Every October we remind people to use strong passwords and think twice before clicking a link. Good advice. But in 2026, the fastest-growing consumer of your enterprise data isn't a person clicking links. It's an AI agent summarizing a case, drafting a reply, or resolving an incident at 2 a.m.
Agents don't get tired or impatient. They also don't hesitate before pasting a Social Security number into a prompt. They work with whatever data they can reach. So, this Cybersecurity Awareness Month, we want to add one line to the checklist: Know your data. You can't protect what you can't see, and you can't govern AI on data you haven't mapped – or don’t even know you have.
This post is about the first, and most overlooked, step: discovering and seeing your sensitive data clearly.
Why "know your data" got harder
Sensitive data rarely arrives in the field labeled "SSN." It shows up where nobody planned for it - in descriptions, comments, attachments, and images, without the right security controls around it. A customer pastes a credit card number into a chat. An employee attaches a spreadsheet of payroll data to an HR case. Someone uploads a screenshot of a driver's license or a photo of a signed form.
For years, that was a compliance challenge. With AI, it becomes an exposure problem, because every summary, search result, and agent action can carry that data somewhere new. The risks include leaks by malicious actors, accidental exposure through misconfigured access controls, and generative AI models ingesting and memorizing the data.
Knowing your data comes down to three questions:
- What sensitive data do you have?
- Where does it live, including the places nobody expects?
- How sensitive is it, and what rules should it follow?
ServiceNow Vault helps answers the first two questions with Data Discovery and the third with Data Classification. Here's how each works under the hood.
Step 1: Discover (see what's really there)
Data Discovery automatically finds and maps sensitive information across tables, records, attachments, and emails. The interesting part is how it detects, because no single technique catches everything.
- Patterns for data: Finds predictable formats like card numbers, national IDs, and account numbers using built-in patterns or custom regex.
- Named Entity Recognition: Catches names, addresses, and locations that regex misses, across both structured and unstructured data.
- Files and images, not just fields: Scans PDF, DOCX, TXT, CSV, and Excel attachments, plus screenshots and photos that text-only scanning would miss.
- AI that helps you find more, faster: Describe a pattern in plain language and ServiceNow Otto for Vault writes the regex, then summarizes discovery results, so you skip the job logs.
Why this matters for AI: an agent grounded on a knowledge article or case history is only as safe as the data inside it. Discovery finds hidden or "dark" sensitive data sitting in places nobody knows about before retrieval does.
Step 2: Classify (turn findings into meaning)
Data Discovery tells you what you have and where it is. Data Classification tells the platform how to treat it. Admins apply predefined or custom labels such as PII, PHI, or Restricted to sensitive fields and track how tables map to those labels. Organizations can also label data against compliance standards like PCI DSS, HIPAA, SOX, and GDPR etc.
Think of classification labels as the control plane for everything downstream. Tagging a field as personal, confidential, or restricted drives precise encryption, retention, and access controls, and helps support compliance reporting. Label once, and every protection keys off the same signal: encryption, anonymization, and Zero Trust Access policies, plus the audits and AI guardrails that prove it's all working. (More on each of these to come in a future blog.)
Step 3: Keep knowing: because data moves
Knowing your data isn't a one-time audit. New records, new apps, and new agents create new exposure every day.
Data Discovery supports real time to catch new risks as they appear. ServiceNow Vault Console, a simplified, centralized platform for managing all Vault applications, adds continuous AI insights that surface sensitive data showing up in non-protected channels.
Your "know your data" checklist for October
- Run a discovery scan in sub-prod. A 30-day trial is available in sub-production for discovery.
- Include attachments and images. Your spreadsheets and screenshots are likely where the dark PII lives.
- Write one custom pattern in plain language for a data type unique to your business, like an employee or policy ID.
- Classify your top 10 AI-touched tables. Start with the ones feeding summaries, search, and agents.
- Schedule rescans so your data map stays current as your AI footprint grows.
The bottom line
AI makes everything move faster, including your data. The organizations that scale AI safely won't be the ones who review every agent by hand. They'll be the ones who know their data well enough that protection becomes automatic. ServiceNow's platform comes with security controls built in. ServiceNow Vault is for the organizations that want to go further: visibility into what sensitive data exists, encryption keys you control, policies that protect sensitive data across the platform, and an audit trail that proves it all on demand.
The first step is to know your data . Stay tuned for our next blog, where we will explore how ServiceNow Vault turns that knowledge into protection, with encryption, anonymization, Zero Trust Access, and AI-safe prompts.
