IBM Guardium vs Imperva DSF: Database Activity Monitoring (2026)

Quick verdict

Short answer

Choose IBM Guardium Data Protection if you want a layered collector, aggregator and central manager estate with S-TAP agents, session termination rules (S-GATE) and agentless universal connectors, and you are comfortable buying it alone or as part of IBM's Guardium Data Security Center suite. Choose Imperva Data Security Fabric if you want monitoring, discovery, risk analytics, static masking and mainframe coverage on one subscription platform, with written licence rules that count database servers, and you like the option of Thales encryption and tokenization next to it. Neither publishes prices, so scope both against your own host counts and audit obligations.

How we know: This comparison is research-based: architecture, collection methods, packaging, ownership and licensing terms were checked on 7 November 2026 against IBM and Imperva product pages, IBM release notes and support pages, Imperva's License Definitions and Rules, the Thales newsroom and AWS documentation. Some imperva.com pages returned a bot check, so details only on those pages are left out. We have not deployed either product, so nothing here is a measured result.

IBM Guardium Data Protection monitors and records access to databases and file systems, applies security and audit policies and produces compliance reports. IBM documents a tiered architecture of collectors, aggregators and a central manager, with S-TAP agents on database servers and the Guardium Installation Manager to deploy and update them. Release 12.2.1 (release notes modified 6 August 2026) adds a Kubernetes-based Edge Gateway and long-term retention to S3-compatible storage. IBM also lists the product as one module of the Guardium Data Security Center suite, next to Guardium Vulnerability Assessment, Guardium DDR and Guardium Cryptography Manager.

Imperva Data Security Fabric (DSF) is Imperva's data security platform built around its long-running database activity monitoring products. Its product page lists data activity monitoring, discovery and classification, risk prioritisation and analytics, retention and archive, automated workflows and playbooks, static data masking, and encryption and tokenization delivered through Thales. Thales completed its acquisition of Imperva on 4 December 2023; DSF keeps the Imperva name but now carries Thales branding, and Imperva documentation redirects to a Thales portal.

Cloud-native alternatives. If you only run a few managed cloud databases, native features may cover the audit need at lower cost. AWS documents Database Activity Streams for Aurora and some RDS engines and names both IBM Guardium and Imperva SecureSphere (an older Imperva product name) as consumers; see AWS Database Activity Streams.

Side by side

Aspect	IBM Guardium Data Protection	Imperva Data Security Fabric
Owner and status	IBM; 12.2.1 current; also sold as a module of Guardium Data Security Center	Thales (Imperva acquisition completed 4 December 2023); DSF name kept
Core function	Database and file activity monitoring, audit policies, compliance reporting	Data activity monitoring plus discovery, classification and risk analytics on one platform
Architecture	Collectors, aggregators and central manager; S-TAP agents; Kubernetes Edge Gateway (12.2.1)	Agent-based or agentless collection; IBM-style tier names not used; detail on bot-protected pages
Agentless collection	Universal connector plug-ins read native logs or streams (for example AlloyDB, SingleStore, Sybase, Snowflake over JDBC, Kafka-based sources)	Agentless support stated on the product page for cloud data stores
Blocking	S-GATE rules can terminate database sessions when improper access is detected	Product page says DSF controls access by users, processes and apps; blocking detail not on pages that loaded
Masking	Not documented for this module	Static data masking, licensed per terabyte masked
Encryption and tokenization	Separate product: Guardium Cryptography Manager	Through Thales (CipherTrust) links on the DSF page
Mainframe	Not covered on the pages checked	Db2, IMS and z/OS files with a single z/OS agent
Deployment	Self-managed appliances on premises or in cloud; AWS Marketplace listing	On premises, hybrid and multicloud (AWS, Azure, Google Cloud, Oracle Cloud)
Licensing	Quote only; metric not published on pages checked	Term subscription plans; counted per Database Server (peak hosts per day in a month)

Key differences

Architecture and collection

Guardium is explicit about its topology. S-TAP agents on Linux, UNIX and Windows database servers send activity to collectors, aggregators merge data from many collectors, and a central manager controls policies and the estate from one console. Where agents cannot be installed, universal connector plug-ins read native audit logs or streams; 12.2.1 ships plug-ins for AlloyDB, Milvus, SingleStore and Sybase, with Snowflake and Kafka-based connectors available through the central manager. The new Edge Gateway runs the monitoring pipeline on Kubernetes. This gives large estates a well-understood scaling model, at the cost of a sizeable appliance and agent fleet to plan, patch and size.

Imperva DSF also supports agent-based and agentless collection across on-premises, hybrid and multicloud estates, and its product page claims coverage of about 200 data repositories and 1,500 file formats. Its mainframe story is concrete: Imperva documents monitoring and audit of Db2, IMS and z/OS files with a single z/OS agent. Imperva's more detailed architecture and agent pages returned a bot check during this review, so ask Imperva or Thales for the component and sizing guide for your estate.

What sits beside monitoring

The portfolios are packaged differently. IBM splits capabilities into separate Guardium products: Guardium Data Protection for monitoring and audit, Guardium Vulnerability Assessment for scanning, Guardium DDR for detection and response, and Guardium Cryptography Manager for cryptography, all grouped under Guardium Data Security Center. Masking is not documented for the Data Protection module on the pages checked.

Imperva puts more under one platform name: activity monitoring, discovery and classification, risk analytics, retention and archive, playbooks and static data masking are all part of DSF, and encryption, tokenization and key management come from Thales CipherTrust. If you want masking for test copies from the same vendor as your monitoring, that favours DSF; if you want to buy only the monitoring module, Guardium's split packaging may suit you. For encryption, compare Thales CipherTrust with IBM's cryptography product directly.

Blocking and enforcement

Both are mainly monitoring and audit tools, but both can act. An IBM Support page (modified 18 June 2026) describes S-GATE rules that automatically terminate database sessions when Guardium detects improper data access, configured through the S-TAP agent and policy rules. Treat termination as a separate rollout from auditing: test the rule as an alert first, and check IBM's support notes for your engine and connection type.

Imperva's DSF page says the platform controls access by users, processes and apps and quotes a customer on its monitoring and blocking capabilities, but the pages that loaded do not describe how blocking works per agent or per cloud service. If inline blocking is a requirement, get the supported engines and modes in writing from Imperva.

Licensing models

Imperva is unusually transparent about the metric. Its License Definitions and Rules (version 9 April 2025) describe DSF as a term subscription with plan instances such as Data 360, Data Secure, and Discover and Classify, plus Sonar add-ons. Most plans count Database Servers: the peak number of database server hosts monitored or classified on any one day in a month. Hosts with 65 or more CPU cores count as Xlarge servers, every 50 million events processed counts as one Database Server where event-based functions are included, monitored high-availability nodes count, and masking is licensed per terabyte masked.

IBM does not state a licence metric on the product pages checked. It offers a demo, a quote and a "Buy on AWS" route through AWS Marketplace, and says the product is AWS EDP eligible. In practice, model your database host count, event volume and retention needs before talking to either vendor, because both quotes will depend on them.

Pricing and licensing

IBM Guardium Data Protection. No list prices are published. IBM's product page offers a demo and a "Buy on AWS" route through AWS Marketplace and says it is AWS EDP eligible; the licence metric and price were not shown on the pages checked. Guardium Data Security Center pages also carry no prices.

Imperva Data Security Fabric. No list prices are published; the product page mentions flexible licensing options and links to plan pages, and pricing comes from Imperva or Thales sales. The licence rules (term subscription, counted Database Servers, Xlarge hosts at 65 or more cores, 50 million events per Database Server where applicable, masking per terabyte) are described above. Both products are quote-based.

Pricing checked on the vendors' official pages on 7 November 2026. Prices change; confirm before buying.

Where each one leads

IBM Guardium Data Protection strengths

Clear, layered architecture (collectors, aggregators, central manager) for very large estates
Universal connector plug-ins for agentless collection from cloud and managed data stores
S-GATE rules can terminate sessions on improper access
Regular releases; 12.2.1 adds a Kubernetes Edge Gateway and S3-compatible long-term retention
Available through AWS Marketplace and AWS EDP eligible

Imperva Data Security Fabric strengths

Monitoring, discovery, classification, risk analytics and static masking on one platform
Documented mainframe coverage for Db2, IMS and z/OS files
Written licence definitions explain how database servers and events are counted
Encryption, tokenization and key management available from the same owner (Thales)
On premises, hybrid and four major clouds named on the product page

Limitations

IBM Guardium Data Protection limitations

No published prices or licence metric on the pages checked
Appliance and agent fleet needs planning, patching and specialist skills
Capabilities are spread across several Guardium products, so check which module covers what
Masking is not documented for the Data Protection module

Imperva Data Security Fabric limitations

No published prices; plan inclusions must be confirmed with sales
Packaging and documentation have moved between Imperva and Thales since 2023
Monitored high-availability nodes count toward licensed database servers
Several technical pages sit behind a bot check, so public detail on agents and blocking is thin

When to choose each

Choose IBM Guardium Data Protection if

You run a very large estate and want a documented collector and aggregator topology
You need agentless coverage of cloud data stores such as Snowflake or AlloyDB through universal connectors
You want session termination rules alongside auditing
You already buy IBM security products or want to purchase through AWS Marketplace

Choose Imperva Data Security Fabric if

You want discovery, risk analytics and static masking with the same platform as monitoring
You must audit Db2 and IMS on IBM z/OS together with distributed databases
You prefer a licence model whose counting rules are published in advance
You want Thales encryption, tokenization and key management next to monitoring

When neither is right

You need audit, firewall and dynamic masking for a moderate number of databases in a product you run yourself: see DataSunrise and DataSunrise vs Oracle Audit Vault.
Your estate is mostly Oracle: compare Oracle Audit Vault and Database Firewall and Oracle Data Safe.
You only run Azure SQL and SQL Server and need vulnerability scans and threat alerts: see Microsoft Defender for SQL.
Your problem is analysts seeing too much data in a warehouse rather than audit: see Satori vs StrongDM.

Final recommendation

Bottom line

These are the two platforms most large enterprises shortlist for database activity monitoring, and both cover mixed on-premises and cloud estates. IBM Guardium Data Protection is the more direct fit when you want a clearly tiered monitoring architecture, agentless universal connectors and session termination, and are happy to buy other capabilities as separate Guardium modules. Imperva Data Security Fabric is the more direct fit when you want monitoring, discovery, risk analytics, masking and mainframe coverage under one subscription, with published counting rules and Thales encryption alongside. Ask both vendors for a scoped proof of concept on your highest-risk engines and for quotes built on the same host and event counts.

Frequently asked questions

Who owns Imperva now?

Thales. Thales announced the completion of its Imperva acquisition on 4 December 2023. The product is still called Imperva Data Security Fabric, with Thales branding on imperva.com.

Is Guardium Data Protection the same as Guardium Data Security Center?

No. Guardium Data Security Center is IBM's suite name; its product page lists Guardium Data Protection as one module next to Guardium Vulnerability Assessment, Guardium DDR and Guardium Cryptography Manager.

Can either tool block queries?

Guardium can terminate database sessions with S-GATE rules, according to an IBM Support page. Imperva's product page says DSF controls access by users, processes and apps, but the blocking mechanics were not on the pages that loaded, so confirm the modes for your engines with Imperva.

How is Imperva DSF licensed?

As a term subscription with plans such as Data 360 and Data Secure. Imperva's licence definitions count Database Servers as the peak number of hosts monitored or classified on any one day in a month, and masking is licensed per terabyte. Prices are by quote.

Do both work with AWS Database Activity Streams?

AWS documentation names IBM Security Guardium and Imperva SecureSphere Database Audit and Protection, an older Imperva product name, as compliance applications that can consume Aurora PostgreSQL activity streams. Confirm current support for your engine with each vendor.

Sources

Checked November 2026.

How we research comparisons: our editorial method.