Why Data Scanning Must Be a Regular Habit

At Ground Labs, we often see organizations deploying data scanning solutions as part of a compliance project or activity. They perform discovery scanning as a one-off exercise, too often simply to check a box during an audit or assessment.

However, regular data scanning is increasingly recognized as a fundamental component of effective data management. Gartner promoted data security posture management (DSPM) in their 2022 Hype Cycle for Data Security as a transformation benefit to enterprise.

Data security posture management (DSPM) “provides visibility as to where sensitive data is, who has access to that data, how it has been used, and what the security posture of the data stored or application is.” [Source: Gartner]

The Problem With One-Off Data Scanning

In 2021, approximately 79 zettabytes of data were generated worldwide. By 2025, the IDC has predicted this figure will exceed 180 zettabytes, with the volume of stored data expected to continue growing at a compound rate of around 19.2% per year.

In 2021, Gartner reported that nearly 80% of workers used collaboration tools such as Microsoft Teams. Much of the data input and shared using these platforms is unstructured. Sometimes called “dark data,” this information remains hidden to the organization, unless they routinely perform data scanning to identify it.

This dark data can include sensitive personal data as well as confidential business information. As it resides in collaboration platforms, rather than structured locations such as databases, organizations often have less ability to control who has access to the data, leaving it potentially exposed to misuse, unauthorized disclosure or cyber-attack.

While a one-off scan may once have satisfied an audit requirement, many standards — such as PCI DSS v4.0 — consider frequent scanning (in PCI DSS terms, “scoping”) as the new acceptable baseline for data security.

The Value of Regular Data Scanning

Periodic data discovery scanning forms the foundation for effective data management, especially when it’s implemented in a continuous cycle of identification, verification and protection:

1. Identify the data you have across the business using evidence-based discovery, whether on-prem or in the cloud, or in structured or unstructured formats
2. Verify the purpose of the data and its value to the organization and classify the data according to its sensitivity
3. Protect the data based on its classification

Advanced data discovery and data management solutions like Ground Labs’ Enterprise Recon support scheduling and automation and integrate with Microsoft Purview to simplify the identification and verification process, while in-built remediation tools deliver protection to sensitive and high-risk data.

To find how data discovery supports effective data management, download our complimentary article Data Discovery is Part of the Equation.