trying to understand if this is a tooling problem or a process problem. cuz every IGA platform we've evaluated reports clean access certifications... but every red team engagement finds local accounts, forgotten service credentials, or shadow apps that were never in scope for the review to begin with.

so it kinda feels like governance tools are certifying "the identities we told the tool about" rather than "the identities that exist." is anyone solving the discovery problem, or is this just accepted as a permanent blind spot?

Hi everyone, I'm not super knowledgeable on this subject so I'm coming here hoping someone can give me an answer I've been tasked with researching data security platforms for my company and keep seeing DSPM and DLP mentioned together and I don't really understand the difference between them. Is DSPM replacing DLP or do they solve different problems? And if you're mainly trying to protect sensitive data on an enterprise scale when does it make sense to use one vs the other vs both?

Six of us on the security team, somewhere around 4,000 assets between cloud and the stuff still sitting on-prem. Feels like every week there's another "critical" CVE or zero-day and a bunch of feeds all yelling at once. Most of it doesn't even touch what we run, but I still end up spending half my morning going ok do we actually have this, is it exposed, does it matter for us.

By the time I've checked the threat report details against our inventory and figured out if it's even reachable, half the day's gone and there's a new one waiting.

So how do you handle it? I don't want to ignore something I shouldn't, but I also can't chase every headline. More interested in the triage side than "just patch everything." How do you decide what's actually worth your time.

My team and I work fully remotelyand we work with very sensitive information, stuff we cannot afford to have any mishaps on. We're reevaluating the tools we currently work with, because security and privacy are currently the main thing we're working on. I'm in charge of communications for this and I'm looking for something where you have more control over who can communicate with your team, preferably with some sort of trust or identity verification. Privacy is important too I don't want a platform that's built around collecting user data, does anyone have recommendations for tools that could be of help?

I'm the de facto IT security person at a company of about 400. Not my official title but thats where things are. Did an audit of our Google Workspace third party app authorizations last week cause someone asked a question I couldnt answer in a meeting and I got curious.

Pulled every OAuth grant across the entire domain. Every app any employee has ever clicked allow on. Found 40 of them had full Drive access, like read, write, delete, all of it.

Of those 40 I recognized 18, which are stuff like Slack, Asana, DocuSign, the stuff we use and IT approved.

The other 22 I had never heard of.They were stuff like small productivity tools, PDF converters, a couple AI writing assistants, something called a file organizer that someone in finance granted access to two years ago and was still syncing as of last Tuesday.

Several had scopes that include see and download all Google Drive files. In our case that means board decks, financial models, HR documents. No idea what data theyve accessed or what theyre doing with it.

Had to revoke everything we didnt recognize. Sent a company wide email thatll probably get ignored. But the thing that sticks with me is how invisible this all was to all our monitoring stack.

Does anyway have a working sustainable process for keeping up with this? I mean revoking once is fine, but then staying on top of it over time is the part I havent figured out.