03b-data-appsec

Domain 3: Data Security

Purpose: Protect sensitive data in AI pipelines (training, inference, retrieval) from leakage and unauthorized access.

Why Critical: AI agents often process PII, PHI, payment data, and proprietary information that must be protected to comply with GDPR, HIPAA, PCI-DSS.

Key Data Security Capabilities

1. PII Detection & Redaction: Identify and mask personally identifiable information
2. Data Encryption: At-rest and in-transit encryption for vector databases
3. Data Access Controls: Row-level security in RAG systems
4. Data Minimization: Collect only necessary data
5. Synthetic Data: Generate fake data for testing

---

Product 1: Private AI

Overview: PII detection and redaction platform for text and documents.

Key Features:

1. 50+ PII Types: Names, SSN, phone, email, credit cards, medical IDs, etc.
2. Redaction Modes: Mask, replace, anonymize, pseudonymize
3. Multi-Language: 50+ languages supported
4. Document Support: Text, PDFs, images (OCR)
5. API & SDK: REST API, Python SDK

Specifications:

Dimension	Details
License	Proprietary
Deployment	Cloud (Private AI), self-hosted (Enterprise)
Pricing	Free tier (1,000 calls/month), $0.002/request (paid)
Accuracy	95%+ PII detection accuracy

Strengths:

• ✅ 50+ PII types (most comprehensive)
• ✅ Multi-language (50+ languages)
• ✅ Document support (PDFs, images)
• ✅ Multiple redaction modes
• ✅ Generous free tier (1,000/month)

Limitations:

• ❌ Cost scales with volume ($0.002/request)
• ❌ Vendor dependency (cloud-only for most)
• ❌ Requires API integration

Best For:

• GDPR/HIPAA compliance
• RAG applications with sensitive data
• Document processing workflows

Website: https://www.private-ai.com/

---

Product 2: Gretel.ai

Overview: Synthetic data generation platform for safe AI development.

Key Features:

1. Synthetic Data Generation: Generate realistic fake data
2. Differential Privacy: Mathematically proven privacy guarantees
3. Data Anonymization: Remove PII while preserving utility
4. Quality Metrics: Statistical similarity to original data
5. API & SDKs: Python SDK, REST API

Specifications:

Dimension	Details
License	Proprietary + open-source SDK
Deployment	Cloud (Gretel), self-hosted (Enterprise)
Pricing	Free tier (100K records/month), $0.03-$0.10/1K records
Accuracy	90%+ utility preservation

Strengths:

• ✅ Differential privacy (provable guarantees)
• ✅ Synthetic data for testing (no real PII exposure)
• ✅ Quality metrics (validate data utility)
• ✅ Open-source SDK (transparency)
• ✅ Generous free tier (100K records/month)

Limitations:

• ❌ Complex setup (requires data science expertise)
• ❌ Cost scales with volume
• ❌ Synthetic data quality varies by use case

Best For:

• Testing/development environments
• Data science teams
• Sharing datasets externally (partners, contractors)

Website: https://gretel.ai/

---

Product 3: AWS Macie

Overview: AWS's data security service for discovering and protecting sensitive data.

Key Features:

1. Automated Discovery: Scan S3 buckets for PII/PHI
2. Data Classification: 100+ sensitive data types
3. Risk Scoring: Assess data exposure risk
4. Alerts: CloudWatch integration for real-time alerts
5. Compliance: GDPR, HIPAA, PCI-DSS reporting

Specifications:

Dimension	Details
License	Proprietary (AWS)
Deployment	AWS Cloud
Pricing	$1.00 per 1GB scanned (discovery), $0.10/1K objects (monitoring)
Integration	S3, CloudWatch, EventBridge

Strengths:

• ✅ Automated discovery (no manual tagging)
• ✅ 100+ sensitive data types
• ✅ Native AWS integration (S3, CloudWatch)
• ✅ Compliance reporting (GDPR, HIPAA)

Limitations:

• ❌ AWS S3 only (not for other clouds/databases)
• ❌ Cost scales with data volume ($1/GB)
• ❌ Discovery-focused (not real-time redaction)

Best For:

• AWS S3 users
• Data lake security
• Compliance audits (GDPR, HIPAA)

Documentation: https://aws.amazon.com/macie/

---

Product 4: Microsoft Purview

Overview: Microsoft's data governance and compliance platform.

Key Features:

1. Data Map: Automated data discovery across Azure, AWS, GCP, on-prem
2. Sensitivity Labels: Classify data (Public, Confidential, Restricted)
3. Data Lineage: Track data flow across systems
4. Policy Enforcement: Automated access controls based on classification
5. Compliance Manager: GDPR, HIPAA, SOC 2 assessments

Specifications:

Dimension	Details
License	Proprietary (Microsoft)
Deployment	Azure Cloud
Pricing	$0.167/GB scanned (data map), $0.25/hour (scanning)
Integration	Azure, AWS, GCP, on-prem sources

Strengths:

• ✅ Multi-cloud (Azure, AWS, GCP)
• ✅ Data lineage (end-to-end visibility)
• ✅ Policy automation (enforce access controls)
• ✅ Compliance dashboard

Limitations:

• ❌ Microsoft-centric (best with Azure)
• ❌ Complex setup (requires governance team)
• ❌ Expensive for large data estates

Best For:

• Multi-cloud data governance
• Enterprises with complex data estates
• Compliance-driven organizations

Documentation: https://azure.microsoft.com/en-us/products/purview/

---

Product 5: Immuta

Overview: Data access control platform with dynamic policy enforcement.

Key Features:

1. Dynamic Data Masking: Real-time PII masking based on user role
2. Row-Level Security: Filter data per user/role
3. Policy Automation: Define policies once, enforce everywhere
4. Purpose-Based Access: Grant access based on data usage purpose
5. Multi-Database: Snowflake, Databricks, Redshift, BigQuery, etc.

Specifications:

Dimension	Details
License	Proprietary
Deployment	Cloud, self-hosted
Pricing	Custom (starts ~$50K/year)
Integration	20+ databases/warehouses

Strengths:

• ✅ Dynamic masking (real-time, role-based)
• ✅ Row-level security (fine-grained access)
• ✅ Purpose-based access (GDPR-friendly)
• ✅ Multi-database (not locked to vendor)

Limitations:

• ❌ Expensive (enterprise pricing)
• ❌ Complex setup
• ❌ Requires data governance expertise

Best For:

• RAG applications with sensitive databases
• Enterprises requiring row-level security
• GDPR compliance (purpose-based access)

Website: https://www.immuta.com/

---

Domain 4: Application Security

Purpose: Secure the AI application codebase, dependencies, and deployment pipelines.

Why Critical: AI applications depend on 10-50+ libraries (LangChain, LlamaIndex, transformers, etc.), each a potential vulnerability. Supply chain attacks are a top threat (OWASP #5).

Key AppSec Capabilities

1. Dependency Scanning: Detect vulnerabilities in libraries
2. SBOM Generation: Software Bill of Materials for transparency
3. Code Scanning: Static analysis for security issues
4. Container Security: Secure Docker images
5. CI/CD Integration: Automated security checks

---

Product 1: Snyk

Overview: Developer-first security platform for code, dependencies, containers, and IaC.

Key Features:

1. Dependency Scanning: Detects vulnerabilities in 10M+ packages
2. Automated Fixes: One-click PRs to fix vulnerabilities
3. Container Scanning: Docker image vulnerability detection
4. IaC Security: Terraform, Kubernetes YAML scanning
5. IDE Integration: VS Code, JetBrains, Eclipse

Specifications:

Dimension	Details
License	Proprietary + free tier
Deployment	Cloud (Snyk-managed)
Pricing	Free (open-source projects), $25-$89/developer/month
Integration	GitHub, GitLab, Bitbucket, CI/CD tools

Strengths:

• ✅ Developer-friendly (IDE integration, automated fixes)
• ✅ 10M+ package vulnerability database
• ✅ Multi-language (Python, JavaScript, Java, Go, etc.)
• ✅ CI/CD integration (GitHub Actions, Jenkins, etc.)
• ✅ Free for open-source projects

Limitations:

• ❌ Cost scales with developers ($25-$89/dev/month)
• ❌ Cloud-only (no self-hosted)
• ❌ Some false positives

Best For:

• Development teams prioritizing speed
• Open-source projects (free)
• Teams using GitHub/GitLab

Website: https://snyk.io/

---

Product 2: GitHub Advanced Security

Overview: GitHub's native security features for code scanning and secret detection.

Key Features:

1. Dependabot: Automated dependency updates and vulnerability alerts
2. Code Scanning: CodeQL engine for semantic analysis
3. Secret Scanning: Detect API keys, tokens in code
4. Security Advisories: GitHub's vulnerability database
5. Pull Request Integration: Block PRs with vulnerabilities

Specifications:

Dimension	Details
License	Proprietary (GitHub)
Deployment	GitHub Cloud, GitHub Enterprise Server
Pricing	Free (public repos), $49/user/month (private repos)
Integration	Native GitHub integration

Strengths:

• ✅ Native GitHub integration (zero setup)
• ✅ CodeQL (powerful semantic analysis)
• ✅ Free for public repos
• ✅ Automated dependency updates (Dependabot)
• ✅ Secret scanning (prevents credential leaks)

Limitations:

• ❌ GitHub-only (not portable)
• ❌ Cost for private repos ($49/user/month)
• ❌ Limited customization vs standalone tools

Best For:

• GitHub users (especially public repos)
• Teams prioritizing native integration
• Open-source projects

Documentation: https://docs.github.com/en/code-security

---

Product 3: GitLab Security Dashboard

Overview: GitLab's built-in security features for SAST, DAST, dependency scanning.

Key Features:

1. SAST: Static Application Security Testing
2. DAST: Dynamic Application Security Testing
3. Dependency Scanning: Detects vulnerable dependencies
4. Container Scanning: Docker image vulnerabilities
5. License Compliance: Track open-source licenses

Specifications:

Dimension	Details
License	Proprietary (GitLab)
Deployment	GitLab Cloud, self-hosted
Pricing	Free tier (basic features), Ultimate: $99/user/month
Integration	Native GitLab integration

Strengths:

• ✅ All-in-one (SAST, DAST, dependency, container scanning)
• ✅ Self-hosted option (GitLab self-managed)
• ✅ Native CI/CD integration
• ✅ License compliance (track OSS licenses)

Limitations:

• ❌ GitLab-only (not portable)
• ❌ Advanced features require Ultimate tier ($99/user/month)
• ❌ SAST/DAST quality varies by language

Best For:

• GitLab users
• Teams requiring self-hosted security
• All-in-one DevSecOps platform

Documentation: https://docs.gitlab.com/ee/user/application_security/

---

Product 4: Checkmarx

Overview: Enterprise SAST/DAST platform for application security.

Key Features:

1. Checkmarx One: Unified platform (SAST, SCA, IaC, API security)
2. AI-Powered Analysis: Reduce false positives
3. Remediation Guidance: Fix recommendations
4. IDE Plugins: Real-time scanning in IDE
5. Compliance: OWASP, PCI-DSS, HIPAA

Specifications:

Dimension	Details
License	Proprietary
Deployment	Cloud, self-hosted
Pricing	Custom (starts ~$100K/year for enterprise)
Integration	20+ CI/CD tools, IDEs

Strengths:

• ✅ Enterprise-grade (Fortune 500 adoption)
• ✅ AI-powered (reduced false positives)
• ✅ Comprehensive (SAST, SCA, IaC, API)
• ✅ Compliance reporting

Limitations:

• ❌ Expensive (enterprise pricing)
• ❌ Complex setup
• ❌ Overkill for small teams

Best For:

• Large enterprises (1,000+ developers)
• Regulated industries (finance, healthcare)
• Teams requiring compliance reporting

Website: https://checkmarx.com/

---

Product 5: Veracode

Overview: Cloud-based application security platform.

Key Features:

1. Static Analysis: SAST for 100+ languages
2. Dynamic Analysis: DAST for web apps
3. SCA: Software Composition Analysis (dependencies)
4. Manual Penetration Testing: Human-driven testing (add-on)
5. Security Labs: Training for developers

Specifications:

Dimension	Details
License	Proprietary
Deployment	Cloud (Veracode-managed)
Pricing	Custom (starts ~$50K/year)
Integration	CI/CD, IDEs, issue trackers

Strengths:

• ✅ 100+ languages supported
• ✅ Manual pen testing (hybrid approach)
• ✅ Security training (developer education)
• ✅ Cloud-based (no infrastructure)

Limitations:

• ❌ Expensive (enterprise pricing)
• ❌ Cloud-only (no self-hosted)
• ❌ Slower than modern tools (longer scan times)

Best For:

• Enterprises requiring manual pen testing
• Teams prioritizing developer training
• Regulated industries

Website: https://www.veracode.com/

---

Product 6: FOSSA

Overview: Open-source license compliance and vulnerability management.

Key Features:

1. License Compliance: Track 200+ OSS licenses
2. Vulnerability Scanning: Detect CVEs in dependencies
3. SBOM Generation: Automated Software Bill of Materials
4. Policy Enforcement: Block non-compliant licenses
5. Attribution Reports: Generate license attribution for legal

Specifications:

Dimension	Details
License	Proprietary + free tier
Deployment	Cloud, self-hosted (Enterprise)
Pricing	Free (open-source), $5-$15/developer/month (paid)
Integration	GitHub, GitLab, Bitbucket, CI/CD

Strengths:

• ✅ License compliance (200+ licenses)
• ✅ SBOM generation (automated)
• ✅ Policy enforcement (block non-compliant)
• ✅ Free for open-source projects

Limitations:

• ❌ Focused on licenses (not full AppSec)
• ❌ Less comprehensive than Snyk/Checkmarx
• ❌ Cost scales with developers

Best For:

• License compliance (GPL, MIT, Apache)
• Teams requiring SBOM
• Open-source projects

Website: https://fossa.com/

---

---

Previous: Guardrails & Identity Management
Next: Threat Detection & Observability - 7 threat detection + 8 observability products