Topic starter
18/08/2026 2:42 pm
TL;DR: Sensitive data protection still fails first at discovery, because fragmented on-premises, cloud and SaaS estates hide PII in databases, collaboration tools, logs and backups, according to Ground Labs. For security and privacy teams, the hard problem is building a usable inventory before encryption, access control and compliance can work at scale.
Editorial analysis by NHI Mgmt Group, based on content published by Ground Labs: “Why is data discovery the hardest part of data protection?”.
Key questions
Q: What should security teams do first when data discovery is incomplete?
A: Start with a complete inventory of the main data locations, including SaaS apps, collaboration tools, backups, logs, and file shares.
Q: Why does fragmented data storage make compliance harder?
A: Because compliance obligations depend on knowing what data exists, where it sits, and who can reach it.
Q: What breaks when sensitive data is spread across unknown or forgotten data stores?
A: When sensitive data is scattered across unknown or forgotten stores, security teams lose inventory accuracy and backup coverage at the same time.
Practitioner guidance
- Map the full data estate before policy tuning Build a discovery inventory that spans databases, SaaS, collaboration tools, file shares, logs, and backups so policy work starts from actual data location.
- Prioritise unstructured data coverage Extend scanning and classification to documents, chats, tickets, and exported files, because sensitive content often appears there before it is formalised elsewhere.
- Tie identity and access controls to discovered assets Use the inventory to connect data owners, access paths, and retention rules so IAM and privacy controls apply to the real locations of sensitive information.
Bottom line: Data protection programmes fail earliest at discovery because sensitive information is spread across systems that traditional inventories miss.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:26 pm
Discovery is the governing control that makes every other data control usable. Encryption, access control, and compliance are all downstream of knowing where sensitive data lives. In distributed estates, the absence of a trustworthy inventory means security teams are operating on partial maps, which creates blind spots in both technical enforcement and audit evidence. The practitioner conclusion is simple: discovery quality determines whether data governance is real or mostly aspirational.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How do organisations know whether discovery is working?
A: Look for measurable coverage across the full estate, including shadow IT, backups, logs and collaboration tools, plus evidence that classified findings feed into access review and remediation workflows. If discovery only finds known systems, it is not changing governance. Effective discovery reduces unknown repositories and shortens the time from identification to control action.
👉 Read our full editorial: Data discovery is the bottleneck in modern data protection