Report:
The Forrester Wave™: Data Security Platforms, Q1 2023
How does Forrester define the Data Security Platforms market in 2023?
Data security platforms offer end-to-end capabilities spanning discovery and classification to enabling data controls, but vary greatly in the data control capabilities offered based on the type of data (structured, unstructured, or both) and data environments covered. Both large established vendors and startups offer data security platforms. For some use cases they compete, while in others they are integration partners. It's common to see multiple types of data security platforms in use within enterprise environments, especially large, complex IT environments. Large vendors continue to build integrated single-platform offerings to enable data security controls for all types of data, with many expanding functionality to support security, privacy, and data governance use cases.
Key Facts for The Forrester Wave™: Data Security Platforms, Q1 2023 in 2023
- Publication Date: 21-Mar-2023
- Document ID: RES178465
- Summary: In our 24-criterion evaluation of data security platform providers, we identified the 14 most significant ones — Broadcom, Forcepoint, Fortra, Google, IBM, Imperva, Lookout, Micro Focus, Microsoft, Netskope, Proofpoint, Thales, Trellix, and Varonis — and researched, analyzed, and scored them. This report shows how each provider measures up and helps security and risk professionals select the right one for their needs.
- Authors: Heidi Shey, Amy DeMartine, Sarah Morana, Christine Turley
How did the Data Security Platforms market evolve in 2023?
- Data security platforms offer end-to-end capabilities spanning discovery and classification to enabling data controls
- Platforms vary greatly in data control capabilities based on type of data (structured, unstructured, or both) and data environments covered
- Both large established vendors and startups offer data security platforms
- Common to see multiple types of data security platforms within enterprise environments, especially large, complex IT environments
- Large vendors building truly integrated single-platform offerings to enable data security controls for all types of data
- Many vendors expanding functionality to support security, privacy, and data governance use cases
- Customer references require anywhere from one FTE to a team of 20 FTEs to manage platforms, with 3-5 FTEs being most common
- Vendors must demonstrate robust security and risk management practices including secure software development lifecycle
- Becoming more common for vendors to provide SBOMs and SCA-generated reports upon request
What product features are required to be included in this year's evaluation?
- Notable revenue of at least $100 million in annual revenue related to data security
- A broad range of capabilities for data security for both unstructured and structured data, including built-in capabilities for sensitive data discovery and classification, data risk visibility and insights, and controls for policy enforcement
- A sizeable global presence with at least 20% of data security revenue outside home region
- Interest from and/or relevance to Forrester clients
What are the common features of top products in the Data Security Platforms space?
No common features specified.
Scope Exclusions
- Vendors with less than $100 million in annual revenue related to data security
- Point solutions without broad range of capabilities for both structured and unstructured data
- Vendors without sizeable global presence (less than 20% revenue outside home region)
- Vendors without relevance to Forrester clients or market presence
Inclusion Criteria
Vendors must, among other requirements:
- Notable revenue of at least $100 million in annual revenue related to data security
- A broad range of capabilities for data security for both unstructured and structured data, including built-in capabilities for sensitive data discovery and classification, data risk visibility and insights, and controls for policy enforcement
- A sizeable global presence with at least 20% of data security revenue outside home region
- Interest from and/or relevance to Forrester clients through inquiries, interviews, or use cases
Offering Strengths — Relative Weighting
- Data discovery — 5%
- Data classification — 5%
- Data use insights — 5%
- Data threat and risk visibility — 5%
- Data access controls — 10%
- Data loss prevention — 5%
- Data masking or redaction — 5%
- Encryption — 10%
- Rights management — 5%
- Tokenization — 5%
- Privacy use cases — 5%
- Data and information governance use cases — 5%
- Investigations — 5%
- Manageability and support — 10%
- Integrations for Zero Trust — 5%
- Supplier risk — 10%
Strategy Strength — Relative Weighting
- Product vision — 25%
- Innovation roadmap — 20%
- Commercial model — 20%
- Execution roadmap — 10%
- Supporting products and services — 15%
- Community engagement — 10%
FAQs
Q: What does this research cover?
A: This research evaluates 14 data security platform providers across 24 criteria grouped into three categories: Current Offering, Strategy, and Market Presence. The evaluation covers the largest end-to-end providers of data security capabilities across a wide range of functionality to enable controls for both structured and unstructured data. It assesses capabilities including data discovery, classification, access controls, data loss prevention, encryption, masking, rights management, tokenization, and support for security, privacy, and governance use cases.
Q: Who should use this research?
A: Security and risk professionals should use this research to select the right data security platform provider for their needs. The report helps organizations understand how different vendors measure up across key capabilities and strategic direction. It is particularly useful for organizations seeking to: reduce operational burden of data security management, enable data security controls while minimizing friction for data use, evaluate vendor security practices, and understand the evolving landscape of data security platforms that support security, privacy, and data governance use cases.
Q: What are the mandatory features of vendors included in this market?
A: Vendors must have: 1) At least $100 million in annual revenue related to data security; 2) A broad range of capabilities for data security covering both unstructured and structured data, including built-in capabilities for sensitive data discovery and classification, data risk visibility and insights, and controls for policy enforcement; 3) A sizeable global presence with at least 20% of data security revenue outside their home region; 4) Interest from and/or relevance to Forrester clients through client inquiries, interviews, or applicable use cases.
Q: What are some reasons for not being included in this report?
A:
- Annual revenue below $100 million related to data security
- Limited capabilities focusing only on structured or unstructured data rather than both
- Lack of holistic approach to data security (missing discovery, classification, risk visibility, or policy enforcement controls)
- Insufficient global presence (less than 20% revenue outside home region)
- Limited relevance to Forrester clients or market presence
Q: What should buyers consider when evaluating products in this market?
A:
- Reduce the burden of ongoing operations - consider vendor support quality, UI design, resources for learning and training, ease of policy creation and customization, predefined templates and workflows, alert investigation flow, and UI navigation
- Enable required data security controls while minimizing friction for data use - ensure the platform enforces policies that secure data while enabling data use with minimal friction to generate greater value
- Demonstrate robust security and risk management practices - hold vendors to high standards including rigorous secure software development lifecycle, ability to provide SBOMs and SCA reports, dedicated PSIRTs for vulnerability response
Q: How has the Data Security Platforms market evolved in 2023?
A:
- Large vendors building truly integrated single-platform offerings to enable data security controls for all types of data
- Expansion of functionality to support not just security use cases, but also privacy and data governance (data lifecycle management)
- Platforms serving as centers of gravity for data security policies
- Multiple types of data security platforms commonly in use within enterprise environments
- Focus on reducing burden of ongoing operations and streamlining deployment for fast time to value
- Emphasis on enabling data security controls while minimizing friction for data use
- Increasing vendor focus on robust security and risk management practices including secure SDLC, SBOMs, and PSIRTs
Q: What differentiates Strength of Offering vs. Strength of Strategy?
A: Current Offering evaluates each vendor's position based on the strength of their current product capabilities across data security controls, including discovery, classification, access controls, DLP, encryption, and other data protection features. It measures what the platform can do today. Strategy evaluates the vendor's future direction and ability to execute, including their product vision, innovation roadmap, commercial model, execution capabilities, supporting services, and community engagement. It measures where the vendor is headed and their ability to deliver on that vision.
Reference
- Forrester, The Forrester Wave™: Data Security Platforms, Q1 2023, 21-Mar-2023, ID RES178465
View Leaders
View Vendor Movements
