This page is for security architects, DBAs, compliance owners and platform teams who need to answer three questions about their databases: who accessed which data, who is allowed to, and what an attacker or an over-privileged insider would see. No single product answers all three, so the category is really several adjacent markets that buyers often combine.
The listings range from appliance-based activity monitoring for large regulated estates, through tools that mask data before it leaves production, to vaults that remove standing database passwords and features built into the clouds. Several vendors in this market changed hands between 2023 and 2026, so ownership and product names are noted where they matter.
What this software does
Database activity monitoring (DAM) captures SQL statements and sessions, either with agents on the database host (for example IBM Guardium S-TAP), by reading the engine's native audit trail, by sniffing network traffic or by sitting in the connection path as a proxy. Captured events go to a separate system that database administrators cannot edit, which provides separation of duties for audits. A proxy or inline database firewall can also block statements that break policy; passive capture can only alert. Cloud providers offer building blocks such as Database Activity Streams on Aurora and RDS, which deliver an encrypted activity stream that a monitoring product then consumes.
Masking replaces sensitive values. Static masking rewrites a copy of the data, usually for test and development, and is irreversible; dynamic masking rewrites query results on the fly for users who should not see real values. Tokenization swaps values for tokens that authorised processes can reverse, and vaultless designs derive tokens without a central lookup table. Encryption ranges from transparent encryption of data files, which protects stolen disks and backups but not data read through a valid login, to column or application-level encryption, all depending on careful key management.
Access and secrets management controls the path to the database: vaults that issue short-lived database credentials, privileged access managers that broker and record administrator sessions, and access proxies that apply policies and just-in-time approvals. Security assessment tools scan configurations, patches and effective permissions against benchmarks such as the CIS Benchmarks and DISA STIGs, so you find excessive privileges before someone uses them.
Types of product in this category
- Activity monitoring and auditing: Products such as IBM Guardium Data Protection, Imperva Data Security Fabric, DataSunrise and Oracle Audit Vault and Database Firewall that capture database activity into a tamper-resistant store, alert on policy violations and produce compliance reports, with optional blocking.
- Masking and privacy: Tools that discover sensitive data and de-identify it, mostly in non-production copies, such as DataMasque, Perforce Delphix, K2view and Google Cloud Sensitive Data Protection.
- Encryption and tokenization: Platforms such as Thales CipherTrust and Protegrity that encrypt files or columns, tokenize fields and manage the keys and policies centrally.
- Access and secrets management: Tools that control how people and applications reach the database: HashiCorp Vault for dynamic credentials, CyberArk Privileged Access Manager for vaulted and recorded admin sessions, and access proxies such as StrongDM and Commvault Data Access Manager.
- Security assessment: Scanners such as LevelBlue DbProtect and IDERA SQL Secure that check configuration, patches and effective permissions against policy templates and show drift over time; they report risk rather than block activity.
- Cloud-native security service: Features of a cloud platform, such as Microsoft Defender for SQL, Oracle Data Safe and Database Activity Streams, that are enabled per database or subscription with no appliances, but cover only that provider's engines or services.
Typical use cases
Audit evidence for regulators
Organisations subject to PCI DSS, HIPAA, the Sarbanes-Oxley Act (SOX) or the EU GDPR need to show who read or changed regulated data, and that administrators could not alter the record. Activity monitoring products keep that trail outside the database and produce scheduled reports.
Masked copies for development and test
Developers need realistic data but should not see real customers. Static masking with consistent values keeps joins working across tables and systems while removing personal data from every non-production copy.
Removing standing database passwords
Applications and engineers often share long-lived credentials stored in config files. Dynamic secrets from a vault, or a proxy that injects credentials and logs every query, replace them with short-lived, per-user access.
Controlling DBA and vendor sessions
Privileged access managers broker administrator sessions through clients such as SSMS or SQL*Plus without revealing passwords, require approval and record the session, which suits outsourced support and break-glass access.
Finding over-privileged accounts
Assessment tools calculate effective permissions through roles and nested groups, flag weak configurations and compare results with a baseline, so you can fix access paths before an audit or an incident.
Threat detection on managed databases
For Azure SQL, Aurora, RDS or Oracle Cloud databases, built-in services raise alerts on suspicious activity such as SQL injection or brute-force attempts, or stream activity to a monitoring product, without agents on servers you cannot reach.
How to choose
- Which control you actually need. Decide first whether the gap is visibility (auditing), prevention (blocking, masking, encryption), access (credentials and sessions) or posture (assessment). Many failed projects buy an activity monitor to solve an access problem, or encryption to solve a visibility problem.
- Data source coverage. Check named support for your engines and versions, including cloud services and warehouses. Coverage ranges from Oracle Database only (Oracle Data Safe) or SQL Server only (IDERA SQL Secure) to very broad multi-engine lists in Guardium, Imperva and DataSunrise. AWS Database Activity Streams, for example, does not support RDS for MySQL, MariaDB or PostgreSQL.
- Capture method and its blind spots. Agents, native audit logs, network sniffing and proxies each miss something. DataSunrise documents that sniffer mode cannot analyse SSL-encrypted traffic and that blocking and dynamic masking need proxy mode, which cannot see local connections. Ask each vendor which connections and statement types its method does not see.
- Blocking versus alerting. If you need to stop queries, confirm the product has an inline or proxy enforcement mode and test its latency and failure behaviour. Several services, including Microsoft Defender for SQL and Database Activity Streams, record or alert but do not block.
- Masking semantics. For non-production data, check deterministic masking (the same input gives the same output across tables and databases), referential integrity, support for files and NoSQL, and whether masking is reversible. Irreversible masking suits test data; tokenization suits processes that must recover real values.
- Key and secret management. For encryption and tokenization, ask where keys live, how they rotate without downtime and who can unprotect data. For vaults, check which databases get dynamic credentials in the free edition and which need an enterprise licence; HashiCorp Vault, for example, needs Enterprise for Oracle dynamic credentials.
- Separation of duties and tamper resistance. Auditors expect DBAs not to be able to change their own audit trail. Check that the monitoring store, policies and reports are administered separately from the databases, and how long audit data is retained online and in archive.
- Operational footprint. Appliances, collectors, agents and proxies need sizing, patching and high availability. Managed cloud features avoid this but tie you to one provider. Factor the specialist skills large DAM deployments need into the total cost.
- Ownership and roadmap. This market consolidated quickly: Imperva is part of Thales, Satori is now Commvault Data Access Manager, CyberArk is owned by Palo Alto Networks and sold under Idira, HashiCorp is owned by IBM, Trustwave DbProtect is now LevelBlue DbProtect, and Redgate SQL Data Privacy Suite is no longer sold under that name. Confirm the current product name, support terms and roadmap in writing.