# Sensitive-data discovery and finding validation

Separate a scan match from a validated finding. Plan coverage, blind spots, false positives and minimal sampling.

Original AI-assisted SecNet educational content. Fictional local examples; not a standards provider publication, endorsement or compliance evidence. Page exercises do not create account progress.

Sources checked: 2026-10-21

## Authorized discovery scope

Harbor wants to inspect a file share, SaaS repository and database. Define owner, authorization, sampling method, scan load and protection of collected records for each source. Installing a connector does not establish access to every area. Encrypted archives, unsupported formats and inaccessible repositories create blind spots. This lesson installs no connector and collects no file content. Learners separate included and excluded sources in an authorized plan instead of drawing organization-wide conclusions from one completed scan. Coverage evidence must accompany the result it qualifies.

## Match versus validated finding

A number sequence might be a real customer identifier, test value or unrelated text. Assess format, context, nearby fields and owner confirmation together. A confidence score is not certainty; understand what the product measures. Test with positive and negative synthetic examples. Harbor’s metadata desk accepts declared classes and performs no regex or machine-learning discovery. During actual validation, collect only necessary evidence with appropriate access so the sample does not become another uncontrolled sensitive copy. The goal is a justified finding, not a larger collection of exposed data.

## Roles of discovery tools

Enterprise catalogs, DLP and DSPM tools may focus on different sources and use cases. Microsoft Purview is an example product family, not a guarantee of coverage across every SaaS service, endpoint and database. Verify supported sources, licensing, deployment mode, access needs and evidence retention. Start with the business question: where is sensitive data, who can access it, or which channel permits inappropriate sharing? These are different measurements. This lesson is not a purchasing recommendation or a claim that vendor capabilities are interchangeable; tool outputs still require context and validation.

## Turn a finding into accountable work

A validated finding names the owner, source, affected scope, evidence reference and corrective work. Reducing copies, correcting labels, restricting access and tuning a false positive are different actions requiring appropriate authority and outcome checks. Harbor uses synthetic references rather than copied sensitive content. Revalidation states whether the same scope was compared; losing access to a source is not remediation. Track remaining gaps through ownership and dates. A discovery result does not itself establish a legal breach or reporting decision, and this local exercise makes neither determination.

## Working sequence

1. Define sources and collection authority.
2. Record coverage and blind spots.
3. Plan positive/negative synthetic tests.
4. Validate findings with minimal evidence.
5. Record corrective work and like-for-like revalidation.

## 1. The scan finished

A finished scan does not establish complete coverage. Do not generalize no findings across the organization without authorization, source scope and blind-spot evidence.

This code is a local policy model; it does not replace actual content discovery, DLP or sanitization validation.

### Weak implementation
```js
s => s.scanRan === true
```

### Corrected implementation
```js
s => s.scanRan === true &&
  s.sourcesScoped === true &&
  s.blindSpotsKnown === true &&
  s.accessAuthorized === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "scanRan": true,
        "sourcesScoped": true,
        "blindSpotsKnown": true,
        "accessAuthorized": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-sourcesScoped",
      "input": {
        "scanRan": true,
        "sourcesScoped": false,
        "blindSpotsKnown": true,
        "accessAuthorized": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-blindSpotsKnown",
      "input": {
        "scanRan": true,
        "sourcesScoped": true,
        "blindSpotsKnown": false,
        "accessAuthorized": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "scanRan": true,
        "sourcesScoped": true,
        "blindSpotsKnown": true,
        "accessAuthorized": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-sourcesScoped",
      "input": {
        "scanRan": true,
        "sourcesScoped": false,
        "blindSpotsKnown": true,
        "accessAuthorized": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-blindSpotsKnown",
      "input": {
        "scanRan": true,
        "sourcesScoped": true,
        "blindSpotsKnown": false,
        "accessAuthorized": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 2. A match was found

A match alone is not verified sensitive data. Review context, false positives and negative examples rather than treating confidence as certainty.

This code is a local policy model; it does not replace actual content discovery, DLP or sanitization validation.

### Weak implementation
```js
s => s.matchFound === true
```

### Corrected implementation
```js
s => s.matchFound === true &&
  s.contextValidated === true &&
  s.falsePositivesTested === true &&
  s.negativeFixtures === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "matchFound": true,
        "contextValidated": true,
        "falsePositivesTested": true,
        "negativeFixtures": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-contextValidated",
      "input": {
        "matchFound": true,
        "contextValidated": false,
        "falsePositivesTested": true,
        "negativeFixtures": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-negativeFixtures",
      "input": {
        "matchFound": true,
        "contextValidated": true,
        "falsePositivesTested": true,
        "negativeFixtures": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "matchFound": true,
        "contextValidated": true,
        "falsePositivesTested": true,
        "negativeFixtures": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-contextValidated",
      "input": {
        "matchFound": true,
        "contextValidated": false,
        "falsePositivesTested": true,
        "negativeFixtures": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-negativeFixtures",
      "input": {
        "matchFound": true,
        "contextValidated": true,
        "falsePositivesTested": true,
        "negativeFixtures": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 3. Sample collected

Sampling can create another sensitive copy. Without minimal fields, restricted access and expiry ownership, discovery work introduces additional risk.

This code is a local policy model; it does not replace actual content discovery, DLP or sanitization validation.

### Weak implementation
```js
s => s.sampleCollected === true
```

### Corrected implementation
```js
s => s.sampleCollected === true &&
  s.minimalFields === true &&
  s.restrictedAccess === true &&
  s.expiryOwned === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "sampleCollected": true,
        "minimalFields": true,
        "restrictedAccess": true,
        "expiryOwned": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-minimalFields",
      "input": {
        "sampleCollected": true,
        "minimalFields": false,
        "restrictedAccess": true,
        "expiryOwned": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-expiryOwned",
      "input": {
        "sampleCollected": true,
        "minimalFields": true,
        "restrictedAccess": true,
        "expiryOwned": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "sampleCollected": true,
        "minimalFields": true,
        "restrictedAccess": true,
        "expiryOwned": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-minimalFields",
      "input": {
        "sampleCollected": true,
        "minimalFields": false,
        "restrictedAccess": true,
        "expiryOwned": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-expiryOwned",
      "input": {
        "sampleCollected": true,
        "minimalFields": true,
        "restrictedAccess": true,
        "expiryOwned": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## Exit evidence

- Authorized discovery scope and blind-spot matrix.
- Contextual finding, minimal evidence and revalidation record.

## References

- [NIST SP 800-122 · PII confidentiality foundation · April 2010](https://csrc.nist.gov/pubs/sp/800/122/final)
- [Microsoft Purview · Data loss prevention overview](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp)