What Is Data Discovery? Sensitive Data Discovery, PII Detection and Building a Data Inventory

Data Discovery is the data security process aimed at discovering where the data inside an organization is located, what kind of information it contains, by whom it is used and how sensitive it is. This approach, used in Turkish as veri keşfi or hassas veri keşfi, is one of the most fundamental building blocks of modern Data Security Architecture.

In order for an organization to be able to protect data it first needs to know where that data is located. However, today corporate data is not kept only in databases. File servers, employee laptops, e-mail systems, SharePoint, OneDrive, Google Drive, SaaS platforms, cloud storage, source code repositories, backup systems and collaboration tools can contain different copies of the same data.

For this reason one of the most fundamental questions in terms of data security is this:

"Which sensitive data do we have in our organization and where exactly is it located?"

If a clear answer cannot be given to this question the effectiveness of the other security layers such as Data Classification, DLP, DSPM, KVKK compliance, access control and data leakage prevention also remains limited.

What Is Data Discovery?

Data Discovery is the structured, semi-structured and unstructured data sources located in the organization's digital ecosystem being discovered and analyzed with automatic or manual methods.

The aim is not only to produce a list of storage locations. Data Discovery at the same time tries to understand the data content.

For example there can be millions of documents on a file server. The names of these files can be:

report.xlsx

list.docx

backup.zip

final_v2.xlsx

in this way.

By looking at the file names it may not be possible to understand whether they contain sensitive data. However, when content inspection is carried out inside them:

identity number,

phone number,

e-mail address,

customer information,

bank account information,

credit card data,

health information,

contract details

can be found.

For this reason Data Discovery analyzes not only the metadata but the content itself as well.

What Is Sensitive Data Discovery?

Sensitive data discovery, that is Sensitive Data Discovery, is the process aimed at automatically detecting the critical data types requiring protection inside the organization.

This approach is important especially in these data types:

Personally Identifiable Information – PII

Personal Data

Special Category Personal Data

Payment Card Data

Financial Data

Health Data

Source Code

Credentials

API Keys

Encryption Keys

Commercial Secrets

Intellectual Property

The aim of sensitive data discovery is to make visible where the organization carries risk.

A database being in the production environment does not automatically make it critical. Which data is located inside it must be known.

In the same way an Excel file that looks ordinary can be much more critical.

Why Is Data Discovery One of the First Steps of Data Security?

Security teams most of the time protect systems.

The firewall protects the network.

EDR protects the endpoint.

Database security protects the database.

However, data moves between all these systems.

For this reason the modern Data Security approach must not be infrastructure-centric but data-centric.

Thanks to Data Discovery the organization:

which data it has,

where it is located,

who accesses it,

which copies of it have been created,

which data is unnecessary

can see these.

Without this visibility security policies can be built on assumptions.

What Is Structured Data?

Structured Data is data kept inside a certain schema or tabular format.

For example:

relational databases,

ERP records,

CRM records,

HR systems,

transaction tables

are examples of structured data.

This data can generally be analyzed on a column and field basis.

For example inside a customer table:

Name

Identity Number

Phone

Email

Credit Card

columns such as these can be present.

Data Discovery tools can carry out sensitive data classification over column names and values.

What Is Unstructured Data?

Unstructured Data is document and file content that does not have a fixed schema.

For example:

Word documents,

PDF files,

PowerPoint presentations,

text files,

images,

e-mails

can be evaluated within the scope of unstructured data.

An important part of corporate sensitive information can be located inside unstructured data.

For this reason carrying out only database scanning is not sufficient.

File systems and collaboration platforms must also be taken into the discovery scope.

What Is Semi-Structured Data?

Semi-Structured Data is not completely tabular but contains a certain field structure.

For example:

JSON,

XML,

log files,

API responses

can enter this category.

Modern applications produce a large amount of semi-structured data.

For this reason Data Discovery tools must be able to analyze these formats too.

What Is PII?

PII, that is Personally Identifiable Information, expresses the information types that can identify a person directly or indirectly.

For example:

full name,

e-mail address,

phone number,

identity number,

address,

passport information,

customer number

can be evaluated within the scope of PII.

Modern Data Discovery solutions can help with the creation of a data inventory by detecting PII patterns.

How Is PII Detection Carried Out?

PII Detection can be carried out with different methods.

Pattern matching is one of the most fundamental methods.

For example certain number formats:

identity number,

credit card number,

phone number

can be detected as these.

However, pattern matching alone may not be sufficient.

Because not every 11-digit number is an identity number.

For this reason modern PII Detection:

Regex

Validation Algorithms

Context Analysis

Keyword Analysis

Exact Data Match

Machine Learning

can use a combination of these.

These methods help to reduce the false positive rate.

How Is Exact Data Match Used in Data Discovery?

Exact Data Match uses the values inside the real authoritative dataset as a reference.

For example the employee identity numbers in the HR system can be fingerprinted in a secure way.

The discovery engine can create a finding only when data belonging to real employees is found.

This can be more accurate than generic pattern detection.

Exact Data Match is important especially for large enterprises.

Keyword-Based Discovery

Certain keywords can be used to detect sensitive content.

For example:

"salary"

"confidential"

"customer list"

"medical record"

"password"

terms such as these can be a signal for sensitive documents.

However, a keyword alone does not provide definite classification.

For this reason it must be used together with context.

Data Discovery with AI and Machine Learning

Modern Data Discovery tools do not only search for exact patterns.

Using machine learning and AI they can analyze the document context.

For example even if a document does not clearly say "Confidential" its content can be:

a merger plan,

a pricing strategy,

a legal investigation,

a financial forecast

these.

AI semantic analysis can estimate that this document is sensitive.

This is a powerful capability especially for unstructured data discovery.

LLM-Based Data Discovery

Large Language Models can interpret the meaning of documents written in natural language.

Thanks to this the confidential content types that are difficult to find with traditional regex can be determined.

For example the LLM:

"This document contains an employee performance evaluation."

or:

"This document is related to an acquisition strategy."

can provide semantic classification such as this.

However, sending confidential content to an external LLM service can create a new data leakage risk.

For this reason the AI-assisted Data Discovery architecture must be designed carefully in terms of security and privacy.

The Difference Between Data Discovery and Data Classification

Data Discovery:

"Where is the data and what does it contain?"

answers this question.

Data Classification:

"How sensitive is this data?"

answers this question.

For example the discovery engine finds 50,000 customer records inside an Excel file.

The classification engine marks this file as Restricted.

For this reason the two technologies complement each other.

The healthiest process is:

Discover → Identify → Classify → Protect

in this way.

What Is a Data Inventory?

A Data Inventory is the systematic list of the data assets inside the organization.

A Data Inventory is not only a list of file names.

For every data asset this information can be kept:

Data Type

Data Location

Owner

Classification

Sensitivity

Access Rights

Retention

Business Purpose

Legal Basis

Data Source

Data Destination

This information forms the foundation for data governance and data security.

Why Is a Corporate Data Inventory Important?

An organization can use many different databases and file repositories.

However, which system keeps which data may not be known without documentation.

A Data Inventory increases this visibility.

For example a customer information dataset:

CRM

ERP

Data Warehouse

Backup

Excel Report

SharePoint

can be located in different locations such as these.

A Data Inventory helps to relate these copies.

What Is Data Mapping?

Data Mapping shows how the data moves between systems.

For example:

Website Form

↓

CRM

↓

ERP

↓

Data Warehouse

↓

Reporting Platform

this can be a data flow.

Thanks to Data Mapping the organization can understand not only where the data is but where it comes from and where it goes.

This is important especially in terms of privacy and compliance.

Why Is Data Flow Mapping Critical?

While sensitive data moves between systems new copies can be created.

For example customer data can be exported from the CRM and taken into Excel.

Afterwards it can be sent to a third party by e-mail.

In this case the original CRM security controls are no longer sufficient.

Data Flow Mapping increases the visibility of this movement.

What Is Data Lineage?

Data Lineage is the approach of tracking the transformation and movement the data has gone through from its origin to its current form.

For example:

Raw Customer Data

↓

Cleansed Data

↓

Analytics Dataset

↓

Executive Report

Data Lineage helps to understand how the data has transformed.

This is valuable in terms of Data Governance, Data Quality and Data Security.

What Is a Data Catalog?

A Data Catalog enables the organization to create a searchable metadata repository about its data assets.

Users or analysts:

which datasets are available,

who the owner is,

which classification,

which business meaning

can see information such as this.

Although a Data Catalog is used more in data governance and analytics use cases it also provides important context for Data Security.

The Difference Between a Data Inventory and a Data Catalog

A Data Inventory focuses more on the question "which data assets are present?".

A Data Catalog, on the other hand, provides richer metadata and business context about this data.

For example:

Inventory:

Customer_Transactions_DB

Catalog:

Owner = Finance

Purpose = Payment Reporting

Classification = Confidential

Source = ERP

Retention = 7 Years

can be more detailed in this way.

Where Must Data Discovery Be Carried Out?

A modern Data Discovery programme must cover not only the databases but the whole data landscape.

Within this scope:

Databases

File Servers

Endpoints

SharePoint

OneDrive

Google Drive

S3 Buckets

Azure Blob Storage

Cloud Databases

SaaS Platforms

E-mail Systems

Source Code Repositories

Backup Systems

Data Lakes

Data Warehouses

can be scanned.

This wide scope is necessary for modern Data Security.

How Is Database Discovery Carried Out?

During database discovery first the database instances in the environment are determined.

Then the schemas and tables are analyzed.

Sensitive columns are detected.

For example:

Customer

Employee

Payment

Health

tables can be high-risk.

The discovery engine can determine column-level sensitivity.

This classification can be used for masking and DAM policies.

File Server Data Discovery

File servers generally contain a large amount of unstructured data accumulated over years.

Especially on shared folders:

old reports,

employee exports,

customer lists,

contracts,

password files

can be present.

A Data Discovery scan can create sensitive findings by analyzing these files content-based.

Endpoint Data Discovery

Sensitive data can also be located on employee laptops.

For example a user can save the customer file they exported from the database to the Desktop.

This copy can remain outside centralized security controls.

Endpoint Data Discovery can help to detect these local copies.

This is important especially in order to reduce insider threat and data leakage risks.

Cloud Data Discovery

Cloud adoption has made data discovery even more complex.

Sensitive data:

AWS S3,

Azure Blob Storage,

Google Cloud Storage,

Cloud Databases

can be located on these.

Wrong configurations or broad IAM permissions can create data exposure.

Cloud Data Discovery makes the content and the location of the data visible.

SaaS Data Discovery

Modern organizations use a large number of SaaS applications.

CRM,

HR,

ticketing,

collaboration,

productivity platforms

can host sensitive data.

For this reason SaaS data must also be taken into the inventory scope.

CASB, API integrations and DSPM solutions can provide this visibility.

SharePoint and OneDrive Data Discovery

Inside Microsoft 365 environments sensitive data can largely be located on SharePoint and OneDrive.

Employees can easily create and share files.

For this reason:

sensitivity labels,

DLP,

data discovery,

access review

must be used together.

Especially external sharing and anonymous links can create critical risk.

Google Drive Data Discovery

For organizations using Google Workspace Google Drive can create the same data sprawl problems.

Sensitive files:

shared drives,

personal user drives,

external shared folders

can be located inside these.

Data Discovery can help to identify this content.

Backup Data Discovery

Backup systems are most of the time ignored in Data Security programmes.

However, inside the backup full copies of the production data can be located.

For this reason sensitive data must also be protected in the backup environment.

Inside the backup inventory:

classification,

retention,

encryption,

access

information must be present.

Source Code Repository Data Discovery

Git repositories can contain not only source code but secrets too.

Developers by mistake:

API Keys

Database Passwords

Cloud Credentials

Private Keys

can commit these.

Secret Scanning is one of the important use cases of Data Discovery on the DevSecOps side.

The repository history must also be scanned.

Because even if a secret is deleted it can remain inside the Git history.

Data Lake and Data Warehouse Discovery

Modern analytics environments contain a large amount of sensitive data.

Data Lakes can keep raw datasets.

Data Warehouses, on the other hand, can combine customer, financial and operational data.

This concentration creates high impact.

For this reason discovery and classification must be critical for these environments.

What Is Shadow Data?

Shadow Data is the data copies that remain outside the organization's official governance and security processes.

For example:

a database export,

a temporary Excel file,

a personal cloud copy,

an old backup,

an unmanaged SharePoint folder

can be Shadow Data.

This is dangerous in terms of data security because the Data Owner and the Security Team may not be aware of its existence.

How Is Shadow Data Created?

Shadow Data is mostly created during normal business operations.

For example an employee:

downloads the customer list from the CRM.

Saves it into Excel.

Moves the file to a shared folder.

Then the old version remains.

A month later another copy is created.

At the end of this process the same sensitive dataset spreads to many locations.

This creates Data Sprawl.

Why Is Shadow Data Risky?

The original production system can have strong security controls.

However, for the duplicate Excel file the same controls may not be present.

For example:

The database is encrypted.

Access is limited.

Audit is enabled.

But the Excel file:

unencrypted,

in an everyone-readable shared folder,

external sharing enabled

can be in this way.

For the attacker reaching the weak copy is easier.

For this reason Data Security must protect not only the original data source but the copies too.

What Is Dark Data?

Dark Data is old or unused data that is stored by the organization but whose business use or value is not clear.

For example:

10-year-old exports,

obsolete reports,

old customer files,

unused databases

can be Dark Data.

Even if this data is not used it creates exposure in the case of a breach.

For this reason Data Minimization is important.

The Difference Between Dark Data and Shadow Data

Shadow Data is the data copies located outside governance visibility.

Dark Data, on the other hand, is data that even if its existence is known has no active business value or is not used.

A piece of data can be both Shadow and Dark at the same time.

For example a customer Excel file created by an employee 5 years ago and forgotten can enter both categories.

What Is Stale Data?

Stale Data is data that has not been used or updated for a long time.

This data must be reevaluated in terms of business need.

If there is no retention requirement deletion can be considered.

Stale sensitive data can increase the attack surface unnecessarily.

Why Is Duplicate Data a Security Problem?

If there are a large number of copies of the same sensitive dataset the security perimeter widens.

Every copy requires separate access control.

For example if instead of 1 customer database there are 30 Excel exports 31 separate exposure points are created.

For this reason Data Discovery can help to find duplicate sensitive data.

What Is Data Minimization?

Data Minimization is the principle of the organization collecting only the data it really needs and keeping it as long as necessary.

Unnecessary data creates both storage cost and security risk.

The less data the attacker can steal the more the potential impact decreases.

For this reason Data Discovery can be used not only for protection but for deletion decisions too.

The Relationship Between Data Discovery and DSPM

DSPM, that is Data Security Posture Management, analyzes where sensitive data is located and which security risks it is under.

Data Discovery is one of the fundamental capabilities of DSPM.

For example DSPM can create this finding:

Sensitive Customer Data

Publicly Accessible Storage

No Encryption

Unknown Owner

=

Critical Risk.

This provides data-centric prioritization.

The Relationship Between Data Discovery and DLP

DLP controls data movement.

However, it is necessary to know which data is sensitive.

Thanks to discovery the sensitive data types can be determined.

DLP policies are created accordingly.

For example:

Customer PII → External Email = Block.

For this reason Discovery provides an important foundation before the DLP implementation.

Data Discovery and DAM

Database Activity Monitoring monitors which data on the database is accessed and how.

Discovery, on the other hand, determines which tables or columns are sensitive.

This context increases DAM alert prioritization.

For example:

User accessed table

this alert can be low value on its own.

However:

User exported 1 million records from Restricted Customer Table

is much more critical.

Data Discovery with IAM and IGA

Data Security is not only the data location.

Who accesses it is important too.

When the discovery findings are combined with identity data:

Who has access?

Why do they have access?

Is this access still required?

these questions can be answered.

IGA access reviews play an important role here.

How Is Excessive Data Access Discovered?

Data Discovery determines the sensitivity of the data.

IAM/IGA, on the other hand, shows the access relationships.

When this information is combined excessive access can be detected.

For example:

Restricted HR Dataset

1,500 Users Have Access

can create risk.

This is a strong signal for starting an access review.

Data Ownership Discovery

For some data repositories the owner may not be known.

This is common especially on old file servers and shared folders.

An Unknown Owner makes security remediation difficult.

Modern Data Discovery and DSPM programs can try to carry out owner inference.

For example:

folder usage,

creator,

department,

access patterns

the owner can be estimated over these.

Data Discovery and KVKK

Within the scope of KVKK it is important to know in which systems personal data is processed.

For this reason Data Discovery can support the personal data inventory and data mapping processes from a technical point of view.

For example discovery:

in which database there are identity numbers,

on which file server employee health data is located,

on which SaaS platform customer contacts are kept

can provide findings such as these.

This information is valuable for privacy governance.

What Is a Personal Data Inventory?

A personal data inventory is the structured record approach containing information such as the personal data categories the organization processes, the processing purposes, the legal basis, the storage locations, the recipients and the retention periods.

Technical Data Discovery can increase the accuracy of this inventory.

Because an inventory made only with business interviews may not find all the copies in the real environment.

Why Must Technical Discovery and the Legal Inventory Be Used Together?

Business units:

"This data is kept only in the CRM."

can say this.

The technical scan, on the other hand, the same data:

shared folder,

Excel,

backup,

cloud storage

can show that it is located inside these.

For this reason the documentation must be compared with the actual technical environment.

This gap analysis is valuable in terms of Data Privacy and Data Security.

Data Discovery and PCI DSS

For environments where payment card data is located cardholder data discovery is important.

Unknown credit card copies can enlarge the compliance scope.

For example an employee may have added card data inside a support ticket.

Discovery tools can detect these unexpected locations.

This can also be used for scope reduction.

Data Discovery and Ransomware

Ransomware actors carry out data discovery too.

After the attacker enters the environment they search for high-value data repositories.

For this reason the defender needs to know the critical data before the attacker.

Sensitive repositories must be kept under high monitoring and access control.

This is the Defender Data Discovery approach.

Data Exfiltration Risk Scoring

When data sensitivity is determined with discovery exfiltration alerts can be prioritized more accurately.

For example:

10 GB Public Data Download

and:

500 MB Restricted Customer Data Download

are not at the same risk level.

For this reason:

Data Sensitivity

Volume

Identity Risk

Destination

can be evaluated together.

Data Discovery and Insider Threat

Insider threat programmes need the sensitive data location context.

Which data did the employee access?

Did they download more than normal?

Did they copy it to a USB drive?

Did they upload it to a personal cloud?

These questions gain meaning only with sensitive data visibility.

Data Discovery strengthens insider risk analytics.

Why Has Cloud Data Discovery Become Critical?

Cloud environments have made data creation and replication easier.

A developer can create a new bucket within a few minutes.

An analyst can produce a new dataset copy.

An AI team can create a new vector database.

This velocity makes traditional inventory processes difficult.

For this reason discovery must be continuous.

What Is Continuous Data Discovery?

Continuous Data Discovery expresses monitoring the environment continuously or at regular intervals instead of scanning it only once a year.

A new:

database,

bucket,

file share,

SaaS repository

when it is created it can be taken into the discovery scope automatically.

This is a more accurate approach for modern cloud environments.

Why Is Point-in-Time Discovery Insufficient?

An environment that is safe today can change tomorrow.

A user can create a new sensitive export.

A developer can open a new cloud bucket.

An AI Agent can generate a new dataset.

For this reason an annual inventory can quickly become outdated.

Continuous Discovery is necessary for a dynamic data estate.

AI Systems Are Creating New Data Sources

Generative AI and RAG systems have brought out new data stores.

For example:

Vector Databases

Prompt Logs

Embedding Stores

Agent Memory

Conversation Histories

can be new sensitive data repositories.

A traditional data inventory can overlook these.

For this reason modern Data Discovery must also cover the AI architecture.

Vector Database Data Security

RAG systems can keep the embeddings of documents inside a vector database.

These repositories can be related to sensitive information.

If vector database access is wide an unauthorized retrieval risk can arise.

For this reason vector stores must be taken into the Data Discovery and Data Classification scope.

Can Prompt Logs Contain Sensitive Data?

Yes.

Users into AI systems:

customer data,

source code,

employee information,

financial data

can enter these.

These prompts can be stored inside logs.

For this reason prompt logs must be evaluated as sensitive data repositories.

Retention and access policies must be applied.

What Is Agent Memory?

AI Agents can use long-term memory.

The agent can store past tasks or user data.

This memory can contain sensitive information.

For this reason Agent Memory is becoming a new Data Governance and Data Discovery area.

RAG Corpus Discovery

While the RAG corpus is being created it must be known which documents have been included in the AI system.

For example:

Internal Documents

HR Documents

Board Reports

Customer Contracts

can be located inside the same corpus.

In this case the retrieval authorization complexity increases.

Data Discovery must make the sensitivity inside the RAG corpus visible.

Data Discovery with AI Governance

AI Governance is not only managing the model risk.

On which data the AI works must be known too.

For this reason the AI inventory must be related to the data inventory.

For example:

AI Application A

uses:

Customer Dataset B

and:

HR Dataset C

a mapping such as this can be made.

This is the foundation of AI Data Governance.

What Should Be Looked At in Data Discovery Tool Selection?

During tool selection not only the file scanning capability must be evaluated.

The platform can have these capabilities:

Structured Data Discovery

Unstructured Data Discovery

Cloud Discovery

SaaS Discovery

PII Detection

Exact Data Match

Data Classification

Data Lineage

Access Analysis

DSPM Integration

DLP Integration

API Integration

AI/ML Detection

These capabilities must be evaluated according to the organization's architecture.

How Is a Data Discovery Project Started?

A Data Discovery programme does not have to start by scanning the whole environment at the same time.

A risk-based approach can be more applicable.

First the crown jewel systems are determined.

For example:

Customer Database

HR Systems

Finance Systems

File Servers

Cloud Storage

can be prioritized.

Then the coverage is widened.

This phased rollout reduces operational complexity.

How Is the Discovery Scope Determined?

While the first scope is being created these questions can be asked:

Which are the critical systems?

Where can personal data be?

Which are the cloud repositories?

Which are the sensitive file shares?

Which are the high-risk business units?

These questions determine the initial scan priorities.

How Are False Positives Managed?

Data Discovery tools can produce too many false positives.

For example normal random numbers can be marked as an identity number.

For this reason validation rules are necessary.

In order to reduce false positives:

Context

Validation Algorithm

Exact Match

Thresholds

can be used.

Otherwise the Security Team can experience alert fatigue.

Is a False Negative More Dangerous?

A False Negative is sensitive data not being detected.

This risk can be more serious because the data remains invisible.

For this reason the accuracy of the discovery engine must be balanced.

The aim is not zero false positives but providing high-confidence visibility.

Scan Permissions Must Be Secure

The discovery tool can use credentials to access the data repositories.

These credentials can carry high privilege.

For this reason scanner accounts:

Least Privilege

Read-Only

Credential Vaulting

Monitoring

must be protected with these.

The Data Security tool itself must not create a new attack surface.

Data Discovery Performance Risk

Large databases or file servers can experience a performance impact during scanning.

For this reason:

scan schedule,

throttling,

incremental scanning

strategies such as these can be used.

Testing must be carried out for production systems.

What Is Incremental Scanning?

After the initial full scan only the changed or new data being scanned can be thought of as incremental scanning.

This can reduce the performance cost.

It is an important method for continuous discovery.

How Must Data Discovery Findings Be Prioritized?

Every sensitive data finding is not the same priority.

For example:

Restricted Data + Public Access

can be critical.

Restricted Data + Strong Controls

can be lower risk.

For this reason the risk score can use these factors:

Sensitivity

Exposure

Access Count

Encryption

Owner

Location

Age

Activity

This is compatible with the DSPM approach.

What Must Be Done After Data Discovery?

Discovery must not be carried out only to produce findings.

For every finding an action is required.

For example:

Classify

Encrypt

Restrict Access

Delete

Move

Mask

Apply DLP

Assign Owner

remediation such as this can be carried out.

Otherwise the organization has only enlarged the risk list.

Data Discovery Remediation Workflow

Example workflow:

Discover Sensitive Data

↓

Validate Finding

↓

Determine Owner

↓

Assign Classification

↓

Analyze Access

↓

Apply Protection

↓

Monitor

↓

Review

This workflow makes the Data Security programme operational.

Data Discovery KPIs

The success of the programme must be measured.

Example KPIs:

Total Data Repositories Discovered

Sensitive Data Assets Found

PII Records Detected

Unclassified Sensitive Data Count

Unknown Owner Count

Shadow Data Findings

Dark Data Volume

Stale Data Volume

Publicly Exposed Sensitive Data

Unencrypted Sensitive Data

Duplicate Sensitive Data Count

Discovery Coverage

Mean Time to Remediate Data Risk

metrics such as these can be these.

How Often Must the Data Inventory Be Updated?

For dynamic environments an annual update may not be sufficient.

If cloud and SaaS adoption is fast the inventory can be updated continuously or near-real-time.

At the very least critical data repositories must be under regular scanning.

This enables the Data Inventory to be a living asset.

The Most Frequently Made Mistakes in Data Discovery

The first common mistake is seeing discovery only as database scanning. Sensitive data is most of the time located inside file servers, endpoints and SaaS systems.

The second mistake is searching only for personal data. Source code, credentials, trade secrets and financial data can be sensitive too.

The third mistake is carrying out one-time discovery. Because the data estate changes continuously the findings quickly become outdated.

The fourth mistake is not assigning an owner to the found data. If there is no ownership the remediation responsibility remains uncertain.

The fifth mistake is not integrating the discovery results with DLP, IGA or DSPM.

The sixth mistake is leaving AI data stores and vector databases out of scope.

The seventh mistake is evaluating every finding at the same risk level.

Data Discovery Checklist

• Is a corporate Data Discovery programme present?
• Is structured data being scanned?
• Is unstructured data being scanned?
• Is semi-structured data in scope?
• Are databases being discovered?
• Are file servers being scanned?
• Are endpoints being evaluated?
• Are SharePoint and OneDrive in scope?
• Is Google Drive in scope?
• Is cloud object storage being scanned?
• Are SaaS applications in scope?
• Are backup repositories being evaluated?
• Are source code repositories under secret scanning?
• Are data lakes and warehouses being scanned?
• Is PII Detection present?
• Is Exact Data Match being used?
• Are Sensitive Data Types defined?
• Are Data Owners being assigned?
• Is the Data Inventory up to date?
• Is Data Mapping being carried out?
• Is Data Lineage known?
• Is Shadow Data being detected?
• Is Dark Data being monitored?
• Is Stale Data being detected?
• Is Duplicate Sensitive Data being determined?
• Is public exposure being checked?
• Is encryption status being analyzed?
• Are access relationships being evaluated?
• Are the discovery findings integrated with classification?
• Is DLP integration present?
• Is DSPM integration present?
• Are high-risk findings being transferred to the SIEM/SOC?
• Are vector databases in the inventory?
• Are prompt logs being checked?
• Is agent memory data included in the scope?
• Is the RAG corpus in the inventory?
• Is Continuous Discovery being applied?
• Are Data Discovery KPIs being monitored?

Data Discovery Maturity Model

Level 1 – Unknown Data Environment: The organization does not know exactly where the data is. The inventory is manual and incomplete.

Level 2 – Basic Data Inventory: Critical systems and data repositories are defined manually. PII discovery is applied in a limited way.

Level 3 – Automatic Sensitive Data Discovery: Databases, file servers, cloud and SaaS environments are scanned automatically. Integration with Data Classification and ownership processes is achieved.

Level 4 – Continuous Data Discovery and DSPM: Shadow Data, Dark Data, excessive access and public exposure are analyzed continuously. Risk-based remediation is applied.

Level 5 – Adaptive Data Intelligence: Data Discovery works together with Identity, DLP, DSPM, AI Governance and behavioral analytics. Data location, sensitivity, access and risk are evaluated continuously.

This transformation:

Unknown Data

↓

Inventoried Data

↓

Discovered Sensitive Data

↓

Risk-Aware Data

↓

Adaptive Data Intelligence

proceeds in this way.

Frequently Asked Questions

What is Data Discovery?

Data Discovery is the process of discovering where the data inside an organization is located, which content it hosts and how sensitive it is.

What is sensitive data discovery?

Sensitive Data Discovery is personal data, financial data, credentials, source code and other critical information being detected inside data repositories.

What is PII Detection?

PII Detection is information that can identify a person directly or indirectly being found with automatic methods.

What is a Data Inventory?

A Data Inventory is the systematic record of the data assets, locations, owners, classifications and access information the organization has.

What is Data Mapping?

Data Mapping is the process that shows which system the data comes from, where it is processed and to which systems it is transferred.

What is Data Lineage?

Data Lineage is the movement and transformation history the data has gone through from the source to the current state.

What is a Data Catalog?

A Data Catalog is the repository that provides searchable metadata and business context about data assets.

What is Shadow Data?

It is the uncontrolled data copies over which the security and governance teams do not have full visibility.

What is Dark Data?

It is data that has been collected but whose active business use or value is limited.

What is Stale Data?

It is data that has not been used or updated for a long time.

What is Structured Data?

It is database or application data that has a schema and a tabular structure.

What is Unstructured Data?

It is data that does not have a fixed schema such as Word, PDF, e-mail and images.

What is the difference between Data Discovery and DLP?

Discovery finds where the data is. DLP tries to control how the data moves.

What is the relationship between Data Discovery and DSPM?

DSPM analyzes data security risks by combining Data Discovery findings with sensitivity, exposure and access context.

Is Data Discovery necessary for KVKK?

Technical Data Discovery can support the personal data inventory and security processes by providing visibility about personal data locations and copies within the scope of KVKK.

What is Cloud Data Discovery?

It is sensitive data repositories being discovered inside AWS, Azure, Google Cloud and SaaS environments.

What is AI Data Discovery?

It is new data repositories such as the datasets, vector databases, prompt logs, RAG corpus and agent memory the AI systems use being discovered and classified.

Conclusion: You Cannot Protect the Data You Do Not See

One of the most fundamental problems of modern Data Security is organizations not being able to provide visibility over all the data they have.

An organization can protect its production database very strongly.

However, the Excel copy taken from the same database:

on an employee laptop,

in a shared folder,

in cloud storage

can be located in an uncontrolled way.

In this case for the attacker finding the weakest copy can be easier than attacking the strongest system.

For this reason modern Data Security must follow not only the systems but the data itself.

Corporate Data Discovery must be able to answer these questions continuously:

Which data do we have?

Where is it located?

How sensitive is it?

Who can access it?

How many copies are there?

Who is the owner?

For how long has it been unused?

Is there public exposure?

Are AI systems using this data?

When these questions are answered the other security controls such as Data Classification, DLP, DSPM, DAM, Encryption and Access Governance can be applied much more accurately.

For this reason the starting point of the modern data security chain:

Discover

must be this.

Afterwards:

Classify

Protect

Govern

Monitor

Respond

come.

And the most important sentence of this chapter:

Data Discovery is the fundamental discovery layer of modern Data Security that makes visible not only the organization learning where the data is located; but which sensitive data is in which system, in the access of which users, in which copies and under which security risk.