SecureSky Acquires Soveren, Bolting Real-Time DSPM onto Its Exposure Management Platform

SecureSky, a provider of Exposure Management and AI-based Managed Detection and Response (MDR) services, has acquired Soveren, a Data Security Posture Management (DSPM) startup whose technology goes beyond the now-commodity at-rest scanning model that dominates the category.

Soveren’s Data Security Platform combines conventional at-rest DSPM with real-time, eBPF-based network analysis, giving customers visibility into sensitive data both at rest and in motion. That in-motion piece is the interesting part: rather than relying purely on periodic scans of storage buckets and databases, Soveren inspects and classifies encrypted TLS traffic at scale with reportedly zero impact on production systems — directly targeting the false-positive fatigue that has dogged regex- and pattern-based classifiers for years. The platform also tracks usage anomalies and changes in third-party data flows across cloud and on-prem environments, pushing it closer to DDR (data detection and response) territory than classic DSPM.

Soveren’s customer list includes Booking Holdings’ Agoda and OpenTable, and the company had raised a relatively modest $10 million from a notably well-connected investor base — including founders and CEOs from Airbnb, Slack, Datadog, Palo Alto Networks, MuleSoft, and Deel, along with Sir Richard Branson’s family office and European VC firstminute capital. That’s a small check size next to DSPM heavyweights like Cyera or Cyberhaven, but the cap table pedigree suggests the technology was well-regarded inside the industry even without a mega-round.

For buyers evaluating exposure-management and MDR platforms, this is a reminder that vendors without native sensitive-data classification are increasingly choosing to acquire that capability rather than partner for it or build it in-house — echoing the pattern set by Cyera’s acquisition of Trail and Proofpoint’s earlier purchase of Normalyze. It also reinforces a broader trend: at-rest-only DSPM is becoming table stakes, and eBPF-based runtime/network detection of data flows is where the next round of differentiation — and consolidation — is happening.