Data Security Posture Management (DSPM) Simulator

DSPM Scan Control

Filter by Data Type

PII

PCI

PHI

Discovery Progress

Stores scanned

0 / 0

Shadow data found

Sensitive records

Critical risk

Data Risk Map

Run a scan to populate the risk map — sensitivity × public access × missing encryption.

How it works

A DSPM scanner crawls every storage asset it can reach — declared buckets and databases, plus "shadow data": undocumented backups, test dumps and forgotten clones nobody registered. For each object it runs pattern-matching classifiers (credit-card checksums, SSN-shaped digit groups, medical record codes) to tag PII, PCI or PHI content, then folds that into a risk score.

risk = sensitivity_weight
     × (public_access ? 2 : 1)
     × (encrypted ? 0.4 : 1)

Sensitivity — none / PII / PCI / PHI, discovered by the scanner's pattern classifiers as it visits each store.
Shadow data — dim, unlabeled nodes with no owner metadata; the riskiest surprises tend to hide here.
Access exposure — a red access ring means the store is reachable without internal credentials.
Encryption — an open lock icon means data at rest is unencrypted, multiplying any sensitivity risk.

Real-world relevance: DSPM tools (a defined cloud-security category) exist because sensitive data sprawls across accounts faster than manual inventories can track it — the highest-value finding is usually a forgotten copy nobody knew was exposed.

Scanning storage estate…0%

Unscanned store PII detected PCI detected PHI detected Shadow data

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.