Independent analyst research
DSPM finds the risk. The next era resolves it.
SACR's new report, "The Agentic DSPM Shift," argues that visibility is no longer enough. The platforms that win will be the ones that can safely fix what they find, and prove it. Teleskope is featured as a representative remediation-first platform.
Author: Lawrence Pingree, Head of Research, SACR | Published October 22, 2026 | 29-minute read
Better discovery created a bigger backlog
DSPM tools got good at mapping sensitive data across cloud, SaaS and collaboration tools. But every new finding lands on a security team that still has to find the owner, check what depends on the data, get approval, and make the change by hand in a different admin console.
SACR calls this the visibility paradox: the more a tool discovers, the longer the queue gets, unless remediation capacity grows at the same rate. As AI copilots, agents and collaboration tools move data faster, waiting days for a ticket to close matters more.
.jpg)
Five findings from the report
Visibility is necessary, not sufficient
Remediation is becoming a primary measure of value in DSPM, alongside discovery and classification.
"Agentic" has to be earned
A chatbot that summarizes alerts is not agentic DSPM. SACR says the claim only holds if the system reduces manual steps under defined authority and produces auditable outcomes.
Separate reasoning from execution
Let AI interpret context and recommend the fix. Let deterministic, tightly scoped controls make the approved change.
Trust comes from context
Whether a fix is safe depends on ownership, identity, intended use, exposure path and business impact, not only on whether the data is sensitive.
Automate in stages
Start with high-confidence, reversible actions such as removing a public link or redacting a payment card number. Expand authority only after the evidence builds up.
Six gates every remediation workflow should pass
SACR evaluates agentic DSPM by workflow, not by vendor slogan. A qualifying workflow has to clear all six.
Observe
Does it watch continuously or on events, not just on a schedule?
Understand
Does it assemble data, identity, ownership, access and business context?
Reason
Can it choose a specific fix and explain why?
Govern
Are authority, approvals, previews and exceptions bounded?
Act
Does it execute the change itself, rather than only opening a ticket?
Verify and learn
Does it confirm the target state changed, keep audit evidence and support rollback?
Why SACR chose Teleskope as an example of remediation-first DSPM
Understand
Classify data in its business context, including document-level understanding and policy ingestion.
Decide
Pick the right action from your policy, with low-confidence cases routed to a person.
Enforce
Act natively, in the same platform.
Actions available today (as described in the report): inform, redact, quarantine, revoke access, relocate, encrypt and delete. Actions are auditable and reversible, and approval thresholds follow each customer's own policy and risk appetite.
Kosmo, in plain terms: Kosmo is Teleskope's AI copilot. It helps teams investigate, prioritize, plan remediation, write policy and report. It cannot change customer systems without human approval. SACR saw it demonstrated in September and notes that the real test is whether it reduces manual work through verified closure. We agree, and we'd rather you test that than take our word for it.
Honest scope: Teleskope remediates natively in supported cloud, SaaS and collaboration environments through APIs. SACR is clear that this is not a universal inline proxy, so teams that need endpoint, browser, network or email prevention should pair Teleskope with complementary controls.
"A strong example of a remediation-first Agentic DSPM architecture."
Ten questions to ask any DSPM vendor about remediation
SACR includes a buyer checklist in the report. A few of the questions:
What can the product do natively, and what only creates a ticket or calls another platform?
Which actions require human approval, and can thresholds vary by risk?
Can you simulate a policy and preview affected objects before anything runs?
Are actions auditable and reversible, and what can't be rolled back?
Does the platform verify the target state changed, or only report that a workflow started?
