Nobody protects what they can't afford to find.

Security leaders are accountable for protecting all sensitive data, even across an environment they don’t completely see. Data sits in production, file shares, backups, staging, development, SaaS platforms and now AI workflows. Much of it has never been scanned.

That isn’t because nobody cares. Thorough and accurate discovery has been too expensive to run everywhere, all the time. At $1 to $3 a gigabyte, organizations have had to choose what gets scanned and what doesn’t. Every exclusion creates a blind spot.

Take away the meter, and the tradeoff changes. You can scan everything, know where the sensitive data actually is, and protect it.

The math you’re working with today

List prices for the big cloud scanners run $1 to $3 per gigabyte inspected. One terabyte is $1,000 to $3,000. Forty terabytes starts at $40,000 per pass. The compute to run our engine over the same 40 TB is about $100.

That per-gigabyte number is why scope gets cut. It’s also why context often has to stand in for content. A “critical” label on a bucket or server is context: it tells you where the data came from. It tells you nothing about what’s in the files, and you only learn that by scanning. At $1 to $3 a gigabyte, most programs run on context alone, then pay top-tier protection on the whole thing, whatever is actually in it.

A CISO at a multibillion-dollar company walked me through his version. He priced DLP against the worst case if data got out, about $5 million, and concluded it was cheaper to keep good backups, skip DLP, and carry the risk. At $3 a gigabyte he was right. At a quarter of a cent, the same spreadsheet says: scan everything, know what you’re carrying, and spend the protection budget on the data that turned up.

Stop rationing discovery

We built Inspect-Data to give you continuous visibility into all of your data: priced so nothing has to be left out; lightweight and fast to run wherever the data lives.

Flat price. No per-gigabyte charge. On a large AWS instance, every classifier reads every byte of a full terabyte in about eight hours for roughly $2.55. Precision, recall and F1 are on par with AWS Macie and Google Sensitive Data Protection.

Footprint and flexibility. The engine is small enough to run on a fraction of a server, so it fits beside the systems you already have instead of requiring new infrastructure, or you can run it on demand. It runs inside your own environment, including air-gapped, and nothing is sent externally. Put the scanner where the data already is.

Speed. A full scan of a terabyte finishes in hours, not weeks. Narrow it to the identifiers you care about, such as Social Security numbers, card numbers or credentials, and it finishes in under an hour. Matching against your own customer or employee records is even faster. Scanning the whole environment stops being a project and becomes a routine job.

Price lets you scan everything. Footprint and flexibility let you scan where the data is, when it’s created, instead of months later. Speed lets you do it in hours instead of weeks.

Put discovery underneath the controls you already own

• Find sensitive data before you pay to protect it. Keep your DLP or DSPM. Inspect broadly first, then concentrate expensive controls on the data and repositories that actually contain sensitive information.
• Know what’s going to AI before it gets there. Inspect data sources before connecting them to AI systems. Identify or redact sensitive information inside your environment and continue inspecting as the source changes.
• Find the shadow data nobody planned for. Inspect staging, development, backups, logs, file shares and other places where production data gets copied. Exact data matching can identify your actual customer, patient or employee records, not merely data that looks like them.

The same engine can run inline with logs, inside an application, on an endpoint or edge device, or across stored data.

Two things most scanners don’t have

Exact and hashed data matching. Standard classifiers tell you if there is sensitive information that looks like something you need to worry about, and for many applications, that’s what you want. But say you want to know exactly if something was found out of a database. Employee names, financial records, medical record numbers, that sort of thing.

Exact data matching allows you to provide data to the engine, even millions of rows, and report if they are found. There is even the option of using a hashed variant, so that you can detect critical information on edge nodes safely.

Text extraction wherever you want it. If your pipeline already extracts text from PDFs, Office files, archives and embedded images, hand the engine the text. If it doesn’t, the engine extracts it for you. You fit the engine to your architecture, not the other way around.

Regulators require the inventory. Boards expect it.

The question is written into the rules: what personal data do you hold, and where is it. PCI DSS 4.0 requires every location where account data is stored, including backups and systems outside the cardholder environment, confirmed at least annually. OCR is auditing HIPAA risk analysis now, and the proposed Security Rule update would add a written asset inventory and a map of how ePHI moves. The FTC Safeguards Rule and NYDFS Part 500 require data and asset inventories of their own. California’s CCPA risk assessments are due December 31, 2027.

Regulators aren’t the only ones asking. Boards rank data privacy and cyber as their top AI concern (69% in PwC’s 2026 directors survey), 45% of audit committee members say they spend too little time on AI and data risk, and 82% of directors call the information linking AI outcomes to risk fair, poor or missing. The inventory of what you hold and where it is answers both the regulator and the board.

Scan everything and that documentation comes out of the inventory. Scan a sample once a year and it comes out of a memo that was obsolete the next day.

”If I scan everything, I’ll have to deal with what I find”

This comes up in most conversations. Look everywhere, find a mess, own the mess.

But incomplete visibility doesn’t eliminate the risk. It limits your ability to assess it. An inventory based on assumptions or a narrow point-in-time scan can only tell you what was in scope when you looked. Broad, repeatable discovery gives the security team evidence about what is actually there.

The bottom line

You can’t protect sensitive data you don’t know is there.

For years, the economics of discovery made incomplete visibility an accepted tradeoff. Organizations scoped, sampled and prioritized because inspecting everything wasn’t practical.

Inspect-Data makes content-level discovery inexpensive enough to run broadly, fast enough to run repeatedly, and small enough to embed where the data lives. Keep the controls you already have, and give them a better map.

Know what you have. Protect what matters.

Benchmark details are available on request. Compare what a full sweep costs under per-gigabyte pricing.