Every practice has a history that nobody wrote down while it was happening. Ask someone in data protection when their field began and you will get a shrug, because it arrived the way neighbourhoods age: one small change at a time, until suddenly the street has a different name. DataSecOps is the newest name on that street, and its story fits in five dates — a database feature nobody applauded, a blog post that named a job people were already doing, a year of stolen passwords, a takeover bid, and a bill that finally put the whole thing on chief executives’ desks. Walk the five in order and the trend line becomes obvious: protection has been moving from yearly projects toward something continuous, priced, and impossible to ignore.
Before the first date: what DataSecOps actually names
One definition first, so the dates mean something. The word was put into circulation by Ben Herzberg of the vendor Satori Cyber on 4 August 2021, and it names a habit rather than a product: security that keeps pace with datasets and their users as both keep moving underneath it. It remains a vendor’s word — no standards body has signed it — while the formal world keeps writing data security governance into its papers. The habit itself is older than the word, which is exactly why a history told through dates works: the word arrived late to a job that had been quietly forming for years.
Date one: January 2016, a feature nobody applauds
PostgreSQL 9.5 shipped row-level security that winter, letting a database decide, row by row, who may see what. No keynote celebrated it; most teams took years to switch it on. But look at what it started: protection moving out of network diagrams and into the tables themselves, evaluated at the moment somebody actually asks for a value. Apache Ranger brought comparable row filters and column masking to the Hadoop world from version 0.6, and the bigger warehouses followed with their own native versions. The direction of travel was set before anyone had a word for it — controls were moving inward, toward the data, and they would never move back out. Everything this history records afterwards is, in one way or another, the consequences of that quiet migration: once the table decides who sees it, the questions about who owns the table, who approves access and who reads the logs stop being theoretical.
Date two: 4 August 2021, the DataSecOps word arrives
Herzberg’s defining piece gave the scattered work a name and, more usefully, a shape: discovery, classification, rules written as code, enforcement, control of what leaves, reading of access history, and periodic review with real revocations. The full scope, borders included, is documented in the Ops Atlas entry for DataSecOps, the reference this whole history leans on. The borders matter as much as the shape — pipes and pipeline work sit with DataOps, lawful-basis questions sit with PrivacyOps, staff identities sit with IAMOps — so teams could tell their new problem apart from their old ones. Naming matters more than outsiders assume. Once the job has a label, budget lines can reference it, job posts can require it, and the person doing it stops being the unofficial keeper of passwords and becomes a role with a title.
Date three: 2024, the passwords come home to roost
The theory met its stress test that year. A criminal group tracked as UNC5537 spent 2024 logging into customers of cloud-data platforms with usernames and passwords harvested months earlier by infostealer malware — the majority of the hit accounts had appeared in those criminal logs beforehand, second factors were largely missing, and some credentials had stayed unchanged for four years. Records left through the database’s own bulk-copy command; the platforms themselves held. Around 165 organisations ended up notifying. The episode re-ordered every priority list overnight: identity hygiene first, because the perimeter had quietly moved from the network to the login form years earlier without most organisations noticing. Insurance questionnaires, procurement forms and board packs all grew a credential-rotation line within months of the disclosures, which is how a security lesson becomes an administrative fact.
Date four: 28 August 2025, the buyer shows up
Consolidation announced itself late that summer, when backup giant Commvault moved to acquire Satori Cyber, the very vendor whose chief scientist had coined the word in 2021, naming a preliminary figure of USD 28.3 million. Read it as the market declaring the practice permanent: the tooling for protecting data in motion was worth folding into a platform company, not leaving as a boutique. The same season, Europe’s top court added legal nuance in the C-413/23 P ruling (EDPS against SRB) — coding data protects recipients who cannot undo the coding, but never the party holding the key — and Gartner formalised the shopping aisle with its data security platforms market guide. A field gets buyers, rulings and analyst categories in that order; all three landed inside one year.
Date five: 2026, the DataSecOps bill comes due
IBM’s 2026 research landed on USD 4.99 million as the average price of a breach — the series’ worst reading yet, and the number that turns protection from a technical preference into a board item. Every earlier date built toward this one: the engines supplied controls, the word supplied vocabulary, the attacks supplied evidence, the consolidation supplied procurement channels, and the bill supplies urgency. The trajectory keeps its slope, too. Teams that once scheduled an annual audit now run quarterly reviews that actually revoke; grants carry expiry dates instead of lifetimes; and classification, once a dusty spreadsheet, has become the first chapter of every serious rollout.
What the five dates mean from here
Extrapolating a trend is a risk, but the direction is legible: protection behaves less like an event and more like maintenance — scheduled, evidenced, and owned by name. For organisations still waiting, the five dates compress into a single instruction: start the inventory now, because every actor in this story — the engines, the buyers, the attackers, the courts — has already moved. Operators in any trade can watch the same pattern in their own domain, wherever structure meets scrutiny: a city that plans its welcome properly, as the guides to planning a first trip to Chennai and its full attractions, heritage and culture show, earns the trust that a city merely famous for it — an important cultural city in South India — has spent centuries building. Protection histories read the same way: the trust was banked slowly, then spent quickly.
The dates, gathered for quick citation:
- January 2016 — PostgreSQL ships row-level rules, and protection begins moving toward the table itself.
- 4 August 2021 — a vendor blog gives the scattered work a name and a shape.
- 2024 — stolen-password intrusions reorder every priority list toward identity first.
- 28 August 2025 — Commvault bids for Satori Cyber; a court ruling and an analyst guide land the same season.
- 2026 — the average breach reaches USD 4.99 million, and boards take over the conversation.
