At a glance
| Supported databases | Broad relational, warehouse, NoSQL, mainframe and file coverage (Imperva claims about 200 repositories) |
| Auditing and activity monitoring | Yes, core function (agent-based or agentless) |
| Masking | Static data masking (per-TB licence) |
| Encryption or tokenization | Offered through Thales (CipherTrust) links on the DSF page |
| Privileged access | Monitoring of privileged activity; not a password vault |
| Policy enforcement | Policies, alerts, workflows and playbooks |
| Compliance reporting | Retention, archive and compliance reporting |
| Deployment | On premises, hybrid and multicloud (AWS, Azure, Google Cloud, Oracle Cloud) |
| Licensing | Term subscription plans (Data 360, Data Secure and others), counted per database server; quote only |
Imperva DSF fits large enterprises that want database activity monitoring plus discovery, classification and risk analytics across structured and unstructured data, on premises and in several clouds. Licensing is by subscription plan and counted database servers, with no public prices, so model your host counts before talking to sales.
Overview
Imperva Data Security Fabric is the umbrella platform Imperva built around its long-running database activity monitoring (DAM) products and its Sonar platform (Imperva's licence definitions still name Sonar add-ons). Its product page lists data activity monitoring, discovery and classification, risk prioritisation and analytics, retention and archive, automated workflows and playbooks, static data masking, and encryption and tokenization (the last via Thales). It supports agent-based and agentless collection across on-premises, hybrid and multicloud estates.
Thales bought Imperva and completed the deal on 4 December 2023. Since then the DSF pages carry Thales branding, link encryption, tokenization and posture management to Thales CipherTrust pages, and Thales has added a joint Data Risk Intelligence offering for DSF Data 360 customers. Licensing is by plan (for example Data 360 or Data Secure) and by counted database servers.
Key features
- Data activity monitoring for databases and files, agent-based or agentless
- Discovery and classification of sensitive data across structured, semi-structured and unstructured stores
- Risk prioritisation and analytics with anomaly detection to reduce false positives
- Data retention and archive of audit data for compliance
- Automated workflows and playbooks, plus integrations with SIEM and other security tools
- Static data masking, licensed per terabyte masked
- Mainframe coverage: monitoring and audit of Db2, IMS and z/OS files with a single z/OS agent
Integrations and ecosystem
Pros and cons
Pros
- Covers databases, mainframe and unstructured files in one platform
- Long history in database activity monitoring
- Written licence definitions explain how database servers are counted
- Thales ownership adds encryption, tokenization and key management options
Cons
- No public prices; plan names and inclusions need confirming with sales
- Packaging has shifted since the Thales acquisition, with Imperva and Thales pages and documentation mixed
- High-availability nodes that are monitored count toward licensed database servers
Pricing
No public prices. Imperva's License Definitions and Rules (version 9 April 2025) describe Data Security Fabric as a term-based subscription with plan instances such as Data 360, Data Secure, Discover and Classify (structured or unstructured) and Sonar add-ons. Most plans count Database Servers: the peak number of database server hosts monitored or classified on any one day in a month, with hosts of 65 or more CPU cores counted as Xlarge servers, and every 50 million events processed counting as one Database Server where event-based functions are included. Data masking is licensed per terabyte masked. Prices come from Imperva or Thales sales.
Pricing checked on the vendor's official page on 7 November 2026. Prices change; confirm before buying.
Who it is best for
Large enterprises with mixed database, mainframe and file estates that want activity monitoring, discovery and risk analytics from one vendor.
Typical use cases
- Monitoring and auditing access to regulated databases across on-premises and cloud
- Finding and classifying sensitive data in databases and file shares
- Auditing Db2 and IMS on IBM z/OS alongside distributed databases
- Prioritising data risk for a security operations team with playbooks
Who should look elsewhere
- Small teams auditing a few cloud databases, where cloud-native features cost far less: see AWS Database Activity Streams.
Verdict
Imperva DSF is a broad data security platform with deep database activity monitoring roots, now part of the Thales portfolio. It suits enterprises that want discovery, monitoring and risk analytics across many repositories, while its quote-only, server-counted licensing and shifting packaging make careful scoping essential.
Frequently asked questions
Who owns Imperva now?
Thales. It announced completion of the Imperva acquisition on 4 December 2023, earlier than the beginning of 2024 it had first expected. The Data Security Fabric pages now carry Thales branding.
How is Imperva DSF licensed?
As a term subscription with plan instances such as Data 360 and Data Secure. Imperva's licence definitions count Database Servers as the peak number of hosts monitored or classified on any one day in a month; masking is per terabyte.
Does DSF cover mainframes?
Yes. Imperva documents monitoring and audit of Db2, IMS and z/OS files using a single z/OS agent.
Can Imperva consume AWS Database Activity Streams?
AWS documentation names Imperva SecureSphere Database Audit and Protection, an older Imperva product name, as a compliance application for Aurora PostgreSQL activity streams. Confirm current DSF support for your engine with Imperva.
Sources
- Imperva Data Security Fabric product page
- Imperva License Definitions and Rules (version 9 April 2025)
- Thales: completion of the Imperva acquisition (4 December 2023)
- Imperva Data Security Fabric and IBM z/OS
Checked November 2026.
Listed in: Database Security & Auditing.
How we research reviews and what star ratings mean: our editorial method.