DSPMCloud & Data Security

Know where your data lives — without moving a byte of it.

Netgraph's DSPM discovers, classifies and monitors sensitive data across the cloud estate and on the endpoint itself. The unified endpoint agent scans path-scoped locations on-host and sends back only classification labels — file contents never leave the machine. Classified locations become nodes on the security knowledge graph, so every alert can answer the question that actually sets its priority: does this host hold PII?

Cloud + endpoint coverageLabels leave, contents don'tIndia-first recognizer packsData nodes on the graphDPDP Act 2023-aligned

Book a demo →Why Netgraph →

What ships in the module

Classification that the whole platform consumes.

On-host discovery

DSPM runs inside the unified endpoint agent — no extra deployment, no data pipeline hauling files off machines. Discovery is path-scoped with include, exclude and custom paths, configured centrally via Fleet policy.

Privacy-preserving by design

Only classification labels leave the host — file contents never do. You learn that a laptop holds Aadhaar numbers without a single Aadhaar number ever transiting your security stack.

India-first recognizers

Out-of-box recognizer packs for the identifiers that matter here: Aadhaar, PAN, bank account, passport and health identifiers — multi-select configuration, and the agent-side classifier actually applies them at scan time.

Custom recognizers

Add your own patterns alongside the shipped packs — internal record formats, customer IDs, whatever your business considers sensitive — and roll them out through the same Fleet policy.

Data on the graph

Classified data locations become nodes on the security knowledge graph. An alert on a host is one edge away from "does this host hold PII?" — and blast-radius calculations include data sensitivity, not just connectivity.

UEBA risk input

DSPM feeds UEBA entity risk — a user behaving anomalously on a host that holds sensitive data scores differently from the same behaviour on a kiosk. Sensitivity becomes a factor, not a footnote.

DPDP evidence trail

Classification results feed the compliance evidence trail with DPDP Act 2023-aligned handling — where personal data lives, how it was discovered, and what watches it.

Cloud estate coverage

The same discover-classify-monitor discipline applies across the cloud estate — so a public bucket finding in CSPM knows whether the bucket holds classified financial data or cat pictures.

Policy in, labels out

One Fleet policy. Every host classified. Zero contents exfiltrated by your own tooling.

You define scan scope and recognizers once in Fleet policy; the agent-side classifier applies them at scan time on each host. What returns is a compact map of labels and locations — enough to drive graph context, UEBA risk and DPDP evidence, and nothing an attacker (or an auditor) could mine for the data itself.

Path-scoped: include / exclude / custom paths per policy.
Multi-select recognizer packs — Aadhaar, PAN, bank account, passport, health — plus custom.
Labels-only telemetry: classification results, never file contents.
Results land as graph nodes and flow to UEBA risk and compliance evidence.

Functionality map

Module functions at a glance

Function	What it does	Where it lives
Data discovery & classification	Discover, classify and monitor sensitive data across cloud estate and endpoints	DSPM pages
Endpoint scan policy	Path-scoped discovery — include / exclude / custom paths — pushed to the unified agent	Fleet policy (Fleet Manager)
Recognizer packs	Aadhaar, PAN, bank account, passport, health identifiers — multi-select, plus custom recognizers	Fleet policy ▸ DSPM configuration
Labels-only telemetry	Agent-side classifier applies recognizers at scan time; only labels leave the host	Unified endpoint agent
Graph fusion	Classified locations become graph nodes; blast radius includes data sensitivity	Security knowledge graph
UEBA risk factor	Data sensitivity feeds entity risk scoring	UEBA entity risk
Compliance evidence	DPDP Act 2023-aligned evidence trail of where personal data lives	Compliance / DPDP evidence

See it live

Scan one fleet. Learn which alerts actually touch PII.

Book a demo →Browse all modules