PII Exposure Detection (Copy & Paste)

Overview

The PII Exposure Detection feature helps Security and Compliance Administrators identify potential risks related to sensitive information being copied or pasted within monitored applications. The system identifies possible PII elements: email addresses, phone numbers and** IBANs ** during clipboard actions, without ever collecting or transmitting the actual clipboard content.

The feature is privacy preserving and fully configurable through global or per application settings in the Discovery module.

The system only sends numerical counts of detected PII items:

• Number of email addresses
• Number of phone numbers
• Number of IBANs

Configurable Controls

Administrators can enable or disable the feature at two levels:

1. Global Level (Discovery Settings)

• Global Toggle: Enable PII Data Exposure (Copy & Paste)
• Default state: OFF

2. Application Level

• Each application inherits the global setting.
• If the global toggle is ON, admins can enable/disable the feature per app.

Detection only runs when both the Global and App toggles are ON.

How PII Detection Works

1. Enabling the PII Detector

To activate PII detection, two settings must be enabled:

Global Discovery Setting

The feature must first be turned ON from the main Discovery settings.

Application-Level Setting

After the global toggle is enabled, you must also enable the feature for each specific application.

PII detection will only run when both settings are ON.

By default, the PII detector appear enabled.

2. Detection Behaviour

Once enabled:

• The system monitors copy (outflow) and paste (inflow) actions performed within the discovered application.
• If a user copies or pastes any of the following:
  • Email address
  • Phone number
  • IBAN

The detector will identify the presence of these PII elements.

3. Counting & Displaying Results

• Each time a user copies or pastes PII, the corresponding PII count increases.
• These counts are then processed in the backend to calculate the application’s PII exposure level.
• The result is displayed to users in the Discovery module on the Discovered Apps table as two columns
  PII Inflow Risk and PII Outflow Risk (High, Medium, Low) , based on the total detected PII activity.

User can click over the badge to view total detected PII counts within selected date range

How Risk is Measured

The backend aggregates detection counts to determine the exposure level for each application.

1. Raw Weighted Score

Each PII type contributes differently to the overall risk:

RAW Score = (Emails × 1) + (Phones × 2) + (IBANs × 5)

2. Density per 100 Actions

Risk is normalized based on total clipboard activity:

R100 = (100 × RAW) / Total Actions

3. Normalized Score (0–100)

The platform converts density into a normalized risk score based on a reference level (default: 50):

Score = normalization of R100 into a 0–100 scale

4. Risk Levels Displayed in the Apps Table

Note : User can click over the badge to view total detected PII counts within selected date range.

PII Exposure Trend – App Dashboard

Overview

The PII Exposure Trend feature helps Security and Compliance Administrators track the evolution of potential sensitive data exposure over time for each application. It provides a visual summary of inflow (paste) and outflow (copy) risks based on PII detection scores, helping you identify patterns and trends in data handling.

Key Features

1. PII Exposure Trend Section

• Each application Analytics dashboard includes a dedicated section labelled "PII Data Flow".
• The section is only visible if PII detection is enabled globally and for the specific application.

2. Line Chart Visualization

• The trend is displayed as a line chart showing normalized PII exposure scores over time.
• X-axis: Time (based on the selected dashboard range)
• Y-axis: Normalized Score (0–100)
• Lines:
  • Inflow Score (paste actions)
  • Outflow Score (copy actions)

3. Interactive Tooltips

• Hovering over the chart shows detailed information:
  • Exact Inflow and Outflow scores
  • Corresponding timestamp

4. Behavior

• The chart adapts to the selected time range on the dashboard.
• If PII detection is turned off globally or for the app, the chart is hidden.