Abstract: Systems and methods are provided for active continuous data security. An active receiver module, an active marker module, an active transmitter module and an active profiler module work together to monitor data requests, detect suspicious activity and characteristics, and responds to hinder the suspicious activity. A method includes: obtaining a request for data; obtaining a characteristic associated with the request for data; comparing the characteristic with a database of known patterns and characteristics to determine if the request is suspicious; storing the request and the characteristic in the database for future comparison; and initiating a response to hinder the request for the data when the request is determined to be suspicious. Markers embedded in data are used to track the data, including data that is exposed to a security risk. Pattern detection is used to uncover suspicious activity and the systems are able self-learn as more data is provided.