Automatic discovery and classification of sensitive data on the infrastructure Prowler already audits.
List S3, RDS and DynamoDB datastores. Sample 10 items each. Send to Lighthouse AI. Get back type, confidence and risk score.
Reading S3 / RDS / DynamoDB needs a permission most customers won't hand over. And one hour isn't enough to touch real AWS anyway.
DSPM activates opt-in when the customer grants extended read on a provider. The normal scan is untouched.
New action in each scan's row menu. Opens a Sheet with scan progress, classified datastores, and one-click handoff to Lighthouse.
| Datastore | Classification | Confidence | Risk |
|---|---|---|---|
| s3://acme-customers-prod | PII | 96% | 10/10 |
| s3://acme-payments-archive | Financial | 91% | 9/10 |
| rds://patients-db-primary | Health | 89% | 8/10 |
| s3://acme-marketing-assets | Public | 99% | 1/10 |
BigID is an enterprise data platform: ML-driven discovery and classification across cloud and on-prem, continuous access monitoring, automated remediation, and now AI SPM for LLM pipelines. Sentra is the cloud-native challenger: agentless scanning via cloud APIs, 95%+ classification accuracy, 150+ built-in labels (PII, PCI, PHI, secrets), full data-flow tracking. Both excellent at the data layer. Neither sees whether the bucket holding that data is publicly accessible, unencrypted, or fronted by a permissive IAM policy. That part lives in a different platform. Usually Prowler.
When DSPM ships on Prowler, the customer enables it by granting read access on the AWS provider they already have. After the normal scan, a follow-up task discovers S3 / RDS / DynamoDB resources, samples a handful of objects per datastore, and asks Lighthouse to classify type, confidence and risk. The classification lives next to the infra finding, so one alert reads "PII bucket, public ACL, unencrypted at rest". New classifiers are a prompt change. No new vendor, no agents, no separate DSPM contract.
Prowler already audits. Lighthouse already reasons. An opt-in flag, a follow-up task and one JSONField between them and you have DSPM.
Thanks.