Every emerging-technology field has one term that arrived late, stuck awkwardly, and ended up describing the whole discipline. For the people who guard data as it moves, that term is DataSecOps — barely five years old, coined by a vendor, disputed by purists, and now impossible to avoid in enterprise buying conversations. Watching a label grow up this fast is its own kind of emerging tech story, so here is the state of play as it stands in late 2026 — the dates, the sums and the rulings, with the speculation clearly marked as such.

The DataSecOps Timeline So Far

The origin is refreshingly well documented for an industry term. On 4 August 2021 the definition appeared under Ben Herzberg’s byline — he leads science at Satori Cyber — describing security that travels with the data and its users as both keep shifting. Purists noted at the time, and still note, that no standards body recognises the label; the craft it names had long gone by the duller title of data security governance. The timeline then accelerates. Through 2024, attackers tracked as UNC5537 worked through customers of a leading cloud warehouse with stolen logins — the published review counted infostealer contact on 79.7% of the hit accounts, missing multi-factor authentication, and some passwords untouched for four years; notifications eventually went out from about 165 organisations, while the platform held firm. August 2025 brought consolidation: Commvault announced it was buying Satori Cyber, preliminarily priced at about USD 28.3 million. September 2025 delivered a legal milestone when Europe’s top court ruled, in EDPS v SRB, that pseudonymisation strips personal-data status once material reaches a recipient with no realistic route to re-identification, while the key holder’s own copy stays personal. Meanwhile regulators kept moving — the EDPB circulated draft guidelines 01/2025 on pseudonymisation, and NIST refreshed SP 800-53 Revision 5 on 27 August 2025. The Ops Atlas DataSecOps entry keeps this chronology in one place if you want dates without commentary.

Three Shifts Defining the Practice Right Now

Read the tooling releases together and three movements stand out:

• Console to code. The mature teams have stopped clicking policies into consoles — an unversioned click has no author, no review and no rollback — and moved rules into repositories where they are tested like any other change. Third-level maturity now explicitly demands zero console-only policies.
• Engines smoothing out, unevenly. Databricks is rolling ABAC-style tagging through Unity Catalog, with portions still marked Beta. Lake Formation filters reads but not writes. BigQuery loses partition pruning wherever row-level rules apply, and WRITE_TRUNCATE loads still discard policy tags. Row-level security landed in PostgreSQL with version 9.5 (January 2016), while its referential-integrity machinery skips those rules — a bypass its documentation admits outright. Ranger has filtered rows and masked columns since 0.6. Snowflake, meanwhile, is retiring password-only sign-ins through 2026.
• Annual audit to continuous evidence. History views such as Snowflake’s ACCESS_HISTORY stretch 365 days back, trail by up to three hours and skip failed queries; lineage tooling like OpenLineage fills gaps pgAudit cannot, notably superuser activity. Evidence is becoming a live feed rather than a winter project.

The Workflow Everyone Is Adopting

One more trend deserves its own paragraph, because it explains how the discipline feels day to day. Access has become a request, not a favour. A petition names the dataset, states the purpose and sets the duration; the owner reviews it like a proposed change; automation checks and issues the grant, expiry included. Routine asks resolve within the day, which removes the motive for side doors, while unusual ones need a filed ticket plus a signed-off risk note and a firm end date. Quarterly, somebody walks the whole grant list and cancels whatever nobody defends. Every part of that loop would have blunted the 2024 credential attacks described above — the accounts that fell had access that never expired and logins nobody re-examined.

What the Money Says About Urgency

Follow the invoices and the adoption curve stops looking mysterious. The average breach now costs USD 4.99 million, per IBM’s 2026 study — the worst figure that series has recorded. Capital One’s 2019 incident, roughly 100 million individuals affected through a misused credential, paying USD 80 million to the OCC when the dust settled. On the spending and standards side, analysts need their own vocabulary: the Gartner market guide of 2025 groups the tooling as data security platforms, and the acquisition arithmetic above tells you the consolidators agree the category matters. Query-time control — deciding per row, per column, per request who sees what — is where the budget lines are converging, and the tokenisation stack has settled on capable primitives such as HashiCorp Vault Transform running FF1 format-preserving encryption.

Where DataSecOps Goes Next

Extrapolating from the documented record rather than hype: expect the maturity ladder the Atlas publishes — Ad hoc, Classified, Enforced, Evidenced, Adaptive — to show up in more board decks, because its exits are unusually checkable. Half of tier-1 coverage reaches the second level; the third demands over ninety percent coverage plus not one console-only policy anywhere; the top rung is verified by watching whether a freshly minted sensitive table lands under protection before anyone gains first access, every time. Expect standards pressure to keep rising through SP 800-207 and the CISA zero-trust framework in its second iteration, and expect pseudonymisation arguments to keep reaching courts, with the EDPB already warning that pseudonymisation alone will normally fall short as a safeguard. For readers tracking the wider security horizon, our piece on quantum computing’s impact on cryptography covers the pressure arriving at the key-management layer this whole discipline depends on. And if you want the adjacent trend from the pipeline side, our write-ups on data pipeline automation benefits and on automated security checks across delivery pipelines bracket the same movement from opposite ends.

Five years from coinage to consolidation is fast even by emerging-tech standards, where terms usually outlive the problems they name. The term began as one scientist’s shorthand, survived a sceptical reception, gained a Fortune-list acquirer, and now names a practice with checkable maturity exits and court-tested definitions underneath it. Whatever you prefer to call it — the atlas keeps both names visible — the direction of travel is unmistakable: protection that moves at the speed of the data, judged by evidence instead of intention. Terms will keep churning; deadlines, owners and revocations do not.