AI Data Security, DSPM, RAG Permission Governance, and Enterprise Knowledge Base Security

Core Conclusions

• Data security is moving from a "compliance afterthought" to the primary control plane for enterprise AI adoption. Microsoft 365 Copilot, Copilot connectors, Azure AI Search, Databricks Unity Catalog, Snowflake Horizon, AWS Bedrock Guardrails, and Google Cloud DSPM are all pushing "data permissions, labels, classification, auditing, and filtering" upstream into the AI call chain, rather than bolting security on after the model. Microsoft states explicitly that Copilot will only return organizational data the user has "at least view permission" to; connectors and Azure AI Search likewise place ACLs, permission filtering, and token-based authorization at the retrieval stage.

• Once enterprise AI, RAG, and agents spread, the first thing exposed is not a "model capability" bottleneck but the "over-shared data surface" and the "ungoverned permission surface." Copilot, RAG, and agents do not redefine a new enterprise permission system; they amplify the misconfigured sharing and overly broad authorization already sitting in SharePoint, OneDrive, email, tickets, CRM, databases, data lakes, and knowledge bases. Microsoft, Azure AI Search, Elastic, Databricks, and Snowflake all stress document-level security, row filters, column masks, ACL/DLS, ABAC, and sensitivity labels as prerequisite capabilities in their official documentation.

• DSPM, DLP, DDR, data access governance, and RAG permission governance are not parallel sectors; in the AI era they string together into one chain. DSPM finds "where the sensitive data is, who can access it, and whether it is exposed"; DLP intercepts "exfiltration"; DDR detects "anomalous access and movement"; access governance and RAG permission control ensure "only the right people and agents see the right content." Google Cloud DSPM, IBM Guardium, Rubrik DSPM, OpenText, Thales, Broadcom, Cloudflare, and Microsoft Purview are all converging on this chain.

• AI agent security is fundamentally a crossover problem of "identity security + data permissions + tool-call governance." AI agents add large numbers of machine and non-human identities; CyberArk reports machine identities already reach 82:1, and its 2025 identity security report names AI as the leading source of new privileged identities; CrowdStrike's $740 million acquisition of SGNL places human, NHI, and AI identities directly inside a continuous identity control framework; Microsoft, Databricks, Cloudflare, and Anthropic all treat the permissions and auditing of agents, MCP, or connectors as core elements.

• The first budgets to materialize are not "pure AI security stories" but four categories tightly bound to the existing data surface: Microsoft 365 / SharePoint / OneDrive permission cleanup and classification; multi-cloud / SaaS DSPM; GenAI DLP / prompt DLP; and document-level security for high-value RAG / enterprise search. These budgets connect directly to Copilots, knowledge-base assistants, customer-service assistants, developer assistants, internal search, and compliance auditing already in production.

• Platform winners and AI-native challengers will coexist. The platform winners are mainly Microsoft, Google/Wiz, AWS, Snowflake, Databricks, Oracle, IBM, Palo Alto, CrowdStrike, and Cloudflare; the AI-native challengers are mainly Cyera, BigID, Sentra, Concentric AI, Securiti, Privacera, Veza, Noma Security, and Lasso Security. The former rely on distribution, identity, cloud, data platforms, and existing customer bases; the latter rely on stronger data discovery, data graphs, cross-cloud and cross-SaaS coverage, AI-native governance, and faster iteration.

• There are not many listed companies that directly benefit with financial validation already in hand. Varonis, CyberArk (acquisition by Palo Alto completed), Snowflake, MongoDB, Elastic, Trend Micro, Cloudflare, CrowdStrike, Palo Alto, Microsoft, and Google Cloud all have clearer product-customer-platform paths; yet many of them do not break out "AI data security revenue" as a line item, and it shows up more as platform expansion, RPO/cRPO, large customer deals, and higher product attach rates.

• Companies with a "strong AI data security narrative but insufficient revenue evidence" clearly outnumber the genuinely quantifiable beneficiaries. Cloudflare's AI-SPM / prompt protection, Palo Alto's Prisma AIRS, CrowdStrike's Falcon Data Security, BigID's AI governance, and companies like Noma/Lasso/Prompt Security move fast on product, but most do not publicly break out ARR or revenue contribution; for investment, weight "whether it is embedded in the strong distribution chain of an existing large platform" over release count alone.

• The sectors with the greatest revenue elasticity are: multi-cloud DSPM, enterprise knowledge base permission governance, agent data access control, GenAI DLP, and data access governance. These sit closest to existing budgets and are most tightly bound to the real-world adoption of Copilot, internal search, data lakehouses, and externally connected SaaS systems. By contrast, vector database security, AI memory security, privacy-enhancing computation, and confidential computing remain proof-of-concept or specialized purchases at many enterprises.

• The best long-term margins live not in scanning itself but in the "control plane." Specifically: the permission graph, label/classification engine, policy engine, retrieval authorization, access auditing, key and encryption orchestration, and a unified AI Gateway/Policy plane. These layers are inherently more software-like and platform-like, and easier to reuse across multiple use cases. Databricks Unity Catalog, Snowflake Horizon, Microsoft Purview, Oracle Deep Data Security, and Thales CipherTrust all reflect this.

• The most bubble-prone valuations are: high-growth security platforms that talk "AI security" without clear revenue attribution; and the "high funding + low transparency" names among private AI-native security companies. Cyera has already risen to a $9 billion valuation in early 2026, and Databricks' Series K in 2025 valued it above $100 billion; the fundamentals of such names may be excellent, but the market has already paid for a great deal of expectation in advance.

• Platform squeeze will be very pronounced. Google Cloud has already built DSPM into Security Command Center; Microsoft binds Purview, Copilot, Graph connectors, and Azure AI Search into one whole; Snowflake, Databricks, and Oracle are also unifying vector retrieval, catalog, labels, permissions, auditing, and AI Gateway into the data platform. Standalone tools that cannot deliver better graphs, precision, and remediation across cloud, SaaS, and data surfaces will be absorbed by the platforms.

• Those at the highest risk of being disrupted are traditional point DLP, static data governance, and weak-graph compliance tools. Broadcom Symantec DLP, legacy email/endpoint DLP, tools that do catalog only without runtime access control, and tools that produce only passive compliance reports will all be squeezed by the platform-style unified "classification + permission + retrieval + logging + policy" control plane.

• The biggest catalysts over the next 12–24 months are: production deployment of in-house Copilots and agents; product integration after Wiz is consolidated into Google Cloud; cross-selling of the AI data protection components of Palo Alto / CrowdStrike / Cloudflare; the native permissioning of Snowflake Horizon and Databricks Unity Catalog for agents/RAG; and a continued wave of large data security M&A.

• The biggest risks over the next 12–24 months are: enterprise AI projects falling short on going into production; customers prioritizing models and compute over governance; platform-native features descending in price or going free; insufficient data classification precision causing false blocks; and cross-border data and AI regulation tightening in tandem. The EU AI Act will become fully applicable on August 2, 2026 (with exceptions for some provisions), the U.S. DOJ's bulk sensitive data rule has taken effect, and China's cross-border data rules continue to tighten.

Value Chain Landscape and Demand Re-rating

The reason data security becomes the core bottleneck once enterprise AI, RAG, and agents are deployed is not that enterprises suddenly "care more about security," but that AI turns what used to be dispersed, static, low-frequency data access into high-frequency, cross-system access amplified by reasoning. Microsoft states clearly that Copilot uses a user's files, email, chats, meetings, and other context through Microsoft Graph; as long as the user has permission, Copilot will use this content as grounding data. For enterprises, this means files that were historically "shared with too many people but never actively sought out" become highly reachable data that "a single natural-language question can surface and summarize."

RAG amplifies this problem further. Microsoft 365 Copilot connectors and Azure AI Search both make "document-level permissions" a core mechanism; Databricks Unity Catalog recommends using ABAC for centralized row/column filtering; Snowflake uses row access policies, dynamic masking, and tag-based masking; Elastic provides document-level / field-level security; Oracle's 26ai introduces Deep Data Security, binding row/column/cell-level access control directly to agentic AI. This is itself an industry signal: if permission inheritance were not a hard problem, platforms would not be rolling out these controls so densely. The difficulty here is that embedding, indexing, retrieval, rerank, and tool use often happen outside the original data, so ACLs, labels, identities, group information, and sensitivity metadata must be synchronized explicitly—otherwise the vector index becomes a "second data surface" detached from source-system authorization. This judgment is an industry inference based on each platform's product design.

The risk introduced by AI agents is more complex than RAG. RAG is mainly "read"; agents may "read + write + call tools + call APIs + persist memory + execute autonomously." Anthropic defines MCP as an open connection standard between AI tools and data sources; Databricks positions Unity AI Gateway as a unified governance layer across LLMs and MCP; Cloudflare released Mesh to protect the AI agent lifecycle; Palo Alto folded Portkey into Prisma AIRS; CrowdStrike, through SGNL, extends continuous identity control to AI identities. The industry's product roadmap already makes the point: agent security is not an extension of traditional prompt protection, but runtime data access governance.

The table below lays out the AI data security value chain from an investment perspective, focusing not on "who can tell a story" but on who sits in the control plane, who can charge for it, and who can build a platform moat.

The chain above also explains how budget boundaries are shifting: budgets that used to belong to IAM, DLP, SaaS security, cloud security, data governance, and GRC are being repackaged under "AI data security." The most direct change is that customers no longer just ask "do you have DLP," but instead ask "will Copilot see content it shouldn't," "can the agent read but not write," "is the RAG permission-aware," "are prompts and outputs audited," and "does the vector index inherit source permissions."

Under three scenarios, the budget path looks roughly as follows:

The base scenario is the most credible investment assumption right now: AI data security will become a standalone budget pool, but it will not become a fully isolated standalone market—instead it will compete for the control surface alongside identity, cloud, security platforms, and data platforms.

Technical Architecture and Sector Breakdown

Looking at an enterprise-grade AI data security system disassembled, the most valuable part is not a "single detection point" but the continuous control chain from discovery, classification, and permission inheritance through to auditing and response. The table below consolidates the 17-layer architecture requested into a single investment framework.

Building on this architecture chain, the 30 segments raised can be compressed into five investment clusters most worth tracking:

Among these, the layer most likely to form a durable moat is the integrated control plane of "data permission graph + classification labels + retrieval authorization + log auditing"; the layer most likely to be replaced by cloud-vendor built-ins is basic scanning, baseline checks, and point prompt DLP; the layer most likely to produce "good product but hard to monetize" is AI security point products that only detect without closing the loop on disposition. This judgment is consistent with the trend of platforms like Google, Microsoft, Databricks, Snowflake, and Oracle continuing to build governance capabilities into the data plane and the AI plane.

Company Tiering and Investment List

First, a high-density investment list. Here I tier by "direct beneficiary / indirect beneficiary / platform beneficiary / AI-native challenger / at risk of platform squeeze," and try to separate "product releases" from "revenue landing."

Priority Research Matrix for Listed Companies

Important Private Company Observation Matrix

Looking at the investment tiers:

• Category A: core direct beneficiaries of AI/RAG/Agent data security—Microsoft, Google/Wiz, Varonis, Snowflake, Databricks (private), Cyera, BigID, and the Privacera/Veza path. The common trait: they sit at the core of the data control surface and connect directly to enterprise knowledge bases, lakehouses, retrieval, permissions, and catalogs.

• Category B: clear beneficiaries, but with higher valuation or platform-squeeze risk—Palo Alto, CrowdStrike, Cloudflare, MongoDB, Elastic, Oracle, Trend Micro, Sentra, and Concentric. The common trait: products are strongly correlated with demand, but AI data security may not yet be broken out as a primary financial driver.

• Category C: more defensive beneficiaries—IBM, Okta, Thales, Broadcom, OpenText, and AWS. Capabilities matter, but near-term financial elasticity is not necessarily the strongest.

• Category D: strong narrative, insufficient financial validation—a large number of "AI security startups" and platform add-on modules, especially companies that only do a prompt firewall, LLM scanning, or an advisory layer.

• Category E: high risk of platform consolidation—traditional point DLP, catalog-only tools, weak runtime governance products, and data governance tools that lack a permission graph and remediation.

Key Listed Companies and Valuation Observations

Below are the 15 listed companies most worth continued secondary research. Because many companies do not break out AI data security revenue, the following is better treated as a "research-priority and expectation-gap list" than a simple valuation table.

Based on the table above, valuation and expectation gaps can be simplified into a rough judgment:

• Expectations already fairly fully reflected: CrowdStrike, Palo Alto, Cloudflare, Databricks (private), Cyera. Their common feature is a strong platform narrative, dense funding/M&A, and high market sentiment.

• Possible expectation gap remaining: Varonis, Elastic, Oracle, some of Snowflake / MongoDB's security sidelines, and non-listed permission governance paths like Veza/Privacera. Their common feature: capabilities are already critical, but the market still prices them mainly on "existing business."

• Good companies but valuations too expensive: CrowdStrike, Cloudflare, and parts of Palo Alto. Current share price, market cap, and market sentiment are all high, so near-term performance depends more on expansion speed beating expectations.

• Revenue growth real, valuation relatively still researchable: Varonis, Elastic, MongoDB, and parts of Snowflake. "Relatively" is the operative word here, not "cheap."

Scoring Model and Current Ranking

I adopt the suggested weights with slight simplification: AI/RAG/Agent revenue exposure 25% + platform position and customer base 20% + permission/classification/governance moat 15% + product coverage 15% + financial quality 10% + growth elasticity 10% + valuation reasonableness 5%.

Given the current materials, the overall ranking (research priority, not investment advice) is roughly as follows:

In the reverse scoring for "platform consolidation risk," the highest risk is usually: point DLP, point AI-SPM, products that only do prompt/output filtering, catalog-only tools, and weak permission-graph governance vendors. The reason is that Microsoft, Google, AWS, Snowflake, Databricks, and Oracle have already pulled the key features into their platforms.

Risks, Open Questions, and Final Conclusions

The biggest risk is not that "the security demand does not exist," but in what form the demand takes, who captures it, and when it shows up in the financials. From current public materials, five most important investment judgments can be summarized.

First, AI data security will become the core control plane of the enterprise AI era, but it is not a standalone isolated market. It will deeply integrate with identity security, cloud security, data platforms, enterprise search, knowledge bases, and compliance auditing. In other words, it is more like a "control plane layer" than a forever-standalone single-product market.

Second, there are only five segments genuinely worth attention. They are: multi-cloud DSPM, data access governance and permission graph, RAG/enterprise search permission governance, GenAI DLP/agent runtime control, and AI data governance and compliance. This is the most central industry distillation of this report.

Third, the ten listed companies most worth in-depth research, ranked by "certainty × elasticity × platform position," in suggested priority order: Microsoft, Google/Alphabet, Palo Alto Networks, CrowdStrike, Varonis, Snowflake, MongoDB, Elastic, Oracle, Cloudflare. Among them, Microsoft/Google/Snowflake lean toward platform certainty, Varonis/Elastic/Oracle lean toward the expectation gap, and PANW/CRWD/NET lean toward high elasticity and high expectations.

Fourth, the ten private companies most worth continuous tracking are: Cyera, BigID, Sentra, Concentric AI, Securiti, Privacera, Veza, Noma Security, Immuta, Lasso Security. Among them, Cyera/BigID/Veza/Privacera have the highest strategic value; Noma/Lasso lean toward AI-native high-risk, high-payoff; and Immuta/Securiti need more validation of their growth curve.

Fifth, the five points the market most easily misunderstands are: one, AI data security is not the same as model security; two, prompt DLP is not the whole picture; three, vector databases do not naturally inherit source permissions; four, Copilot is not "secure," it "faithfully executes existing permissions"; five, what truly makes money is the control plane, not point detection.

Over the next 6–12 months, the metrics most worth tracking include:

• Whether public companies begin to break out ARR, RPO, cRPO, and customer counts for AI data security / data protection / AI governance / identity for AI.

• New permission and audit features in Microsoft Purview, Google Cloud DSPM, AWS Bedrock Guardrails, Snowflake Horizon, and Databricks Unity Catalog / AI Gateway.

• Whether customers move RAG and agents from pilot to production; whether they begin to require document-level security, approval workflow, payload logging, and retention control.

• Whether major M&A keeps happening on the DSPM / identity-data governance / AI gateway / RAG access control front line. Google-Wiz, PANW-Protect AI/Portkey, and CrowdStrike-SGNL have already pointed the direction.

Open Questions and Limitations

This report has tried to compress the conflict between "broad and comprehensive" and "verifiable," but several types of information still have not been adequately disclosed by public companies:

• Most companies do not break out AI data security revenue, and it can only be inferred from product releases, customer scenarios, platform attach rates, and RPO/ARR; "releases" must not be mistaken for "revenue."

• Some traditional vendors and regional companies (especially A-shares, Hong Kong shares, Europe, Japan, Korea, and India) have insufficient AI data security granularity in this round of public materials, and are better placed on a second-round verification list than turned into strong conclusions this round.

• Vector database security, agent memory security, privacy-enhancing computation, and confidential computing remain early-stage for now; they may be important in the short term but will not necessarily form a large revenue pool immediately.

Final Conclusion

If you single out the links in the AI value chain that can genuinely form a long-term profit pool, data security, DSPM, RAG permission governance, data access governance, and enterprise knowledge base security are the cluster that most deserves attention. They determine whether enterprise AI can move from demo to production, whether Copilot and agents can touch core data, and who bears the future regulatory and audit risk.

For investment, the narrower follow-on directions most worth prioritizing converge to four main lines:

DSPM, GenAI DLP, RAG permission governance, and agent data access control. These four main lines have both clear demand and the best odds of converting into revenue, platform attach rate, RPO/cRPO, and margin improvement over the next 12–24 months.

This report is based on public information and does not constitute investment advice. Markets carry risk; invest with caution.