Article
Sensitive Data Discovery: Find PII, PHI, and PCI Data Automatically
Gartner published its first-ever Market Guide for Data Security Posture Management in September 2025, and the framing was blunt: DSPM exists because organizations have lost track of where their sensitive data actually lives, and that visibility gap is now the primary driver of data risk in the AI era (Gartner Market Guide for DSPM, via Forcepoint). Varonis's 2025 State of Data Security Report, based on an analysis of nearly 10 billion files across 1,000 real-world IT environments, found that 99% of organizations have sensitive data exposed in ways AI can easily surface, and only 1 in 10 companies had actually labeled their files (Varonis, 2025 State of Data Security Report). If you don't know where sensitive data sits, you can't protect it — and most organizations, by their own numbers, don't know.
Why manual data mapping breaks down at scale
Spreadsheet-based data inventories and one-time mapping exercises made sense when most sensitive data lived in a handful of known databases. That world is gone. Unstructured content — free-text documents, chat logs, emails, SaaS files — now makes up more than 80% of enterprise data assets, and none of it holds still long enough for a static map to stay accurate (IJETRM, "AI-Native DLP: Replacing Regex-Based Content Inspection").
Manual mapping also assumes someone remembers to update it. In practice, new cloud buckets, SaaS connections, and database copies get spun up constantly, and each one is a candidate for the same blind spot. Varonis's research found that 98% of organizations have unverified or unsanctioned applications — including shadow AI tools — connected to their environments, and 66% have cloud data exposed to anonymous users (Varonis, 2025 State of Data Security Report). A quarterly spreadsheet review can't keep pace with that rate of change; by the time it's updated, it's already stale.
This is precisely the gap Gartner says DSPM tools are built to close: automated, continuous discovery and classification across structured and unstructured data stores, replacing the manual inventory process entirely (Gartner Market Guide for DSPM, via GuardSense).
Shadow data is now a measurable cost driver, not a theoretical risk
"Shadow data" — sensitive information sitting in unmanaged, unmonitored, or forgotten data stores — has moved from a hypothetical concern to one of the most expensive categories IBM tracks. In IBM's 2024 Cost of a Data Breach Report, shadow data was involved in 35% of breaches and pushed average breach costs to $5.27 million, roughly 16% higher than breaches without it, while also taking 26% longer to identify and 20% longer to contain (IBM, "Hidden risk of shadow data and shadow AI leads to higher breach costs").
The 2025 edition of the report sharpened the picture further by isolating shadow AI as its own category: 20% of organizations suffered a breach tied to unsanctioned AI tool use, and those with high levels of shadow AI paid $670,000 more per breach than organizations with low or no shadow AI exposure — $4.74 million versus $4.07 million (IBM Cost of a Data Breach Report 2025). Shadow AI breaches also exposed customer PII at a higher rate (65%, versus 53% across all breaches) and took longer to detect — a pattern IBM attributes directly to data being scattered across environments nobody was actively monitoring (IBM, 2025 Cost of a Data Breach Report). The common thread across both editions of the report: data you can't see is data that costs more when it's eventually found by an attacker instead of by you.
Why regex-only tools miss most of what matters
Legacy discovery tools built on regular expressions and keyword lists work reasonably well on rigidly formatted fields — a 16-digit number that passes a Luhn check is easy to flag as a card number. But regex-based classification degrades badly on anything less structured. Research comparing legacy pattern-matching tools to AI-native classification found that regex-only systems achieve just 5–25% accuracy on unstructured content, with false positive rates exceeding 40% on complex data types (IJETRM, "AI-Native DLP: Replacing Regex-Based Content Inspection").
The gap widens on exactly the data types that carry the most regulatory weight. The same research measured regex detection accuracy at 38% for free-text medical records, 25% for context-dependent legal PII, and just 8% for paraphrased confidential data — figures that jump to 91%, 88%, and 82% respectively with LLM-driven semantic classification. Multilingual data fares even worse under regex: Asian-language PII detection sits at 10–20% accuracy for pattern-matching tools versus 80–88% for AI-based classifiers, and RTL scripts like Arabic and Hebrew are detected at under 10% by regex compared to 75–85% with semantic models (IJETRM, "AI-Native DLP: Replacing Regex-Based Content Inspection").
The practical consequence isn't just missed data — it's alert fatigue. The same analysis found that AI-driven classification cut false positive rates from the 37–42% range down to 3.5–5% over twelve months of production use, translating into roughly an 80% reduction in the manual triage burden on security teams. A tool that flags PII correctly but buries it under thousands of false alerts doesn't actually reduce risk; it just moves the bottleneck.
Coverage has to span structured and unstructured data — not one or the other
Gartner's Market Guide is explicit that DSPM's mandatory capabilities include automated discovery across both structured and unstructured data stores, plus accurate AI-driven classification and continuous monitoring of access and movement — not a one-time scan of a database schema (Gartner Market Guide for DSPM, via GuardSense). That's a deliberate framing: a discovery tool that only covers relational databases will miss the 80%-plus of enterprise data that lives in documents, chat, and SaaS files, while a tool that only covers files will miss the structured systems where PCI and financial data concentrates.
This is also where most enterprise environments actually get exposed. Varonis found that cloud storage, SaaS platforms (Microsoft 365, Salesforce, Box, AWS), and collaboration tools are now where the bulk of ungoverned sensitive data accumulates — and that visibility gaps there are compounding as generative AI tools index and surface files that were never properly classified in the first place (Varonis, 2025 State of Data Security Report). Discovery has to run continuously across databases, data warehouses, cloud object storage, and SaaS applications at once — because sensitive data doesn't stay confined to the system it started in.
Where the DSPM market stands, and what "good" looks like
The market has consolidated around a handful of recognized approaches. Gartner's inaugural DSPM Market Guide named representative vendors including BigID, Varonis, Cyera, Concentric AI, and Symmetry Systems, and framed the category's core use cases as data loss prevention, privacy and governance, entitlement management, cloud security posture, and — increasingly — securing data used in AI applications (Gartner Market Guide for DSPM, via GuardSense). Independent vendor comparisons echo the same split: BigID is frequently cited for its classification taxonomy depth and hybrid on-prem/cloud coverage, Varonis for unstructured file and Microsoft 365 exposure, and Cyera for fast, agentless cloud-native onboarding (Symmetry Systems, "Top Seven DSPM Solutions").
Analysts are also converging on a warning that's directly relevant to buyers: demo environments with clean, sanitized sample data hide the limitations that only show up under real production complexity, and hands-on proof-of-concept testing against your own schema is the only way to validate discovery completeness and classification accuracy before committing (Symmetry Systems, "Top Seven DSPM Solutions"). A tool that looks complete in a vendor's curated demo can still miss the messy, inconsistent, real-world data patterns that actually drive breach risk.
A practical framework for standing up sensitive data discovery
Inventory every environment, not just the ones you already suspect. Include cloud object storage, data warehouses, relational databases, SaaS applications, and any AI tools with data access. Gartner's guidance is that discovery has to be automated and continuous across structured and unstructured stores alike, not a manual, periodic exercise (Gartner Market Guide for DSPM, via Forcepoint).
Use AI/ML-based classification, not regex alone. Pattern matching still has a role for rigid formats like card numbers, but it cannot reliably classify free-text medical records, context-dependent legal language, or multilingual PII — where AI-driven semantic models outperform regex by 40-60 percentage points (IJETRM, "AI-Native DLP").
Prioritize by exposure, not just by data type. A sensitive file with broad, unmonitored access is a bigger risk than a well-secured one — Varonis found 66% of organizations have cloud data exposed to anonymous users, so classification results need to be paired with access and exposure context (Varonis, 2025 State of Data Security Report).
Test against your own production-like data before buying. Vendor demos are curated by design; validate discovery completeness and false-positive rates against your actual schema and file patterns.
Feed discovery results into a remediation workflow, not just a dashboard. Discovery that identifies risk without triggering masking, access changes, or deletion just becomes another report nobody acts on.
Re-scan continuously. New buckets, tables, and SaaS connections appear constantly; a one-time discovery project is stale within weeks.
Industry-specific considerations
Healthcare. HIPAA requires covered entities to know where PHI resides in order to apply the Safe Harbor or Expert Determination de-identification standards correctly — an organization that hasn't discovered all its PHI locations cannot demonstrate it has met either standard (IRI, "Data Masking in Healthcare"). Healthcare also remains the costliest breach category for the fifteenth consecutive year, averaging $7.42 million per incident, which makes discovery gaps a direct financial exposure, not just a compliance gap (IBM Cost of a Data Breach Report 2025, via Northdoor).
Financial services. PCI DSS 4.0 and the GLBA Safeguards Rule both require organizations to know where cardholder and customer data lives across every environment — not just production — before they can apply the required technical controls. Financial services breaches average $5.56 million, the second-highest of any industry IBM tracks (IBM Cost of a Data Breach Report 2025, via Northdoor).
A quick checklist
Do you have a current, automatically updated inventory of every system — cloud, database, SaaS — that could contain sensitive data?
Is your classification tool built on AI/ML models, or does it rely primarily on regex and keyword matching?
Does your discovery coverage span both structured databases and unstructured documents, chat, and file storage equally?
Can you show, right now, which sensitive data has excessive or anonymous access exposure?
Have you tested discovery accuracy against your own production-like data, or only against a vendor's demo environment?
The bottom line
The organizations getting hurt by shadow data aren't the ones with no security program — they're the ones whose discovery process can't keep pace with how fast data actually moves and multiplies across cloud, database, and SaaS systems. Regex-only tools and static spreadsheets were never built for an 80%-unstructured, constantly-changing data estate, and the accuracy gap shows up directly in breach cost and detection time.
C² Data Privacy Platform discovers sensitive and shadow data across cloud storage, databases, data warehouses, and SaaS systems using AI-powered classification — not regex alone — so nothing sits unclassified and unprotected. You Can't Protect What You Can't See. Book a demo to see it run against your own schema.
Sources: Gartner Market Guide for Data Security Posture Management, via Forcepoint, Gartner Market Guide for Data Security Posture Management, via GuardSense, Varonis — 2025 State of Data Security Report, IBM — "Hidden risk of shadow data and shadow AI leads to higher breach costs", IBM Cost of a Data Breach Report 2025, IBM — 2025 Cost of a Data Breach: Navigating the AI rush, IBM Cost of a Data Breach Report 2025, via Northdoor, IJETRM — "AI-Native DLP: Replacing Regex-Based Content Inspection", Symmetry Systems — "Top Seven DSPM Solutions", IRI — "Data Masking in Healthcare", C² Data Technology.
