Data Discovery and Classification: Find Your Sensitive Data
November 15th, 2026
Leading Managed Technology Services Provider (MTSP) Expands Data Discovery and Classification Solutions to Reduce Compliance and Cybersecurity Risk
INDIANAPOLIS, IN ‐ Van Ausdall & Farrar, Inc., a leading managed technology services provider (MTSP), has expanded its data discovery and classification solutions, designed to help customers identify sensitive information, reduce unnecessary exposure, and strengthen compliance. As businesses generate more data than they can track, most organizations have lost sight of what data they actually have — and who can access it.
The reality for many organizations is simple: data grows quietly over time. Employee and customer names, financial records, medical information, contracts, credentials, and internal communications accumulate across email systems, cloud storage platforms, CRM systems, laptops, SharePoint, OneDrive, Box, Salesforce, and local devices. Yet very few companies pause to ask a critical question: do we truly know where our sensitive data lives, and who can see it?
Why Discovery Comes First
Data classification begins with discovery — identifying which information exists across an organization's IT environment. From there, data is categorized by sensitivity level: public, internal, confidential, regulated, or highly restricted. You cannot protect what you have never inventoried, and you cannot classify a file you do not know exists.
This matters most in industries where regulatory oversight is strict and penalties for non-compliance are severe — healthcare, financial services, government, public safety, and criminal justice among them. Under HIPAA, for example, violations range from relatively minor fines in unavoidable situations to penalties exceeding $1 million in cases of willful negligence. If you work in one of those industries, our article on HIPAA technical safeguards covers where healthcare environments typically have gaps.
The One Percent Permission Problem
"Most users only need about one percent of the permissions they actually are granted," said Guillermo Fernandez, VCIO of Van Ausdall & Farrar, Inc. "But because data keeps growing and access is rarely reviewed, organizations end up exposing far more to potential threats than they realize."
These errors are rarely malicious. Companies prioritize collaboration and efficiency, and the default mindset is to grant broad access so work can move quickly. That is well-intentioned, and it creates unnecessary risk that compounds as data grows. A shared drive that made sense for six people still carries the same permissions when it holds contracts and payroll files.
The fix is the Principle of Least Privilege: granting access only to the people who genuinely need it. Applied consistently, it reduces exposure while leaving employees free to work — and it turns a vague sense of risk into a list of specific permissions you can justify to an auditor.
Where AI Raises the Stakes
Artificial intelligence tools operate on existing permissions. If an employee can reach sensitive information, AI can surface it instantly and in plain language. "Even though it may seem efficient to give AI access, do you want your staff to be able to ask AI how much the owner is being compensated?" commented Fernandez.
When access controls are not structured properly, sensitive information becomes searchable and visible when it should not be. Data discovery is what makes AI adoption safe rather than risky, because it establishes the permission boundaries AI tools inherit. Organizations that clean up permissions first get the productivity gains without the exposure.
What a Discovery and Classification Engagement Looks Like
Modern data discovery and classification provides structured visibility into your environment. The process identifies where sensitive data resides, evaluates who has access to it, and aligns permissions with regulatory and operational requirements:
- Scan email systems, file shares, cloud storage, CRM platforms, endpoints, and local devices for sensitive data patterns
- Classify what is found by sensitivity level, so effort goes to the records that carry real risk
- Map access — which users, groups, and service accounts can reach each category of data
- Remove or narrow excessive permissions, starting with the widest exposure
- Establish review cadence, so permissions do not silently drift back to broad access
For most businesses, the findings are humbling in a useful way. Files holding financial records or credentials are frequently reachable by far more people than the work requires, and nobody intended it. Unstructured data — scanned documents, exports, and archived files on shared drives — is usually the largest source of surprises, which is why document management and discovery tend to go hand in hand.
"Our goal is to give organizations clarity and confidence," Fernandez concluded. "Once you know what data you have and who can access it, you can protect it properly — and that peace of mind is invaluable."
Data discovery and classification are not a one-time project. New data arrives daily, employees change roles, and permissions accumulate. Treated as an ongoing part of managed IT services, classification keeps your network security posture honest instead of theoretical — and gives you an answer the next time someone asks where your sensitive data actually lives.
To find out what is exposed in your environment and who can see it, start a conversation with our team.
View Full Press Release (PDF)Posted in: Cybersecurity, News & Press