Does sensitive data discovery need to read the data itself?

Not always. Content scanning samples or reads values and matches them against patterns or models, which finds sensitive data in free text but exposes values to the scanner. Metadata classification looks only at catalog information such as column names and types, which never touches values but can miss data stored in badly named fields. Many programmes use both.

How often should discovery run?

Continuously or on a short schedule, because schemas and buckets change. New tables, columns and files appear with every release, and a classification done once at the start of an audit is out of date within weeks. Running discovery daily or on each schema change keeps the inventory, and the monitoring that depends on it, current.

Glossary

Sensitive data discovery

Also called data discovery and classification, sensitive data classification, PII discovery

Sensitive data discovery is the automated process of finding and classifying data that needs protection, such as personal, financial, health or secret information, across databases, file stores and cloud services, so it can be inventoried, monitored and secured.

Rudratic glossary

Organisations rarely know every place their sensitive data lives. Customer records get copied into reporting schemas, test databases and spreadsheets; new columns appear with each release. Sensitive data discovery scans these stores, labels what it finds, and keeps that map current, so that access controls, monitoring and audit can focus on the data that matters.

How it works

Discovery tools combine several techniques:

Technique	How it works	Trade-off
Pattern matching	Regular expressions and checksums for card numbers, IDs and similar	Precise for structured formats, blind to context
Machine learning or AI classification	Models judge whether content or metadata looks sensitive	Covers fuzzy cases, needs review
Exact data match	Compares against a list of known sensitive values	Very precise, needs the source list
Metadata classification	Reads column names, types and catalog information only	Never touches values, may miss misnamed fields

Cloud vendors document these methods. Amazon Macie discovers sensitive data in S3 using machine learning and pattern matching, with managed and custom data identifiers and sampling for automated discovery. Microsoft Purview classifies content with sensitive information types, exact data match, trainable classifiers and credential detection.

Why it matters

Controls depend on knowing where data is. NIST SP 800-122 gives context-based guidance for identifying PII and choosing a protection level for each instance. NIST SP 800-53 Rev. 5 control PM-5(1) requires an inventory of systems that process personally identifiable information, and RA-2 requires categorising systems by the information they hold. Discovery also feeds database activity monitoring: an alert on a mass read only works if the table has been flagged as sensitive.