Sensitive data discovery

Sensitive data discovery is the work of locating files likely to hold regulated or confidential material. A metadata-only approach surfaces candidates from signals such as name, path, format, and location, then leaves the judgment to a person. It answers where to look first. After an incident, that is the question everything else waits on, and an index turns it into a search rather than an investigation.

Key takeaways

It shows teams where to look first, from metadata alone.
A metadata-only approach uses signals such as name, path, and location.
Knowing where sensitive files sit limits the damage if a breach happens.

What counts as sensitive data?

Any data that would cause harm if it reached the wrong people. Common types are personal data such as names with addresses or ID numbers, health records, payment and bank details, employee records, contracts, and intellectual property such as designs, source code, and unreleased media.

What is the difference between dark data and sensitive data?

They describe different things. Dark data is data nobody can describe: its content and value are unknown. Sensitive data is data that would cause harm if exposed, whether or not anyone knows it is there. The two overlap in the most dangerous place: sensitive data that is also dark, such as old HR exports or scanned contracts nobody remembers, is exposed and unprotected at the same time.

How does file visibility reduce the impact of a breach?

It shortens the slowest step. After an incident, the first question is what was in the affected location. With an index, that is a query. Without one, it is an investigation. Breach cost rises with the time taken to scope and contain, and IBM put the global average at $4.99 million in its 2026 Cost of a Data Breach Report.

Where does sensitive data hide in file storage?

Mostly in places nobody thinks to check:

Exports and reports: spreadsheets exported from HR, finance, or sales systems and saved to shared drives.
Folders of people who left: files that were never reviewed when the account was closed.
Old copies: data left behind by past migrations, tests, and projects.
Scans: scanned forms, contracts, and IDs saved as images or PDFs.

These locations can be flagged from attributes such as path, owner, and file type, and then checked with tools that review content.

Can metadata alone find sensitive data?

It can point to where sensitive data is likely to be, but it cannot confirm it. Metadata signals include folder paths such as HR, payroll, legal, or patients; owners in departments that handle personal data; file types such as scans, exports, and spreadsheets; and file names that include words like “passport” or “contract.” Those signals narrow millions of files to a short list of likely locations, and content scanning tools then confirm what each file actually holds.

How can file analytics help find sensitive data?

By turning those signals into reports that show where risk is growing:

Where it piles up: folders with many exports, scans, or spreadsheets from HR, finance, or sales systems.
Who holds it: owners and departments with large amounts of likely sensitive files, including people who have left.
How old it is: likely sensitive files past their retention period, which only add risk.
Where it should not be: likely sensitive files sitting on shared drives, in the cloud, or in regions where they are not allowed.

Security and privacy teams can then start their reviews with the riskiest folders, instead of the whole estate.