Cyberwatch-WX: Sensitive Data Discovery, Classification, and Unstructured Data Scanning
Audience: CEO, CFO, CSO/CISO, CIO, General Counsel, Owners, and Board Members
Author: Northern Data Solutions — Office of the CTO
Service Line: Cyberwatch Advanced — Proactive Advanced Security: Data Discovery and Governance. Cyberwatch-WX is included in the Proactive Advanced Security subscription at no additional cost.
1. Executive Summary
Every compliance obligation your organization carries — PCI DSS, CMMC, the FTC Safeguards Rule, HIPAA, state privacy law — begins with the same unwritten assumption: that you know where the regulated data is. Almost no organization does. Payment card numbers sit in a spreadsheet on a departmental share. Controlled Unclassified Information arrives as an email attachment and gets saved to a personal OneDrive. Employee Social Security numbers live in a decade-old HR archive nobody has opened since the last system migration. None of it is in the system of record, and none of it appears on the asset inventory your assessor was handed.
Cyberwatch-WX is the sensitive data discovery and classification capability of the Cyberwatch Advanced platform, delivered by Northern Data Solutions. It continuously scans structured and unstructured repositories across on-premises, cloud, and SaaS environments; identifies regulated content by what it actually is rather than by where it is filed; resolves who can reach each file through every nested group and inherited permission; and drives automated remediation that shrinks exposure rather than merely reporting it.
Identifying sensitive data is only the beginning. Cyberwatch Advanced bridges the critical gap between knowing where your risk lives and actually eliminating it. Where a point-in-time PII scan produces a spreadsheet that ages out within weeks, Cyberwatch-WX produces a continuously maintained, defensible inventory — and the access, remediation, and disposal evidence that turns that inventory into an auditable control.
Every framework you are assessed against assumes you have a complete data inventory. Fewer than half of organizations actually have one. That gap is where breaches, audit findings, and denied claims originate.
According to the 2026 Data and Identity Security Report, only 43.4% of organizations maintain a continuously updated, complete inventory of where sensitive data resides, and 8.2% have none at all. Lack of visibility into who can access sensitive data is the single leading cause of exposure, at 36.9% — ahead of excessive permissions themselves. Only 24% of organizations remediate risky access immediately through automation; the rest rely on periodic manual review or act only after an incident.
2. The Business Problem: You Cannot Protect What You Cannot Find
Four structural gaps make the unstructured data estate the most under-governed high-value asset most organizations own.
Data sprawls faster than any team can track it. Sensitive content multiplies across file shares, SharePoint and OneDrive, Teams channels, cloud object storage, SaaS applications, databases, email archives, and now AI-connected repositories. Each copy is an independent exposure with its own permissions. The original may be well controlled; the fourteen derivative copies are not.
Point-in-time scanning produces stale answers. A discovery exercise run for last year’s audit describes an environment that no longer exists. Newly created and newly modified content — which is precisely where the highest-risk material tends to be — is invisible to a scan that already finished. An inventory that is not continuously maintained is a historical document, not a control.
Keyword and regular-expression matching is not classification. A pattern that matches sixteen consecutive digits will flag part numbers, invoice references, and tracking codes as payment card data. The result is a finding set with a false-positive rate high enough that the security team stops reading it, and genuine exposures are buried in noise. Low-fidelity classification also degrades every downstream control that consumes it, most notably data loss prevention.
Knowing where the data is does not tell you who can reach it. A file’s sensitivity is only half of its risk. The other half is effective access — resolved through nested Active Directory and Entra ID groups, inherited folder permissions, broken inheritance, legacy global access groups such as Everyone and Authenticated Users, and external sharing links. A CUI document readable by the entire domain is a materially different problem from the same document readable by four cleared engineers, and a classification tool that does not resolve permissions cannot tell you which one you have.
The practical consequence is a compliance program that attests to controls over regulated data it cannot locate, and an incident response function that, on the worst day of its year, cannot answer the only question that matters: what was actually in there?
3. How Cyberwatch-WX Works
The platform operates in four stages that run continuously rather than as a periodic project.
| Discover | Classify | Correlate | Remediate |
| Agentless crawl of file shares, cloud storage, SaaS platforms, email archives, and databases — including the repositories that never made the asset register | Compound term processing and statistical content analysis tags PCI, PII, PHI, CUI, FCI, credentials, and intellectual property by what the content is | Nested groups, inherited and broken permissions, and external shares resolved into effective access, then layered with sensitivity | Quarantine, strip global access, correct inheritance, revoke external shares, redact, label, or defensibly dispose — every action logged |
| Incremental re-scan on every change — the inventory never goes stale | |||
Figure 1 — The Cyberwatch-WX data governance cycle: a continuous loop rather than a periodic project.
3.1 Discover
Scanning runs agentless. No software is installed on your file servers, and indexing and classification are performed and stored on a separate dedicated server, so production storage performance is not affected and no new agent is introduced onto systems that may themselves be in an audit scope. Coverage spans Windows and NAS file shares, SharePoint Online and on-premises, OneDrive, Teams, Exchange and email archives, cloud object storage, database platforms, and the SaaS and AI-connected repositories where content increasingly accumulates.
The first pass builds a complete index. Everything after that is incremental — only new and modified content is re-processed, which is what makes continuous operation economically practical at enterprise data volumes. Shadow data, meaning regulated content sitting in unexpected or unauthorized locations, is surfaced specifically because the crawl is not limited to the repositories already on your formal inventory.
3.2 Classify
Classification is where most data discovery programs quietly fail. Cyberwatch-WX does not rely on keyword lists and regular expressions alone. It applies compound term processing and statistical content analysis, evaluating terms in context rather than matching isolated strings — an approach that works across languages, vocabularies, and grammatical styles, and that distinguishes a genuine payment card number in a genuine payment context from a sixteen-digit part number in a bill of materials.
Predefined taxonomies cover payment card data (PCI DSS), personally identifiable information, protected health information, financial records, and other regulated categories. Custom taxonomies are built for the content types specific to your organization — contract language, engineering drawings, export-controlled technical data, proprietary formulations, or the distinctive markings that identify CUI and FCI in a defense supply chain.
Results are written back as durable classification metadata embedded in the file itself, and can apply Microsoft Information Protection sensitivity labels. This matters operationally: it raises the accuracy of every downstream control that consumes classification, including data loss prevention, information rights management, and retention policy. Confidence scoring on each classification hit allows rules to be tuned rather than accepted blindly, which is how the false-positive problem is actually solved.
3.3 Correlate Sensitivity With Effective Access
Classification answers what it is. Permission resolution answers who can reach it. Cyberwatch-WX resolves effective access across Active Directory, Entra ID, SharePoint, and cloud storage — walking nested group memberships, inherited permissions, broken inheritance, direct ACL grants, legacy global access groups, and external sharing links — then layers data sensitivity on top of the resolved result.
The output is the sentence your auditors, your underwriters, and your board actually want: this many files containing this regulated data type are reachable by this many identities, through these access paths, and here is how that number has moved since last quarter. The platform surfaces the high-impact conditions specifically — regulated content exposed to global access groups, sensitive folders with broken inheritance, externally shared files carrying PII, and toxic access combinations that arise from role changes and group nesting rather than from any single deliberate grant.
3.4 Remediate and Dispose
Reporting exposure is not reducing it. Remediation workflows act on findings: relocating sensitive files to controlled locations, removing permissions granted through global access groups, correcting broken inheritance, revoking external shares, redacting confidential content in place, and applying protective labels. Actions can run automatically under policy or be routed for approval, and every action is logged as evidence.
ROT analysis — redundant, obsolete, and trivial data — is the most underrated part of the program. A large share of the regulated content in a typical estate is duplicate or long past any business or legal retention requirement. Defensibly disposing of it is the only remediation that reduces risk to zero rather than merely managing it, and it simultaneously satisfies the disposal requirements that PCI DSS, the FTC Safeguards Rule, HIPAA, and NIST SP 800-171 all impose. It also recovers storage cost, which is the rare security outcome your CFO will fund without being asked twice.
3.5 Govern Continuously
Accountable data owners are identified and given visibility into who can access the content they own, with attestation and access-review workflows routed to them rather than to a central security team with no business context. Exposure is tracked over time against clear indicators — overexposed file counts, high-risk access paths, regulated content outside approved repositories — so that leadership can demonstrate risk reduction as a trend rather than assert it as a posture.
4. What Cyberwatch-WX Finds
| Data Type | What It Looks Like in the Wild | Why It Matters |
| Cardholder data (PCI) | Primary account numbers in call-centre notes, chargeback spreadsheets, emailed order forms, scanned faxes, and application debug logs | Any system storing PAN is in PCI DSS scope. Cardholder data found outside the defined CDE is the single most common cause of a scope expansion finding — and of a failed assessment nobody saw coming. |
| CUI and FCI | Drawings, statements of work, specifications and correspondence saved from email into departmental shares and personal OneDrive folders | CMMC scope is determined by where CUI is processed, stored, or transmitted. Undiscovered CUI outside the enclave silently expands your assessment boundary and invalidates the scoping decision your assessment rests on. |
| PII | Social Security numbers, dates of birth, driver’s licence and passport numbers in HR archives, benefits files, and legacy migration folders | Drives FTC Safeguards obligations, state breach-notification exposure, and consumer privacy rights. Breach notification cost is a direct function of record count — a count you cannot produce without an inventory. |
| PHI | Claims documentation, eligibility files, occupational health records, and case correspondence held well outside clinical systems | HIPAA risk analysis is legally required to be accurate and thorough. A risk analysis that omits ePHI repositories nobody knew existed is, by definition, neither. |
| Financial and banking records | Account and routing numbers, wire instructions, tax identification numbers, and payroll files | Prime targets for business email compromise and payment fraud. Exposure here converts directly into transferred funds rather than into a notification letter. |
| Credentials and secrets | Password spreadsheets, configuration files, connection strings, API keys and private keys stored on shares | These are lateral movement fuel. A single readable credentials file frequently turns a contained incident into a domain-wide compromise. |
| Intellectual property | Formulations, source code, pricing models, customer lists, and export-controlled technical data | Usually uninsured and unregulated, and often the asset whose loss would most damage enterprise value. Nothing external obliges you to protect it, which is precisely why it is rarely governed. |
| ROT data | Duplicates, superseded versions, and regulated content retained years past any business or legal requirement | Pure liability with no offsetting value. Defensible disposal is the only remediation that eliminates risk outright — and it returns storage cost to the business. |
Figure 2 — What Cyberwatch-WX finds: the sensitive data types discovered and classified across the unstructured estate.
5. Technical Appendix: Architecture, Accuracy, and Operations
Deployment model. Agentless collection, with indexing and classification performed on a dedicated server separate from the data sources. Initial deployment is measured in hours. Time to first complete classification depends on data volume, connection bandwidth, selected classification depth, and server sizing; incremental indexing thereafter is substantially faster and is what sustains continuous operation.
Classification engine. Content-based analysis using compound term processing and statistical modelling rather than string matching alone, applied against taxonomy rule sets. Predefined taxonomies ship for the major regulated categories; custom taxonomies are authored for organization-specific content. Each hit carries a confidence score, allowing thresholds to be tuned per taxonomy to balance recall against false-positive load. Classification results are embedded into file metadata and can be expressed as Microsoft Information Protection labels for downstream enforcement.
Permission resolution. Effective-access calculation across Active Directory, Entra ID, SharePoint, and cloud storage, including nested group expansion, inherited and broken-inheritance ACLs, global access group membership, and external sharing. Sensitivity is layered onto resolved permissions so that findings describe reachability rather than nominal role assignment.
Remediation actions. Move or quarantine to a controlled location; remove or replace ACL entries; strip global access group permissions; revoke external shares; redact content in place; apply protective labels; and execute retention-driven disposal. Actions run under policy automatically or through an approval workflow, with full action logging.
Reporting and evidence. Distribution of classified content by source, taxonomy, and term; classification hit summaries for rule validation; total files processed against sensitive file counts; exposure and access-path trending over time; and framework-aligned reporting suitable for direct submission as audit evidence.
Integration. Classification output feeds data loss prevention and information rights management controls, raising their accuracy materially. Access findings feed identity governance and access certification. Evidence artifacts flow into the Compliance-as-a-Service platform, where they are maintained continuously rather than reconstructed at audit time.
6. Compliance Mapping
Data discovery and classification is not a nice-to-have adjacent to compliance. In each of the frameworks below, it is the precondition on which the other controls depend.
| Framework | Requirement | How Cyberwatch-WX Supports It |
| CMMC L2 / NIST SP 800-171 | Scoping — identification of CUI assets, Security Protection Assets, and Contractor Risk Managed Assets prior to assessment | Scope is determined by where CUI actually resides, not where policy says it should. Discovery establishes the defensible boundary and surfaces the CUI outside the enclave that would otherwise expand the assessment mid-engagement. |
| CMMC L2 / NIST SP 800-171 | MP.L2-3.8.1 and MP.L2-3.8.2 — protect media containing CUI and limit access to authorized users; SC.L2-3.13.16 — protect confidentiality of CUI at rest | Locates CUI on media and in repositories, resolves who can reach it, and drives permission remediation and labelling so the protection and access-limitation controls apply to the full CUI population. |
| CMMC L2 / NIST SP 800-171 | MP.L2-3.8.3 — sanitize or destroy media containing CUI before disposal or reuse; AC.L2-3.1.3 — control the flow of CUI | ROT analysis identifies CUI eligible for destruction and produces dated disposal evidence. Continuous re-scanning detects CUI that has flowed outside approved locations. |
| CMMC L1 (FCI) | FAR 52.204-21 basic safeguarding — AC.L1-3.1.1 and AC.L1-3.1.2, limiting access to authorized users and permitted transactions | Identifies FCI across shared drives and collaboration platforms, then evidences that access is limited to authorized users — the control most Level 1 self-assessments assert without supporting data. |
| PCI DSS v4.0 / v4.0.1 | 12.5.2 — PCI DSS scope documented and validated at least once every 12 months and upon significant change (12.5.2.1: every six months for service providers) | Scope validation requires evidence that account data does not exist outside the defined CDE. Continuous discovery produces exactly that evidence, on the assessor’s required cadence, rather than a manual annual hunt. |
| PCI DSS v4.0 / v4.0.1 | 3.2.1 — account data storage minimized through retention and disposal policy, with data exceeding retention securely deleted; 3.3.1 — sensitive authentication data not retained after authorization | Finds retained account data and SAD across file shares, email, and logs, and drives defensible deletion with logged evidence for each disposal action. |
| PCI DSS v4.0 / v4.0.1 | 3.5.1 — PAN rendered unreadable wherever stored; 7.2 — access to system components and data appropriately defined and assigned by business need to know | Identifies unprotected PAN outside the CDE and resolves effective access to it, supporting both the protection requirement and the need-to-know access assignment it depends on. |
| FTC Safeguards Rule (16 CFR 314) | 314.4(c)(2) — identify and manage the data, personnel, devices, systems, and facilities that enable the achievement of business purposes, according to their relative importance | Produces the customer-information inventory this provision requires, maintained continuously and covering the unstructured repositories where non-public personal information actually accumulates. |
| FTC Safeguards Rule (16 CFR 314) | 314.4(c)(1) — implement and periodically review access controls, including periodically reassessing who has access to customer information | Effective-access resolution combined with owner-led attestation is the periodic reassessment, evidenced. Manual permission reviews of a file estate at scale are not realistically defensible. |
| FTC Safeguards Rule (16 CFR 314) | 314.4(c)(6) — securely dispose of customer information no later than two years after the last date it was used, unless retention is otherwise required, and periodically review retention practice | ROT and last-accessed analysis identify customer information past the two-year threshold and execute disposal with a retained audit trail — a requirement most programs acknowledge and very few evidence. |
| HIPAA Security Rule | 164.308(a)(1)(ii)(A) — accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI | A risk analysis cannot be accurate or thorough if the ePHI population is unknown. Discovery establishes the ePHI inventory the analysis is legally required to be built on. |
| HIPAA Security Rule | 164.312(a)(1) — technical policies and procedures allowing access only to those persons granted access rights; 164.310(d)(2)(i) — disposal of ePHI | Resolves effective access to ePHI repositories and drives least-privilege remediation, plus evidenced disposal of ePHI retained beyond requirement. |
| State privacy and breach notification | Consumer rights to know and to delete (CCPA/CPRA and equivalents); breach notification triggered by the categories of personal information involved | Fulfilling a deletion request requires knowing every location holding that consumer’s data. Determining notification obligations requires knowing what was in the compromised repository. Both are inventory problems, answered in hours rather than weeks. |
Figure 3 — Compliance mapping: Cyberwatch-WX capabilities against the requirement areas they most directly support.
6.1 Evidence Is Not the Same as Interpretation
A discovery platform produces findings. It does not decide which findings change your compliance position, which repositories belong inside an enclave boundary, which retained records are subject to a legal hold that overrides a disposal policy, or how a scope decision should be documented so that an assessor accepts it.
Cyberwatch-WX is therefore delivered as a managed service. Northern Data Solutions defines the taxonomies and tuning thresholds, interprets results against the frameworks you are actually assessed under, makes and documents the scoping determinations, coordinates disposal decisions with your General Counsel and records-retention obligations, and produces the evidence packages your QSA, C3PAO, auditor, or regulator will accept. The automation delivers coverage and cadence no manual exercise can match; our VCSO practitioners give that coverage standing.
7. Cyber Liability Insurance
Data inventory and classification questions now appear routinely on cyber liability applications and renewal questionnaires, usually framed around whether the applicant knows where sensitive data resides, whether access to it is reviewed, and whether data is disposed of on a defined retention schedule. The reason is actuarial: breach cost scales with record count and data category, so an insurer’s exposure is a direct function of a data estate the applicant frequently cannot describe.
Carrier requirements are not standardized and vary by limit, industry, and underwriter, so confirm specifics with your broker rather than assuming. What is durable is that an organization able to state its regulated data inventory with evidence negotiates from a materially stronger position than one estimating — and that a materially inaccurate application is a recognized basis for a denied claim. The same inventory also compresses the most expensive phase of an actual incident: establishing what was in the compromised repository, which determines notification obligations, regulatory exposure, and the ultimate size of the loss.
8. Implementation Through Cyberwatch Advanced
| # | Phase | What Happens |
| 1 | Repository inventory | We establish the authoritative list of repositories — file shares, SharePoint and OneDrive, Teams, email archives, cloud storage, databases, and SaaS platforms — including the ones that never made it onto the asset register. Most clients find repositories here they did not know were in use. |
| 2 | Taxonomy design | Predefined taxonomies for PCI, PII, PHI, and financial data are selected and tuned, and custom taxonomies are authored for your CUI and FCI markings, contract language, and proprietary content. Thresholds are set to control false-positive load before the first full scan. |
| 3 | Baseline discovery | The initial read-only index and classification pass runs against your highest-risk repositories first. The deliverable is your baseline data inventory and exposure position — typically the first time the organization has seen it. |
| 4 | Access correlation and triage | Permissions are resolved and sensitivity layered on top. Our practitioners triage the result into an ordered remediation plan by business impact: global access exposure first, external sharing second, ROT disposal third. |
| 5 | Remediation and disposal | Permission corrections, relocations, labelling, and defensible disposal execute under policy with approval workflows and full action logging, coordinated with records-retention and legal-hold requirements. |
| 6 | Continuous operation | Incremental scanning keeps the inventory current, owner-led attestation runs on cadence, exposure trending reports to leadership, and evidence is maintained continuously in the Compliance-as-a-Service platform rather than assembled at audit time. |
Figure 4 — Implementation roadmap: how a Cyberwatch-WX deployment proceeds from discovery through continuous governance.
9. Where Cyberwatch-WX Fits in Your Security Program
Cyberwatch-WX answers one question, and it answers it definitively: where does our regulated data actually live? That answer is a prerequisite for almost every other decision in a security and compliance program — what to put inside an enclave, which systems belong in an assessment boundary, which configuration changes are material, and which findings deserve remediation hours first. The table below shows how WX connects to the rest of the stack.
| Layer | Service | What It Answers | Commercial Position |
| Discover | Cyberwatch-WX | Where does our regulated data live, in what volume, and who can reach it? | Included |
| See | CyberGuard | What do we own, and what changed since we last approved it? Attack surface management and configuration change detection | Included |
| Identify | Cyberwatch | Which exposures can actually be exploited? Third-party penetration testing, exploit validation, and continuous vulnerability identification | Included |
| Protect | Cyberwatch Advanced (Proactive Advanced Security) | How do we close the gap and keep it closed? Identity and Access Management with adaptive MFA, Principle of Least Privilege, Zero Trust architecture, attack surface visibility, password management and rotation, and the cybersecurity training platform with employee attestation — plus the Cyberwatch Maturity Program at no additional cost | Included |
| Contain | CyberCloud / CyberVault | Where should regulated data live instead? Pre-hardened enclave and encrypted file exchange | Additional fee |
| Prove | Compliance-as-a-Service | Can we demonstrate the control operated continuously, not just today? | Included |
| Govern | VCSO | Who owns the classification policy, the risk acceptance, and the board conversation? | Included |
Figure 5 — Where Cyberwatch-WX sits in the Northern Data Solutions service stack, and which layers are included in the Proactive Advanced Security subscription.
The sequencing matters as much as the components. A discovery sweep run before an enclave migration turns that migration into a defined project with a known scope. The same sweep run before a CMMC or PCI assessment establishes the boundary argument the entire program rests on. And run continuously afterward, it is what prevents the boundary from quietly eroding as the business creates new data in new places, which it does every single day.
10. Recommended Next Steps for the Board
Direct your IT, security, compliance, and legal leadership to (1) state, in writing and with supporting evidence, where the organization’s regulated data currently resides — and treat the inability to do so as the finding it is; (2) commission a baseline Cyberwatch-WX discovery across the file shares, collaboration platforms, and email archives that have never been scanned, with particular attention to regulated data outside the systems of record; and (3) establish a standing retention and disposal practice, with defensible deletion of data past requirement reported as a measured quarterly outcome rather than an aspiration.
11. Conclusion
Every control you operate, every attestation you sign, and every insurance application you submit rests on an assumption about where your sensitive data is. For most organizations that assumption is unexamined, and the gap between it and reality is where breaches become catastrophic, audits become findings, and claims become disputes. An inventory that is complete, current, and evidenced is not administrative housekeeping — it is the foundation the rest of the security program stands on.
Cyberwatch-WX establishes that foundation and keeps it current. It is the data layer beneath the entire Cyberwatch stack: it tells Cyberwatch third-party penetration testing which systems are worth the attacker’s effort and turns a proven exploit path into a quantified business impact; it gives Cyberwatch Advanced — identity and access management with adaptive MFA, Principle of Least Privilege, Zero Trust Architecture, attack surface visibility, password management and rotation, and cybersecurity training with employee attestation — the sensitivity context those controls need to be applied where they matter instead of uniformly; it feeds Compliance-as-a-Service the continuously maintained inventory, access-review, and disposal evidence that CMMC, PCI DSS, the FTC Safeguards Rule, and HIPAA all assume you already hold; and it gives your VCSO the one number no other tool can produce — what is actually at stake. Ask your Northern Data Solutions account team to schedule your Cyberwatch-WX baseline discovery.