Image-file DSPM expands sensitive-data detection in cloud buckets

At a glance

What this is: Orca Security’s update applies OCR to cloud-bucket content so DSPM can detect PII inside image files such as passports and driver’s licences.

Why it matters: IAM, IGA and cloud security teams need to treat identity proof images as governed sensitive data because discovery gaps can leave regulated material outside policy, retention and access controls.

Context

Cloud buckets are often used as an intake and storage layer for identity proof documents, including passport photos, voter cards and driver’s licences. When those files are treated as ordinary objects rather than sensitive identity evidence, discovery tools can miss regulated content and governance teams lose visibility into where the data sits.

The governance gap is not limited to storage hygiene. Once an organisation asks customers, workers or applicants to upload identity documents, the resulting images become part of the identity lifecycle and must be classified, retained and accessed as personal data.

OCR changes the detection model by making image content machine-readable for DSPM workflows. That matters because the control problem is no longer just whether a bucket exists, but whether sensitive identity evidence inside that bucket is known, classified and restricted.

Key questions

Q: How should teams govern identity documents stored in cloud buckets?

A: Treat identity documents as regulated sensitive data, not as incidental uploads. Assign ownership, classify them at ingestion, restrict access to the minimum operational set, and tie deletion or archival to the business purpose that created them. If the files can contain PII, the storage location and retention policy need the same level of governance as any other controlled record.

Q: When does DSPM miss the real risk in image-based identity workflows?

A: It misses the risk when discovery only scans text objects and ignores image content. In that case, passport photos, ID cards and similar files remain outside classification even though they carry the same privacy and access obligations as other personal data.

Q: What are the signs that identity proof data is being governed poorly?

A: Look for uploads landing in shared buckets, no documented retention period, broad access to raw images and no evidence that OCR or similar discovery is classifying the files. Those signals point to an inventory problem, not just a storage issue.

Q: What is the difference between storing identity documents and governing them?

A: Storing a file only places it in a bucket. Governing it means the organisation knows what the file contains, why it exists, who may view it, how long it may stay, and when it must be deleted or redacted.

Technical breakdown

Why image files evade text-only sensitive-data discovery

Traditional DSPM pipelines are strong at scanning text objects, database fields and log content, but image files are different. A passport scan or ID card photo is usually an unstructured object whose sensitive fields are embedded as pixels, not as searchable text. Optical Character Recognition converts that visual text into machine-readable output so classification engines can identify PII, PHI, PCI data or custom identifiers. In cloud storage, that distinction matters because buckets often become the landing zone for uploads from mobile apps, banking flows and onboarding workflows. Without OCR, the data exists but remains effectively invisible to discovery tooling.

Practical implication: Extend discovery coverage beyond text objects and test whether uploaded identity images are actually classified, not merely stored.

How cloud-bucket DSPM ties data classification to identity governance

Image-file DSPM is not just a storage feature. It changes how identity evidence enters governance workflows because a photo of an ID is still personal data with a lifecycle, an owner and a purpose. Once classified, that object can feed policy decisions about who may access it, how long it may persist and whether it requires masking or redaction in operational workflows. This is where DSPM intersects with IAM and IGA: discovery is the prerequisite for setting controls, but governance only works if the sensitive object is mapped to the right business process and retention boundary.

Practical implication: Map identity-proof uploads to a named business process and apply access, retention and deletion controls at the object level.

Why redacted evidence matters in regulated cloud environments

The article notes that the platform provides redacted samples of detected sensitive data. That is operationally important because security teams need proof that a control found the right object without exposing the underlying identity data to more people than necessary. Redacted evidence supports triage, auditability and incident review while reducing unnecessary handling of raw identity artifacts. In privacy-heavy environments, the problem is not only finding the data but demonstrating that detection itself does not create a new exposure path.

Practical implication: Require redacted evidence in DSPM workflows so triage and audit can proceed without broadening access to identity documents.

Threat narrative

Attacker objective: Gain access to unclassified identity documents at rest and use that exposure for privacy abuse, compliance failure or downstream credential and fraud activity.

1. Entry occurs when customers, applicants or employees upload identity document images into cloud buckets as part of normal application or verification workflows.
2. Credential or access abuse is not the primary issue here; the risk emerges when those objects are stored without sufficient classification, ownership or access restriction.
3. Impact occurs when regulated identity images remain undiscovered by text-focused scanning, leaving PII exposed to overbroad access, retention failures or compliance breaches.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

OCR turns identity documents into a governance object, not just a file format problem. Once a passport photo or driver’s licence image lands in cloud storage, the question is no longer whether the upload succeeded. The question is whether the organisation can classify that object as regulated identity evidence and bind it to policy. That is why DSPM and IAM now overlap at the point of ingestion, not after the fact.

Identity proofing workflows create a data-classification blind spot when they depend on image uploads. Many programmes still treat document images as a front-end convenience, then assume downstream storage controls will close the gap. They often do not, because text-only discovery cannot see what OCR can. The result is a governance gap in which the most sensitive artefacts of the identity lifecycle are least likely to be inventoried correctly.

Cloud-bucket visibility is becoming part of identity governance maturity. If an organisation cannot find identity documents in object storage, it cannot prove retention, access restriction or deletion discipline. That makes DSPM a control-point for privacy compliance and identity lifecycle governance, not merely a cloud security add-on. Practitioners should treat unclassified identity images as an inventory failure with compliance consequences.

Sensitive identity images require an object-level control model. The same upload path can serve onboarding, travel, age verification and customer due diligence, but the control obligations differ by use case and jurisdiction. A single bucket policy is rarely enough because the content, purpose and retention period vary. The practical conclusion is to govern identity images as a dedicated data class, with discovery, access and lifecycle controls aligned to the business process.

Image-file DSPM sharpens the case for privacy-aware identity telemetry. The strongest value here is not simply finding more files. It is proving that sensitive identity artefacts can be detected, redacted and governed before they spread across buckets, backups and secondary workflows. For security leaders, that shifts the conversation from storage sprawl to evidence handling and policy enforcement.

From our research library:

• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Read next: Identity Data Privacy and Consent Guide

What this signals

Image-file discovery is now part of privacy governance. As more identity flows move to mobile upload patterns, the control boundary shifts from the application form to the object store. Teams that only scan text files will continue to miss identity evidence embedded in images, which is exactly where the highest-risk personal data often sits.

Object-level governance becomes the decisive control point. The practical problem is not whether cloud storage can hold identity documents, but whether those documents can be classified, retained and restricted as a distinct data class. That pushes IAM, IGA and DSPM teams to align on a shared inventory of identity artifacts, not separate views of the same bucket.

For practitioners

• Define identity image data classes Classify passport scans, ID photos, voter cards and driver’s licences as regulated identity evidence, not generic uploads.
• Enable OCR in DSPM workflows Validate that sensitive-data discovery includes image files in object storage, especially cloud buckets used by onboarding and verification flows.
• Tie object storage to retention rules Assign retention, deletion and review periods to identity documents based on the business process that collected them.
• Limit access to redacted evidence Use redacted samples for triage and audit so analysts can confirm detection without broad access to raw identity images.

Key takeaways

• Image-based identity documents create a discovery blind spot when organisations rely on text-focused scanning alone.
• The control gap is amplified in cloud buckets because uploaded IDs, passports and similar files often become regulated personal data at rest.
• Governance improves when identity images are classified at ingestion and tied to object-level access, retention and redaction controls.

Key terms

• Identity Verification Artifacts: Identity verification artifacts are the visual or data irregularities that expose tampering, fabrication, or inconsistency during onboarding. They may appear in facial features, borders, texture, or motion. Detection systems use these artifacts to distinguish genuine capture from manipulated media or synthetic identity attempts.
• OCR-based Discovery: OCR-based discovery is the use of optical character recognition to make text inside images searchable for security and compliance workflows. In DSPM, it extends sensitive-data detection into files that would otherwise be invisible to text-only scanning, especially in cloud object storage.
• Field-Level Data Governance: The practice of deciding exactly which data elements a script, application, or service is allowed to read, process, or transmit. It is stricter than application-level approval because it focuses on individual fields, not just the overall feature or integration.
• Sensitive Data Inventory: A sensitive data inventory is the live record of where protected information exists, how it moves, and which identities can access it. It is the operational foundation for enforcement, auditability, and breach response because classification without inventory cannot be verified.

Deepen your knowledge

NHI governance, identity lifecycle management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or NHI governance programme, it is worth exploring.