31 vendors, one gap: Forrester's Q3 2026 DSP landscape puts the problem in remediation, not discovery

Count the clauses in the definition Forrester supplies and the misallocation becomes arithmetic. Four capability clauses: understanding data and its sensitivity, surfacing and generating insights about its use, providing visibility of risks and threats, and implementing data-centric controls that enforce policy for access, use and lifecycle management ^[7]. Three of the four describe knowing. One describes doing ^[15]. That ratio is also roughly the shape of most data security spend, and the finding Varonis pulls out of the report is that knowing is not where buyers are stuck ^[6].

The mechanism behind the stall is not mysterious. A discovery finding has no blast radius; revoking access does. Varonis illustrates the difference with the line "we revoked 1M excessive permissions automatically and nothing broke" ^[13], though that figure appears as rhetoric rather than a result, with no customer, date or dataset attached to it ^[14]. The underlying asymmetry holds regardless. An unactioned dashboard fails invisibly until there is a breach; an over-eager automated revocation fails visibly, to everyone, inside the hour. That is why Varonis can describe automated remediation at scale as the holy grail of the category and still be describing an unsolved problem ^[17].

Agentic AI is what makes the asymmetry expensive. Per Varonis's reading, Forrester names it both the main trend and the top disruptor of the category ^[3], and treats AI agents as a new class of identity that reaches data at machine speed and produces data of its own ^[4]. A remediation queue that a human works through is a throughput ceiling once the thing generating exposure does not sleep.

The buying group shifts with it. The room now holds four named constituencies rather than one, with data leaders, AI leaders and CTOs joining the CISO because the platform has to sit inside the data and AI architecture those teams are already building ^[5][16]. More sign-offs means longer cycles and a different evaluation, one where the security team is no longer the only party with a veto.

Forrester also pulls database activity monitoring and data-centric threat detection inside the category boundary ^[8]. For anyone selling either as a standalone product, that is a reclassification from product to feature, in a category Forrester calls mature and still counts 31 vendors in ^[1][2].

One caveat that is load-bearing: all of this arrives through a post by Varonis, which Forrester named a Leader in its Q1 2025 Data Security Platforms Wave ^[10]. The report itself needs a Forrester subscription ^[11], and Forrester's own boilerplate says it does not endorse vendors or advise anyone to buy on the strength of its ratings ^[12]. A reading that says enforcement is the real job is a convenient reading for a vendor selling enforcement. It is also cheap to test without a subscription: the number of policy changes an incumbent platform made last quarter with no human approving each one.