Database Security

Databases remain the dominant technology for storing business-critical digital information, so protecting the integrity, confidentiality, and availability of sensitive data (manufacturing parameters, financial transactions, customer records) is central to enterprise security. Database security spans controls for the data and database systems themselves, plus the supporting compute/network infrastructure and the applications that access data. Key risks include accidental or malicious corruption and loss, over-privileged administrators and accounts, compromised legitimate users via malware or phishing, exploitable software vulnerabilities or misconfigurations, and denial-of-service attacks that disrupt access.

Because database security is multifaceted, the report emphasizes a strategic, multi-layered architecture with centralized management, governance, and analytics, rather than isolated point solutions. The evaluation focuses primarily on protection for traditional RDBMS, rewarding broader coverage (e.g., NoSQL support), cloud/hybrid deployment readiness, and integration into existing security ecosystems—especially SIEM/SOC, IAM, and security governance tools. It also considers support for Security and Privacy by Design principles (including encryption, masking, fine-grained dynamic access management, and unified policies across environments), framed as increasingly important given upcoming GDPR obligations.

The functional areas assessed include vulnerability assessment; data discovery and classification; data protection (encryption, masking, tokenization); monitoring and analytics (visibility, alerting, anomaly detection, SIEM integration); threat prevention (e.g., SQL injection, DoS controls, exploit prevention); access management (dynamic policies, privilege reduction, behavior analytics); audit and compliance (centralized reporting, separation of duties, forensics); and performance/scalability constraints (including passive monitoring for critical systems). In leadership ratings, IBM and Oracle lead overall, with IBM ranked highest due to database-agnostic breadth; other mature vendors cluster as challengers, while several smaller innovators and “vendors to watch” broaden the market’s evolution.

• Security risks for databases include human error, sabotage, over-privileged access, compromised user accounts, software vulnerabilities or misconfigurations, and denial-of-service attacks.
• The evaluation focuses primarily on security solutions for traditional relational database management systems (RDBMS).
• Solutions that also protect NoSQL databases are rated more favorably.
• Integration with SIEM/SOC solutions, identity and access management systems, and security governance technologies is a major evaluation focus.
• Key functional areas assessed include vulnerability assessment, data discovery and classification, data protection, monitoring and analytics, threat prevention, access management, audit and compliance, and performance and scalability.
• IBM and Oracle are positioned as Leaders in the Overall Leadership rating.
• IBM is positioned as the overall leader because its solutions are database-agnostic, while a substantial portion of Oracle’s portfolio focuses only on Oracle databases.
• The Product Leadership Leaders are IBM, Oracle, and Gemalto.
• The Market Leadership Leaders are Oracle, IBM, Thales e-Security, Gemalto, and McAfee.
• HexaTier was acquired by Huawei at the end of 2016.

• “Customers are encouraged to look at database security products not as isolated point solutions, but as a part of an overall corporate security strategy based on a multi-layered architecture and unified by centralized management, governance and analytics.”
• “Solutions offering support for multiple database types as well as extending their coverage to other types of digital information are expected to receive more favorable ratings.”
• “Another crucial area to consider is development of applications based on the Security and Privacy by Design principles.”
• “Although classification alone does not provide any protection, it serves as a crucial first step in defining proper security policies for different data depending on their criticality and compliance requirements.”
• “For certain critical applications, passive monitoring may still be the only viable option.”
• “Only the largest players in the market, which offer a wide range of products covering different aspects of database security can be found among the leaders.”
• “Depending on your specific requirements, vendors generally not recognized as the Leaders may still be the best choice.”
• “We recommend that you always perform a thorough product selection and evaluation process for your specific projects.”
• “There are no Followers in this rating, indicating overall maturity of the vendors representing the market in our Leadership Compass.”
• “Vendors above the line are sort of ‘over-performing’ in the market.”