Data Discovery
Automatically scanning stores to find where sensitive data actually resides, as distinct from where the documentation says it should.
Classification schemes are usually defined top-down and applied to new systems. Discovery answers the harder question: where is the regulated data right now, including the copies nobody recorded?
The consistent findings when an organisation first scans properly: personal data in log files, production data in a development database, exports on object storage from an investigation two years ago, an analytics table that unexpectedly joined identifiers, card numbers in a free-text notes field, and personal data in support ticket attachments.
Each of those has different remediation, and none appears in an architecture diagram.
Mechanisms: managed scanning services (Macie, Purview, DLP), pattern and entity detection over samples, and increasingly classification derived from lineage — a column derived from a classified column inherits the classification, which is far cheaper than scanning everything repeatedly.
Two design points. Scan continuously rather than once, because new copies appear constantly, and a one-off scan is accurate for a week. And feed results into the catalogue and into policy, so discovery drives enforcement — access controls, retention, masking in non-production — rather than producing a report that is read once.
The strongest use of the output is usually deletion: much of what is found is data nobody needs, and removing it is cheaper than protecting it.