read the full report here.

Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here.