| Page | Answers |
|---|---|
| Dashboards | What needs attention across the estate. |
| Findings | What is wrong, where, and its status. |
| Activity | Who accessed what, what changed, and incidents. |
| Accounts | The same views, for one account at a time. |
| Datastores | Every store, what it holds and who can reach it. |
| Data | Every data class, where it is and how much of it there is. |
| Identities | Every identity that can reach a datastore. |
| AI Agents | AI agents, apps and endpoints with reach into sensitive data. |
| Compliance | Framework posture mapped to the data found. |
| Privacy | Data subject requests. See Privacy requests. |
| Policies | The rules that raise Findings. |
| Deployments | Every scanner and connection, its health, coverage and settings. |
| Reports | Generated and scheduled reports. |
Dashboards
Two tabs, both filterable by account and exportable as CSV or Excel:- SecOps: open Findings by severity, sensitive records at high risk and their trend, top identities with access, Finding trends, and the top Findings, datastores and data classes at high risk.
- Data & Assets: datastore totals (new and ghost stores, per provider), data classes (including learned and file-level classes), the data inventory, and how records and sensitivity are distributed.
Findings
Each Finding is one policy failing on one datastore, with an id such asDSPM-123.
- Group by policy, datastore, risk type, severity or account, or show a flat list.
- Filter by status, severity, policy, risk type, framework, data class, sensitivity, datastore, account, cloud provider, region and more. Export CSV exports the current view.
- Status: Open or In Progress, or close it as Resolved, False Positive, Risk Accepted, Won’t Fix or Muted, with an optional note. Select changes the status of many Findings at once.
Activity
- Live Event Feed: data access events from CloudTrail, storage logs and audit logs.
- Data Changes: objects added, modified or removed between runs, and the classes they gained or lost.
- Incidents: move each through Open, Investigating, Resolved or False Positive. Use Report Incident to open one by hand.
- Anomalies: unusual access, marked Reviewed, Escalated or Dismissed.
Datastores
The inventory of every store found. A ghost icon marks a store nobody appears to use or own; hover it for the reason. An account’s page shows the Data Flows and Asset Graph of that account’s stores. Open a store for its Overview, Findings, Classified Data, Data, Identities and Event Log. The Overview shows its details, the data classes found, security configuration, who can reach it, network reachability, volume and retention, and its risk score. The store’s Actions menu has Rescan now, Auto-Scan (On, Off or Use account schedule), Scan Priority, Manage tags, Manage contacts and Copy URN. Select several stores on the list to rescan, turn auto-scan on or off, or tag them together. A size or record count that has not been measured yet reads not measured, never0.
Data
Every data class found, with its context, sensitivity, total records, Findings, datastores and accounts.- Add Data Class creates a custom class. See Classification.
- Learned candidates lists auto-learn and AI suggestions to Promote or Dismiss.
- Data class catalog and Custom classes list what can be detected.
Identities
Every identity that can reach a datastore, filterable by trust level, identity type, stale or ghost identities, MFA, AI identities and privilege. Click a row to open the identity in a side panel (step through the list with its arrows, or choose Open full page); click its name to open the full page directly. Each identity shows the datastores it can reach and the classes they hold.- Last Active is a date, Never used (the scan read the use of every credential and found none: a role’s last use in the 400 days AWS tracks, every password and access key of a user in the credential report), Not applicable for groups, or Unknown (not collected) when nothing read it.
- Creation Date is IAM’s creation date for AWS users, roles and groups.
- Organizational Info comes from the identity provider, or, for AWS users and roles, from their tags:
Department,TitleorJobTitle,OfficeorLocation,Country,EmailandOwnerorManager. Each value names its source. An AWS user tagged withEmailis linked to the Microsoft Entra ID user with that address.
AI Agents
AI agents, AI applications, model endpoints and knowledge bases found in your cloud accounts, with the sensitive data each can reach. Tiles count those that reach sensitive data, have no guardrail or have a public endpoint. AI found in code, on developer machines or in clusters is shown by other products, not here. The inventory comes from each cloud’s AI services: Amazon Bedrock and SageMaker, Azure OpenAI and Vertex AI, read by the in-account scanner when its deployment has Collect AI services and agents turned on (Deployments → the deployment → Configuration; on by default). On AWS and GCP the Terraform variableenable_ai_inventory (default true)
grants the read permissions it needs. When the page is empty it says which accounts were read and which services did
not answer.
Compliance
Posture per framework, such as GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001, ISO 27701, CCPA, DPDP and the EU AI Act. Each framework lists its Requirements, Policies, Datastores and Scope declarations, each marked Failing, Passing or Not evaluated. Export the evidence as CSV, or a compliance report as PDF or Excel.Policies
- Explore the catalogue by use case, severity or framework, and Add or Remove any policy.
- Recommended activation keeps critical and high policies for the datastore types you use, and switches off the medium and low policies you have not set yourself; their open Findings close at the next evaluation. Policies you switched on or off yourself are never changed. Turned off, every built-in policy you have not switched off runs.
- Create Policy opens the editor: name, description, base severity, risk type, use case, framework, the conditions (on the datastore, its data and the identities that reach it) and remediation guidance.
- Built-in policies can be switched off or given another severity. Custom policies can be duplicated or deleted.
Deployments
Three tabs:- Deployments: every in-account scanner and hosted connection, with its health. Open one for its status, preflight checks, runs, configuration and errors. See Before you deploy.
- Coverage: how many stores were discovered, read, refused or not scanned yet, and under What is missing, and why, the cause and fix for each gap.
- Settings: organization-wide classification settings. See Classification.