01 / 07
navigate  ·  space advance
Prowler · Off-site Hackathon · Team 3

DSPM with Lighthouse AI

Automatic discovery and classification of sensitive data on the infrastructure Prowler already audits.

Time budget 60 minutes
Honesty 100% mocked, 0% cheating
The setup

Discover, sample, classify.
In one hour. With a catch.

The brief

List S3, RDS and DynamoDB datastores. Sample 10 items each. Send to Lighthouse AI. Get back type, confidence and risk score.

The catch

Reading S3 / RDS / DynamoDB needs a permission most customers won't hand over. And one hour isn't enough to touch real AWS anyway.

DSPM has to be opt-in. That's the only architectural decision we keep honest. The data is mocked; the way we'd ship it isn't.
How it would really ship

An extra task after the scan.

DSPM activates opt-in when the customer grants extended read on a provider. The normal scan is untouched.

01
Provider creds
+ S3/RDS/Dynamo read (opt-in)
02
Prowler scan
The normal check scan
03
DSPM task
Discover + sample per datastore
04
Lighthouse AI
Classifies type, confidence, risk
05
Resource.dspm
Persisted as JSONB, visible in UI
Deliverable 01

Same CLI as prowler.

~/prowler · python scripts/dspm_scan.py
python scripts/dspm_scan.py --provider aws --service s3,rds,dynamodb --verbose Prowler DSPM Scan v0.1.0 · powered by Lighthouse AI [+] Discovering datastores in AWS account 123456789012 S3: 3 · RDS: 3 · DynamoDB: 3 [+] Classifying samples with Lighthouse AI . . . [1/9] s3://acme-customers-prod PII conf=0.96 risk=10/10 [2/9] s3://acme-payments-archive Financial conf=0.91 risk=9/10 [3/9] rds://patients-db-primary Health conf=0.89 risk=8/10 [. . .] Wrote ./dspm-output/dspm-catalog.json + dspm-report.html Summary: 3 PII · 2 Financial · 1 Health · 3 Public · top risk 10/10
Deliverable 02

Where the customer already looks.

New action in each scan's row menu. Opens a Sheet with scan progress, classified datastores, and one-click handoff to Lighthouse.

DSPM Analysis · powered by Lighthouse AI
Datastore Classification Confidence Risk
s3://acme-customers-prod PII 96% 10/10
s3://acme-payments-archive Financial 91% 9/10
rds://patients-db-primary Health 89% 8/10
s3://acme-marketing-assets Public 99% 1/10
Where we fit

What BigID and Sentra do. What Prowler will do.

BigID · Sentra

BigID is an enterprise data platform: ML-driven discovery and classification across cloud and on-prem, continuous access monitoring, automated remediation, and now AI SPM for LLM pipelines. Sentra is the cloud-native challenger: agentless scanning via cloud APIs, 95%+ classification accuracy, 150+ built-in labels (PII, PCI, PHI, secrets), full data-flow tracking. Both excellent at the data layer. Neither sees whether the bucket holding that data is publicly accessible, unencrypted, or fronted by a permissive IAM policy. That part lives in a different platform. Usually Prowler.

Prowler + Lighthouse

When DSPM ships on Prowler, the customer enables it by granting read access on the AWS provider they already have. After the normal scan, a follow-up task discovers S3 / RDS / DynamoDB resources, samples a handful of objects per datastore, and asks Lighthouse to classify type, confidence and risk. The classification lives next to the infra finding, so one alert reads "PII bucket, public ACL, unencrypted at rest". New classifiers are a prompt change. No new vendor, no agents, no separate DSPM contract.

What you see is a demo.
What we're telling you isn't.

Prowler already audits. Lighthouse already reasons. An opt-in flag, a follow-up task and one JSONField between them and you have DSPM.

scripts/dspm_scan.py ui/components/dspm/* hackathon/DSPM_VS_BIGID.md

Thanks.