Sensitive InfoCopy Anchor Link

The Sensitive Info screen answers the question every auditor asks and almost no one can answer: "Where is our regulated data right now - and who can reach it?" Credit card numbers, national IDs, health records, credentials - each detected type becomes one row, mapped across your entire estate: how many files and emails contain it, which sites concentrate it, and which users, groups, and apps can get to it.

What You Can AchieveCopy Anchor Link

Two Engines, One TruthCopy Anchor Link

Detections carry their provenance, and the two sources are deliberately independent:

• Microsoft Purview sync - 1Security imports the Sensitive Information Type detections Microsoft has already made, so existing Purview investment shows up here immediately.
• 1Security scan - our own engine reads file and email content and applies 300+ detectors, including OCR for scanned documents and images - the place card numbers actually hide. It runs without E5 licensing. See Sensitivity Scanning.

The two engines synergize rather than compete: existing Purview investment shows up immediately and gets an independent verification, while 1Security's own engine covers tenants - and file types - Purview doesn't. Remediation stays where it belongs: DLP and auto-labeling policies are configured in Purview, aimed by what you find here.

The 1Security engine also watches for content that attacks AI rather than leaks data: three AI prompt injection detection types flag instruction-override phrasing (English and Polish), text hidden from human readers with invisible Unicode characters, and markdown templates built to smuggle data out through an assistant's answer. Because such a payload matters the moment an agent can read it, new and changed files inside any agent's knowledge sources (its RAG grounding) are scanned on a priority lane rather than the regular schedule - a planted payload is typically classified within minutes of landing.

Every detection includes a confidence level (high / medium / low), so you can quote regulator-grade numbers from high-confidence matches while still investigating the long tail.

The Detection ListCopy Anchor Link

Each row is a sensitive information type with its active status, confidence level, and reach counts across files, emails, sites, groups, users, and apps. Those counts are the pivot points: they tell you not just that 4,120 files contain IBAN numbers, but that they concentrate in two sites and are reachable by three third-party apps.

Filters scope the view to specific users, groups, sites, files, or apps, compliance frameworks, label associations, and orphaned resources - so "sensitive data reachable by X" is a filter, not a project.

Investigative PatternsCopy Anchor Link

• Concentration analysis - pick your highest-risk type (payment cards, health data) and check the sites count: two sites holding 90% of it means two remediation projects, not two hundred.
• Regulator-grade numbers - filter high confidence only when preparing disclosure or audit figures; keep lower confidence matches as your investigation backlog.
• From detection to exposure - from any type, pivot to the Files screen and combine it with sharing filters to see which instances of that data are public, external, or unlabeled.