The silent contract
In a world where every query could be a compliance risk, can you afford blind spots in your database monitoring? Every interaction with a database is more than a transaction. It is a silent contract between the system and the people it serves. Each query that touches sensitive data should be able to affirm three things: this access is secure, it is justified, and it is logged.
Observability is the discipline that lets an enterprise keep that contract, and show that it has kept it.
The trust stack, in one view
Data, monitoring, governance and compliance combined into one system, so every query to sensitive data is recorded, evaluated and protected.
- Detecting unauthorised access attempts
- Keeping clear audit trails across thousands of events
- Mapping database activity to regulatory frameworks
- Layered architecture: data, monitoring, governance and compliance as one system
- Real-time intelligence, beyond log collection
- Auditability at scale: proof, not promises
Where organisations struggle
Most enterprises collect database logs. Far fewer can detect an unauthorised access attempt while it is happening, maintain a clear audit trail across thousands of events a day, or map database activity directly to the frameworks their auditors ask about. The logs exist; the answers do not.
The trust stack
The answer is a stack, not a tool. Auditing at the data layer records who did what to which objects, down to specific sensitive columns. A monitoring layer parses those records in real time and raises anomalies on query patterns, such as out-of-hours access to sensitive data. A governance layer decides what justified access looks like and who owns each rule. A compliance layer turns the result into dashboards and evidence that map to obligations.
Every query is not just recorded. It is evaluated and protected.
In our own estate
On an Oracle 19c platform, unified auditing tracks logins, schema access and DML activity, and fine-grained auditing watches access to specific sensitive columns, such as PAN and Aadhaar, with custom conditions and session detail. Those audit records flow into a SIEM, in our case Wazuh, which parses them in real time, raises alerts on anomaly triggers and powers dashboards for the GRC team. The stack is ordinary technology. The discipline of connecting the four layers is what most estates lack.
What regulators expect
For financial services in India the expectation is explicit. The DPDP Act 2023, the RBI's cyber security directions and SEBI's guidelines all point the same way: a layered architecture in which data, monitoring, governance and compliance work as one system; real-time intelligence rather than log collection; and auditability at scale. Proof, not promises.
Telemetry is not observability
Collecting signals is the easy part. Observability is being able to answer the questions operators, risk teams and auditors actually ask: who accessed which sensitive column, from where, was it justified, and what happened next. The same standard applies well beyond databases, to identity systems, APIs, cloud control planes and, increasingly, the AI services that read enterprise data. A platform you cannot interrogate that way is a platform you cannot trust, however many dashboards it has.
Where to begin
Start with the one data store your regulator would ask about first. Turn on auditing for its sensitive columns. Route the records to the SIEM you already own. Write three alert rules that would have caught your last near-miss. Put a named owner on each. Then ask the question the stack exists to answer: can we prove who touched this data last quarter, and why? If the answer takes a week, that is the finding.
Trust is not a feature. It is the foundation. Build it, one query at a time.
Krishna works at the intersection of cyber security, infrastructure, AI and enterprise risk, with a focus on engineering trustworthy and resilient technology foundations.
Follow on LinkedInThis perspective expands a post first published by the author on LinkedIn.
