A client email lands: “the board wants our data locked down, what do we buy?” Independent engineers get this brief more often than any other security question, and answering it well means comparing two genuinely different routes. This piece puts them side by side — the controls warehouses ship with, versus the overlay products that sit across several engines at once — and ends with what belongs in your statement of work.

What DataSecOps Work Actually Consists Of

Scope first, so the comparison has fixed boundaries. The label comes from Satori Cyber’s Ben Herzberg, who set it down on 4 August 2021 to describe security woven, in agile fashion, into data and user populations that never stop changing. It remains vendor language — standards bodies never adopted it, and data security governance is the older term for the same craft — and its author’s employer now belongs to Commvault, which announced the purchase on 28 August 2025 at a preliminary USD 28.3 million. The craft itself is concrete: find and tag sensitive columns, encode rules per row, column and query, enforce them at read time, monitor what leaves, and keep cancelling access nobody defends. For a neutral definition to cite in the proposal itself, the atlas definition of DataSecOps is the tidy citation.

Contender One: The Engines’ Own Controls

Every major platform now carries usable primitives, each with documented personality. Build on them and you inherit both the power and the quirks:

• Snowflake gates masking, row access and classification behind Enterprise Edition or higher. A tag can carry only one masking policy per data type; an attached policy is permanent — you edit its body with SET BODY rather than swap it. Its ACCESS_HISTORY view reaches 365 days back, may trail by three hours, and omits failed queries.
• BigQuery’s row-level security disables partition pruning on the filtered tables, so costs climb; a WRITE_TRUNCATE load silently discards policy tags; and query-duration side channels leak information to the patient observer.
• Databricks Unity Catalog introduces ABAC-style tags across its estate, with portions still flagged Beta.
• AWS Lake Formation applies read-time filters — writes pass through untouched.
• PostgreSQL has shipped row-level security since 9.5, back in January 2016, yet referential-integrity checks bypass the policies entirely, a leak its own docs call a covert channel.
• Apache Ranger, in the Hadoop family since its 0.6 release, filters rows and masks columns at grant time.

Two further limits repeat across engines: duplicates created by copy or CREATE OR REPLACE frequently lose their tags, and insert paths are rarely covered by read-oriented policies. Tokenisation done properly needs a vault — HashiCorp’s Transform applies FF1 format-preserving encryption for exactly this job — and audit coverage needs pgAudit on Postgres systems, with the caveat that superuser actions escape it, plus lineage from OpenLineage.

Contender Two: The Overlay Platforms

The second route abstracts policy out of the engines. Products from Commvault’s Satori line, Immuta and Privacera connect to several warehouses at once, hold one policy model, and translate it per platform. The pitch is real: a distributed team with Snowflake, BigQuery and Redshift can write a rule once. Onboarding is faster, audit views arrive pre-joined, and engine-tier licensing sometimes drops because the overlay supplies masking on cheaper editions. The costs are equally real: another subscription, another identity to federate, and a component that must sit in every query path to matter — with the operational review that implies whenever an engine is added or a connection moves. Which leads to the sentence every proposal should contain, because it is the most common way these projects fail:

A proxy layer supplements native controls; it never substitutes for them. Direct connections, shares and clones that skip the proxy bypass every rule it holds.

Head-to-Head: Where Each Route Wins

Summarised for the scoping conversation:

• Choose native when the estate runs on one engine, the team already holds the right tier, and latency budgets are tight — fewer moving parts, no extra vendor.
• Choose an overlay when engines are mixed, policy changes need to propagate in minutes rather than sprints, or audit reporting must look identical across platforms.
• Choose both when compliance demands defence in depth — overlays for the request workflow and the paperwork, native policies so a bypassed proxy still leaves the data covered.

Whichever column you mark, one sequencing rule holds: classification precedes purchase. Sizing any product against data you have not yet inventoried produces the expensive kind of guess, and reviewers of freelance contracts — a topic we covered in what recruiters actually assess — increasingly ask for that inventory step by name.

The Dashboard You Promise the Client

Whichever route the client picks, the same four numbers prove the work, and a worked example shows the arithmetic. Take an estate with 1,240 sensitive-or-likely columns of which 1,085 sit behind some policy: coverage reads 87.5%. Of all reads against sensitive columns, 17.1% still hit plain-text values, which is the figure that should trend to near zero. Over-exposure counts principals holding more than their role needs — 212 out of 940, or 22.6%. Dormancy counts grants untouched for ninety days or more — 310 out of 1,900, a 16.3% queue for the revoke pass. Quote those four as the project’s exit criteria and the engagement stops being a matter of taste. Maturity language, if the client wants it, has published exits too: level two at more than half of tier-1 covered, level three at over ninety percent with no console-only policies anywhere.

The DataSecOps Build Decision, and the Quote You Send

Translate the comparison into deliverables and the quote writes itself. Line one: discovery sweep with human-confirmed tags on the top tables. Line two: policy set as versioned code, with request, approval, expiry and a quarterly revoke calendar. Line three: egress logging and the evidence pack. Clients combining this with broader platform work — the situation described in our note on pairing cloud and DevOps consulting — should see the same loop appear under both headings rather than two competing plans. Newcomers weighing whether such engagements suit them can start with the beginner FAQ for new freelancers. The honest close for the client email: the engines you already pay for can carry most of the policy; an overlay earns its fee only where several engines and one policy must meet; and whichever route you pick, the rules need owners, expiries and reviews, or they are decoration.