Data Classification and Access Governance technology and investment research

Function

Data classification and access governance platforms automatically discover, classify, and label sensitive data across on-premises file servers, cloud storage, SaaS applications, and databases. Access governance extends this by analyzing who has access to what, identifying over-permissioned users, and automating entitlement reviews and access certifications. Together they answer: where is our sensitive data, who can access it, and should they still have that access?

Why it's a bottleneck

Data classification at enterprise scale is a machine learning problem with a compliance deadline. The average enterprise has petabytes of unstructured data scattered across SharePoint, OneDrive, Box, S3 buckets, and legacy file shares. Manually classifying this data is impossible; automated classification must handle hundreds of file types, detect sensitive content (PII, PHI, PCI, IP) with high precision, and do so without disrupting business operations. Access governance adds a graph problem: mapping the permission graph across Active Directory, cloud IAM roles, and SaaS applications to identify toxic combinations (e.g., a contractor with read access to source code AND write access to the build pipeline). Regulatory tailwinds (GDPR data subject access requests, SEC cyber disclosure rules, state privacy laws) make data classification and access governance compliance-mandated, not optional.

Companies

• VRNS — Varonis; data classification, access governance, insider threat detection; strong in unstructured data on Windows/Unix file servers and cloud
• SNOW — Snowflake; Horizon governance for data cloud, classification and tagging within the Snowflake ecosystem
• PANW — Prisma Cloud DSPM (Data Security Posture Management); data classification for cloud environments
• MSFT — Microsoft Purview; data classification and governance for M365/Azure ecosystem

Related technologies

• Identity & Access Management (IAM) — access governance bridges identity (who you are) and data (what you can touch)
• Privileged Access Management (PAM) — PAM governs privileged accounts; data access governance governs all accounts' access to data
• Compliance & GRC — data classification feeds into regulatory reporting and audit evidence collection

Open questions

• [ ] What is VRNS's total addressable market for on-prem unstructured data vs. cloud/SaaS data — and how is the mix shifting?
• [ ] Can Microsoft Purview (bundled with E5) capture the M365-centric data classification market, leaving VRNS with non-Microsoft environments?
• [ ] Does the emergence of DSPM (Data Security Posture Management) as a separate category fragment or expand the data governance market?
• [ ] How does AI-generated data (LLM training data, model outputs) change the data classification challenge — are new classification categories needed for synthetic/sensitive model data?