Executive summary
As of November 2026, CybersecTools tracks 252 companies that sell data protection solutions as their main business. Database Security is part of that family. The largest groups are based in the United States, Canada and the United Kingdom. In the last 12 months they raised $1.8B across 28 funding rounds, 9 companies were acquired and 12 new companies started in the last two years.
From that field we chose seven solutions that watch, test or encrypt the data in your databases. IBM Guardium suits large companies that need activity monitoring and audit reports across many database types. Imperva Data Security Fabric fits teams that want one view of database activity across on-premises and cloud stores. Oracle Audit Vault and Database Firewall suits teams that want audit trails and a SQL firewall, and it covers non-Oracle databases too.
The main choice is between watching, testing and hiding. Activity monitoring products such as Guardium, Imperva, Oracle and DataSunrise record who touched what, so you can alert on misuse and prove control to auditors. Trellix and LevelBlue DbProtect also scan databases for weak settings and missing patches, and Trellix can virtually patch databases that cannot be updated. Thales CipherTrust Database Protection encrypts columns, so stolen data is useless without the key.
Ask each vendor how many of your database types it covers today, because coverage differs more than features do.
How we evaluated
We looked at 27 database security solutions from 22 companies, and the 7 on this page made the cut. We combined our judgment from years of leading enterprise security programs with market data from Mandos, our market intelligence platform, and with the vendor and review pages listed under Sources at the end of this page. For customer feedback, we left out paid reviews, reviews by vendor staff or partners, review campaigns and anything older than two years, so you get an accurate view of what customers say.
Four traits mattered most: coverage of the database types you run; activity monitoring and audit reports that hold up with auditors; protection such as a SQL firewall, virtual patching or encryption that works without rewriting applications; and links to your SIEM and key management. We left out products that protect only one database brand and broad data security platforms that are not built around databases. The order follows how widely each product is used by teams like yours. Company momentum shows how the vendor itself is growing, so a market leader can rank first with a lower score.
Read the full method · See all sources
What is Database Security
Database security products protect the data stored in your databases and data warehouses, such as customer records, card numbers and health data. Database activity monitoring records every query, so you can see who read or changed sensitive data and get an alert when something looks wrong. Encryption, tokenization and masking change the data itself, so a person or app without the right rights sees only scrambled or hidden values.
This matters because databases hold the data attackers want most, and admins can often read all of it. Rules such as PCI DSS, HIPAA and GDPR also expect you to show who accessed regulated data. Database security gives you that record and lets you limit what each person can see.
Compare Database Security solutions
This analysis focuses on seven database security solutions. The table compares them on vendor, who each one is best for, deployment model and the NIST CSF functions they cover.
- 1.
IBM Guardium
Best for: Large companies with many database types
Hybrid · Mid-Market to Enterprise · NIST: Identify, Protect, Detect, Respond
- 2.
Imperva Data Security Fabric
Best for: One view across on-premises and cloud data
Hybrid · Mid-Market to Enterprise · NIST: Identify, Protect, Detect, Respond
- 3.
Oracle Audit Vault and Database Firewall
Best for: Audit trails and a SQL firewall across mixed databases
On-Premises · Mid-Market to Enterprise · NIST: Protect, Detect, Respond
- 4.
Thales CipherTrust Database Protection
Best for: Column encryption without changing application code
Hybrid · SMB to Enterprise · NIST: Protect
- 5.
Trellix Database Security
Best for: Older databases that can no longer be patched
Hybrid · Mid-Market to Enterprise · NIST: Identify, Protect, Detect
- 6.
LevelBlue DbProtect
Best for: Agentless scans for weak settings and risky user rights
Hybrid · Mid-Market to Enterprise · NIST: Identify, Protect, Detect
- 7.
DataSunrise Data Security Platform
Best for: Monitoring, masking and firewall in one product
Hybrid · SMB to Enterprise · NIST: Identify, Protect, Detect
| Solution | Best for | Deployment | Company size | NIST CSF functions |
|---|---|---|---|---|
| Large companies with many database types | Hybrid | Mid-Market to Enterprise | Identify, Protect, Detect, Respond |
| One view across on-premises and cloud data | Hybrid | Mid-Market to Enterprise | Identify, Protect, Detect, Respond |
| Audit trails and a SQL firewall across mixed databases | On-Premises | Mid-Market to Enterprise | Protect, Detect, Respond |
| Column encryption without changing application code | Hybrid | SMB to Enterprise | Protect |
| Older databases that can no longer be patched | Hybrid | Mid-Market to Enterprise | Identify, Protect, Detect |
| Agentless scans for weak settings and risky user rights | Hybrid | Mid-Market to Enterprise | Identify, Protect, Detect |
| Monitoring, masking and firewall in one product | Hybrid | SMB to Enterprise | Identify, Protect, Detect |
See every Database Security solution we list
The full Database Security market, filtered by company size, deployment and NIST coverage.
Best for: Large companies with many database types
At a glance
- Vendor
- IBM
- Headquarters
- Armonk, United States
- Founded
- 1911
- Ownership
- Public company (IBM)
- Deployment
- Hybrid
- Company size
- Mid-Market, Enterprise
- NIST CSF
- Identify, Protect, Detect, Respond
- Pricing
- Contact sales
Funding, hiring and news for IBM on Mandos.
Our take
IBM Guardium monitors access to data in real time, so you can see who read or changed sensitive records and block risky activity. It also finds and classifies sensitive data, runs vulnerability assessments on databases and builds compliance reports for rules such as GDPR, CCPA and PCI DSS. It is part of IBM's wider data security family, which also includes encryption and key management products.
It connects to Oracle, Microsoft SQL Server, PostgreSQL, MariaDB, SAP, Snowflake, Databricks and Hadoop, among others.
Guardium earns its place on coverage, because one product watches a very wide spread of database types across on-premises and cloud. That makes it a natural fit for a mid-market or enterprise estate with many platforms and strict audit duties. Its scope now reaches into DSPM, AI and cryptography, so be clear which parts you need for databases before you scope the deal.
IBM Guardium main features
- Data discovery and classification across cloud and SaaS environments
- Real-time data access monitoring and threat detection
- Automated compliance workflows and reporting for GDPR, CCPA, PCI-DSS
- Database vulnerability assessment and remediation
- Data Detection and Response with automated blocking and quarantine
- AI security discovery and governance enforcement
- Cryptography and encryption key lifecycle management
- Data Security Posture Management (DSPM)
IBM Guardium main integrations
- Amazon Web Services
- Microsoft SQL Server
- Microsoft Azure SQL Database
- Oracle Database
- PostgreSQL
- MariaDB
- SAP
- Snowflake
- Databricks
- Google Cloud
- Elastic
- Hadoop
Show all 22Show fewer
- Cloudera
- Apache Cassandra
- Couchbase
- CockroachDB
- DataStax
- EDB
- Aerospike
- SingleStore
- OpenText Vertica
- Broadcom Tanzu Greenplum
What customers say
- Most praised:
- Reports
- Most criticized:
- Setup, Speed
Guardium keeps a running record of who touches which database and what they run, so banks, insurers and telecom firms lean on it to pass audits faster and to catch unusual access as it happens. It covers many database types from one place, which helps when the data lives on several platforms. The catch is the effort to run it, because the interface and documentation make for a steep learning curve and teams often end up asking IBM for help. Users who switched on inline blocking also report added delay on database connections.
Before you buy
Where it is strong
- Real-time monitoring with blocking of risky data access
- Built-in compliance reports for GDPR, CCPA and PCI DSS
- Covers many database, warehouse and big data platforms
Ask in the demo
- Ask how long a typical rollout takes for your database count
- Check which of your databases need agents and which do not
- Ask what skills your team needs to tune policies and reports
Enterprise-scale data security platform for multicloud and hybrid environments
San Mateo, United StatesFounded 2002$86M raised
- SOC 2
- ISO 27001
- FedRAMP
- PCI DSS
- HIPAA
Best for: One view across on-premises and cloud data
At a glance
- Vendor
- Imperva
- Headquarters
- San Mateo, United States
- Founded
- 2002
- Deployment
- Hybrid
- Company size
- Mid-Market, Enterprise
- NIST CSF
- Identify, Protect, Detect, Respond
- Pricing
- Contact sales
Funding, hiring and news for Imperva on Mandos.
Our take
Imperva Data Security Fabric finds sensitive data, watches who accesses it and flags unusual activity across databases, file shares and cloud storage. It applies the same security policies across all of them, and it automates audit reports for SOX, HIPAA and GDPR. Imperva is part of Thales and still sells under its own name.
Imperva says it covers more than 200 data repository types, including Oracle, Microsoft SQL Server, IBM DB2, SAP HANA, Teradata, MongoDB, Amazon S3 and Google Cloud Storage.
It is on this list because it puts database activity from on-premises and several clouds into one view with one set of policies. That suits a hybrid mid-market or enterprise estate where data is spread thin. Since Thales now owns it, ask how it will sit next to the Thales encryption and key products on the roadmap.
Imperva Data Security Fabric main features
- Data discovery and classification across structured and unstructured data
- Monitoring for unusual behaviors and unauthorized data access
- Security policy enforcement across multicloud, hybrid, and on-premises environments
- Coverage for 200+ data repository types and 1,500+ file formats
- Automated compliance reporting for SOX, HIPAA, GDPR, and other regulations
- Risk analytics and insights for data security posture
- Automated workflows and security orchestration
- Centralized visibility across file stores and data assets
Imperva Data Security Fabric main integrations
- Oracle
- Microsoft SQL Server
- MySQL
- PostgreSQL
- IBM DB2
- SAP HANA
- Teradata
- Amazon S3
- Azure Blob Storage
- Azure Data Lake
- Google Cloud Storage
- Apache Hadoop
Show all 20Show fewer
- Apache Spark
- MongoDB
- Cassandra
- Couchbase
- Cloudera
- Salesforce
- Office 365
- Google Workspace
What customers say
Banks and other regulated firms use Imperva Data Security Fabric to see who touches sensitive data across on-site and cloud systems, which gives them the record they need for audits. Its real-time alerts and blocking on database activity also get good marks. The catch is the cost of running it, because the license is expensive and staff need paid vendor training before they can configure and tune it well.
Before you buy
Where it is strong
- Same policies across on-premises, cloud and file stores
- More than 200 data repository types supported
- Automated audit reports for SOX, HIPAA and GDPR
Ask in the demo
- Ask for coverage of your exact cloud database services
- Check what training and services the rollout needs
- Ask how it fits with Thales encryption products you may own
Best for: Audit trails and a SQL firewall across mixed databases
At a glance
- Vendor
- Oracle
- Headquarters
- Austin, United States
- Founded
- 1977
- Ownership
- Public company (ORCL)
- Deployment
- On-Premises
- Company size
- Mid-Market, Enterprise
- NIST CSF
- Protect, Detect, Respond
- Pricing
- Contact sales
Funding, hiring and news for Oracle on Mandos.
Our take
Oracle Audit Vault and Database Firewall collects audit data from your databases and checks SQL traffic on the network. The firewall can allow, log, alert on, swap or block each statement, and it can learn normal SQL and block anything that differs. It also captures before and after values of changed data and tracks changes to user rights and stored procedures. It ships ready-made compliance reports for GDPR, PCI, HIPAA and SOX, and sends alerts to your SIEM over syslog.
Beyond Oracle, it audits Microsoft SQL Server, IBM Db2, SAP Sybase, MongoDB, PostgreSQL and MariaDB.
It makes the list because it pairs audit trails with a real SQL firewall, so you can both prove control and stop bad queries. It runs on premises as a software appliance on your own hardware, which fits shops that keep databases in house. If most of your data has moved to the cloud, check how that model fits.
Oracle Audit Vault and Database Firewall main features
- Audit data collection from database and OS audit trails
- Network SQL inspection with allow, log, alert or block
- SQL substitution and allow-list policies from learned traffic
- Database security posture management for Oracle Database
- Predefined GDPR, PCI, HIPAA and SOX compliance reports
- Alerts on failed logins and sensitive table access
- Before and after values captured from REDO records
- User entitlement tracking and change comparison
Oracle Audit Vault and Database Firewall main integrations
- Microsoft SQL Server
- SAP Sybase
- IBM Db2
- MongoDB
- PostgreSQL
- MariaDB
- EnterpriseDB
- Red Hat Enterprise Linux
- IBM AIX
Before you buy
Where it is strong
- SQL firewall that can block or swap risky statements
- Audit collection from Oracle and non-Oracle databases
- Ready-made GDPR, PCI, HIPAA and SOX reports
Ask in the demo
- Confirm audit support for each of your database versions
- Ask how it runs for your cloud databases
- Check which features need extra Oracle licenses
Column-level database encryption without application code modification
Meudon, FranceFounded 1893Public company
- SOC 2
- ISO 27001
- FedRAMP
- PCI DSS
- FIPS 140
- Common Criteria
Best for: Column encryption without changing application code
At a glance
- Vendor
- Thales Group
- Headquarters
- Meudon, France
- Founded
- 1893
- Ownership
- Public company (HO)
- Deployment
- Hybrid
- Company size
- SMB, Mid-Market, Enterprise
- NIST CSF
- Protect
- Pricing
- Contact sales
Funding, hiring and news for Thales Group on Mandos.
Our take
Thales CipherTrust Database Protection encrypts sensitive columns inside your databases, so apps keep running normal SQL while the data stays protected. It supports AES and format-preserving encryption, which keeps encrypted values in the same shape as the original. It also adds static and dynamic masking, so even database admins see only what their role allows.
Keys live in CipherTrust Manager, which is FIPS 140-2 Level 3 certified, and you can rotate keys without downtime. Thales lists Oracle, Microsoft SQL Server, IBM DB2 and Teradata as supported databases.
This is the encryption pick on the list, because stolen data is useless without the key and you do not have to rewrite applications to get there. It fits teams of any size that must protect specific columns for regulators. It does not watch activity, so pair it with a monitoring product if you also need audit trails.
Thales CipherTrust Database Protection main features
- Column-level database encryption
- Format-Preserving Encryption (FPE)
- AES encryption
- Centralized key management via CipherTrust Manager
- Live key rotation without downtime
- Static and dynamic data masking
- Granular access controls
- Local or remote encryption options
Thales CipherTrust Database Protection main integrations
- Oracle
- Microsoft SQL Server
- IBM DB2
- Teradata
Before you buy
Where it is strong
- Column-level encryption without application changes
- Masking that hides data even from database admins
- Key rotation without downtime through CipherTrust Manager
Ask in the demo
- Confirm support for your database versions and cloud services
- Test query speed on encrypted columns with your real workload
- Ask what CipherTrust Manager licensing adds to the cost
Alternatives to each solution on this list
The closest Database Security alternatives for every pick, matched on features and integrations.
Best for: Older databases that can no longer be patched
At a glance
- Vendor
- Trellix
- Headquarters
- Plano, United States
- Founded
- 1999
- Deployment
- Hybrid
- Company size
- Mid-Market, Enterprise
- NIST CSF
- Identify, Protect, Detect
- Pricing
- Contact sales
Funding, hiring and news for Trellix on Mandos.
Our take
Trellix Database Security watches database access, scans for known weaknesses and adds virtual patches. A virtual patch blocks attacks on a known flaw without changing the database, which helps when a vendor patch is not out yet or an old database can no longer be patched. It finds databases and the sensitive data in them, ranks their weaknesses, and gives each database a risk score.
It covers Oracle, Microsoft SQL Server, MySQL, PostgreSQL, MariaDB, Sybase, Db2 and SAP HANA, plus Amazon RDS.
It earns its place on virtual patching, which buys you time on databases you cannot patch or take offline. That fits mid-market and enterprise teams running older systems next to newer ones. Ask how its cloud coverage compares with its on-premises list, because the cloud side is limited to Amazon RDS.
Trellix Database Security main features
- Database activity monitoring with threat blocking
- Automated scans to find databases and sensitive data
- Ranked list of known database vulnerabilities
- Virtual patching without database downtime
- Protection for legacy databases without vendor patches
- Risk score per database from weaknesses and activity
- Dashboards for access patterns and anomalies
- Configuration and coding health checks
Trellix Database Security main integrations
- Oracle Database
- Microsoft SQL Server
- MySQL
- PostgreSQL
- MariaDB
- SAP Sybase ASE
- IBM Db2
- SAP HANA
- Percona Server for MySQL
- Amazon RDS
Before you buy
Where it is strong
- Virtual patching without database downtime
- Protection for legacy databases without vendor patches
- Risk score per database from weaknesses and activity
Ask in the demo
- Ask how fast new virtual patches ship after a flaw is found
- Confirm support for your database versions and cloud services
- Check what the rollout needs on each database server
Best for: Agentless scans for weak settings and risky user rights
At a glance
- Vendor
- LevelBlue
- Headquarters
- Plano, United States
- Founded
- 2024
- Deployment
- Hybrid
- Company size
- Mid-Market, Enterprise
- NIST CSF
- Identify, Protect, Detect
- Pricing
- Contact sales
Funding, hiring and news for LevelBlue on Mandos.
Our take
LevelBlue DbProtect finds weak settings, missing patches and risky user rights in your databases, then watches activity for threats. Its scanners are agentless, so nothing is installed on database servers. A rights engine maps who can reach sensitive data, and it checks databases against CIS, DISA-STIG, FISMA and CMMC. The monitoring side learns normal behavior and can end a session or disable a user. It was sold under the Trustwave name before, and you can also buy it as a managed service.
Supported databases include Oracle, Microsoft SQL Server, PostgreSQL, MongoDB, SAP HANA, Teradata and Snowflake.
It is here because it starts from hardening, so you fix weak settings and excess rights before you hunt for misuse. The agentless model suits teams that cannot touch database servers. If you lack staff to run it, weigh the managed service against running it yourself.
LevelBlue DbProtect main features
- Agentless vulnerability scans of databases
- Discovery of databases, objects, users and security settings
- Pre-built security and compliance policies
- Checks against CIS, DISA-STIG, FISMA and CMMC
- User and application rights review for least privilege
- Sensitive data discovery and access mapping
- Database activity monitoring with policy violation alerts
- Anomaly detection based on learned user behavior
LevelBlue DbProtect main integrations
- CyberArk
- Amazon RDS
- Amazon Aurora
- Oracle Database
- Azure SQL Database
- Microsoft SQL Server
- MySQL
- MariaDB
- Percona Server for MySQL
- PostgreSQL
- MongoDB
- Elasticsearch
Show all 20Show fewer
- IBM Db2
- Apache Cassandra
- Couchbase
- SAP HANA
- Teradata
- Redis Enterprise
- SAP Sybase ASE
- Snowflake
Before you buy
Where it is strong
- Agentless scans of settings, patches and user rights
- Built-in CIS, DISA-STIG, FISMA and CMMC checks
- Active response that ends sessions or disables users
Ask in the demo
- Ask how the product is supported after the move to LevelBlue
- Confirm the scan schedule fits your change windows
- Check pricing for the software versus the managed service
DB security platform with monitoring, masking, firewall & compliance.
Seattle, United StatesFounded 2015
- ISO 27001
Best for: Monitoring, masking and firewall in one product
At a glance
- Vendor
- DataSunrise
- Headquarters
- Seattle, United States
- Founded
- 2015
- Deployment
- Hybrid
- Company size
- SMB, Mid-Market, Enterprise
- NIST CSF
- Identify, Protect, Detect
- Pricing
- Contact sales
Funding, hiring and news for DataSunrise on Mandos.
Our take
DataSunrise Data Security Platform combines activity monitoring, a database firewall, masking and sensitive data discovery in one product. The firewall checks queries in real time and blocks SQL injection and other risky statements, and it can run as a proxy in front of the database or with agents. It also covers some AI services, such as Amazon Bedrock and OpenAI, to stop sensitive data reaching them.
It connects to Oracle, Microsoft SQL Server, PostgreSQL, MySQL, Snowflake, Databricks, Amazon Redshift and BigQuery.
It makes the list because monitoring, firewall and masking come in one product, which means fewer moving parts. That suits smaller and mid-sized teams as well as larger ones that want one product for these jobs. Decide early between proxy and agent mode, because a proxy puts the product in the path of every query.
DataSunrise Data Security Platform main features
- Real-time database activity monitoring
- SQL injection detection
- Allow and deny lists for SQL statements
- Dynamic data masking
- Encryption
- Request blocking
- Reverse proxy deployment
- Self-learning mode
DataSunrise Data Security Platform main integrations
- AWS
- Microsoft Azure
- Snowflake
- Databricks
- Oracle Database
- Microsoft SQL Server
- PostgreSQL
- MySQL
- MariaDB
- Amazon S3
- Amazon Redshift
- Amazon Aurora
Show all 33Show fewer
- Amazon RDS
- BigQuery
- Microsoft SharePoint
- Microsoft OneDrive
- Salesforce
- OpenAI
- Anthropic Claude
- Amazon Bedrock
- Azure OpenAI
- Google Gemini
- IBM Db2
- SAP HANA
- Sybase
- Informix
- Qdrant
- Amazon DocumentDB
- Azure Cosmos DB
- AlloyDB
- Google Cloud SQL
- ChatGPT
- SIEM
Before you buy
Where it is strong
- Database firewall that blocks SQL injection in real time
- Dynamic and static masking in the same product
- Proxy or agent deployment for cloud and on-premises
Ask in the demo
- Test proxy mode for added query delay on busy databases
- Ask how many of your database types it supports today
- Check how alerts reach your SIEM
How they fit your cybersecurity program (NIST CSF)
NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. The grid shows which functions each pick maps to in our record, so you can see where a solution sits in your program and what it leaves to other controls.
Where each solution sits on NIST CSF 2.0
All 7 solutions map to Protect. 5 of 7 map to Identify. 6 of 7 map to Detect. 3 of 7 map to Respond. None map to Govern or Recover.
Swipe the table sideways to see all six functions.
| Solution | ||||||
|---|---|---|---|---|---|---|
| All solutions on this list | 0 of 7 | 5 of 7 | 7 of 7 | 6 of 7 | 3 of 7 | 0 of 7 |
| IBM Guardium | – | 2 of 3 | 1 of 5 | 2 of 2 | 1 of 4 | – |
| Imperva Data Security Fabric | – | 2 of 3 | 1 of 5 | 2 of 2 | 1 of 4 | – |
| Oracle Audit Vault and Database Firewall | – | – | 2 of 5 | 2 of 2 | 1 of 4 | – |
| Thales CipherTrust Database Protection | – | – | 2 of 5 | – | – | – |
| Trellix Database Security | – | 2 of 3 | 1 of 5 | 2 of 2 | – | – |
| LevelBlue DbProtect | – | 2 of 3 | 1 of 5 | 2 of 2 | – | – |
| DataSunrise Data Security Platform | – | 2 of 3 | 1 of 5 | 2 of 2 | – | – |
A cell shows how many of that function's categories the solution maps to.
A product helps you reach these outcomes, but it does not make you compliant on its own. Your people and processes do the rest.
CISO checklist for selecting a Database Security product
I built this checklist from my own work researching, rolling out and reviewing products like these. I recommend you go through it before you sign.
Nika (Nikoloz) Kokhreidze, Founder of CybersecTools and Mandos
Work through these steps in order to go from scattered database risk to a contract you can defend.
Your ticks stay in this browser. Nothing is sent to us.
Compare Database Security solutions side by side
Features, integrations, NIST coverage and deployment for every Database Security solution we list, in one table.
Other solutions we considered for this shortlist
We looked at 21 products for this list. These did not make the 7 above but are worth a look for the right team.
1.ALTR Data Security Platform · ALTR
Unified data security platform for cloud data access control and governance
2.Baffle Data Protection · Baffle
Transparent data protection platform with encryption & tokenization for cloud envs.
3.SecuPi Proactive Data Security Platform · SecuPi
Data security platform for real-time protection of sensitive data access
4.Sotero Data Security Platform · Sotero
Data security platform providing in-use encryption for databases and apps
5.Mirror Security Vector Intelligence Platform · Mirror Security
FHE-powered vector database security platform for AI/LLM data protection
6.CipherStash Protect · CipherStash
TypeScript SDK for field-level searchable encryption on PostgreSQL databases.
Conclusion
Start with the question you most need to answer. If auditors want proof of who accessed regulated data across many database types, IBM Guardium and Imperva Data Security Fabric are built for that. Oracle Audit Vault and Database Firewall adds a SQL firewall, and DataSunrise covers monitoring, masking and a firewall in one product.
If weak settings and old, unpatched databases worry you most, Trellix Database Security adds virtual patching and LevelBlue DbProtect runs agentless checks against CIS and DISA-STIG. If you need the data itself to stay protected, Thales CipherTrust Database Protection adds column encryption without code changes.
Frequently Asked Questions
What is database activity monitoring?
Database activity monitoring records the queries people and apps run against your databases. It shows who read or changed sensitive data, alerts on unusual activity and builds reports for auditors.
Do I need encryption if I already monitor database activity?
Often yes, because they solve different problems. Monitoring tells you who accessed data, while encryption or tokenization makes stolen data useless without the key. Many teams use both for their most sensitive tables.
What is the difference between encryption, tokenization and masking?
Encryption scrambles data so only key holders can read it. Tokenization swaps a value for a stand-in that maps back to it in a secure store. Masking hides part or all of a value, for example showing only the last four digits of a card number.
Can database admins be stopped from seeing sensitive data?
Yes. Column encryption, dynamic masking and fine-grained access rules can hide values even from admins, while still letting them run and maintain the database. Ask each vendor how they separate admin duties from data access.
What is virtual patching for databases?
A virtual patch blocks attacks on a known database flaw from outside the database, without installing the vendor's patch. It buys time until you can patch, and it protects old databases that no longer get patches.
Do these products work with cloud databases?
Most cover major cloud services such as Amazon RDS, Aurora and Azure SQL, but coverage differs by product and by service. Ask for a list that matches every database you run today.
How long does a database security rollout take?
It depends on how many databases you have and whether agents are needed. Encryption products that need no code changes can start in days, while enterprise-wide activity monitoring often takes months of tuning.
Sources
These are the pages we reviewed for each pick: the vendor's own product page and website, its market data on Mandos, and every review page we read for customer feedback.
1.IBM Guardium · IBM
Product page · IBM website · Market data on Mandos · Gartner Peer Insights · PeerSpot: ibm security guardium data protection · G2 · Reddit: ibm security guardium · PeerSpot: ibm security guardium · Reddit: anyone here use ibm guardium · Reddit: anyone here using ibm guardium i was wondering if
2.Imperva Data Security Fabric · Imperva
Product page · Imperva website · Market data on Mandos · Gartner Peer Insights · G2 · PeerSpot · Reddit: anyone here with experience in implementing dam · Reddit: cyera vs imperva for db security worth exploring · Reddit: anyone ever use imperva
3.Oracle Audit Vault and Database Firewall · Oracle
Product page · Oracle website · Market data on Mandos · G2 · Reddit
4.Thales CipherTrust Database Protection · Thales Group
Product page · Thales Group website · Market data on Mandos · G2 · Gartner Peer Insights
5.Trellix Database Security · Trellix
Product page · Trellix website · Market data on Mandos · G2 · PeerSpot · Reddit
6.LevelBlue DbProtect · LevelBlue
Product page · LevelBlue website · Market data on Mandos · Gartner Peer Insights · PeerSpot
7.DataSunrise Data Security Platform · DataSunrise
Product page · DataSunrise website · Market data on Mandos · G2 · Gartner Peer Insights · PeerSpot
