Shadow data refers to sensitive information that exists within your organization but remains unidentified and unprotected by your current data loss prevention systems. This data includes dynamically and rapidly generated unstructured content such as:

You can't configure pattern-based matching for all types of sensitive data because each definition lacks the complete contextual understanding of a document or payload. Trainable classifiers can grasp contextual nuances, but they depend on manual uploads of known sensitive documents that might not always be available or sufficient for training. These limitations create gaps in your data security posture, allowing sensitive information to go undetected.

Shadow Data Discovery enables Enterprise Data Loss Prevention (E-DLP) to analyze your organization's data and identify patterns without requiring you to predefine what constitutes sensitive information. Enterprise DLP runs summarization and categorization on your file-based assets, collecting summaries for up to 100,000 documents and organizing them into categories, which are AI-generated groupings of similar documents based on their content and context. Enterprise DLP then maps these categories to groups, which are broader classifications that align with common data types such as source code, personally identifiable information (PII), or financial records. Groups make it easier to understand your data landscape and author data protection policies against meaningful classifications rather than individual clusters.

Enterprise DLP maps categories to a set of predefined groups automatically, and you can customize those mappings or create your own groups to reflect how your organization structures its data. This approach helps you discover and protect sensitive data that would otherwise remain hidden in your environment.

Shadow Data Discovery supports file-based scanning for the following SaaS apps onboarded to Data Security (SaaS API).