Abstract: A computer-implemented method for identifying possible leakage paths of sensitive information may include (i) discovering an original set of users having permission to read the sensitive information at an originating storage device in an originating location via an original set of information transfer paths and (ii) performing a security action. The security action may include (A) determining an additional set of information transfer paths having information transfer paths other than the information transfer paths already discovered, via which the original set of users can write the sensitive information and (B) identifying an additional set of users having permission to read the sensitive information via the additional set of information transfer paths.

Abstract: The disclosed computer-implemented method for prioritizing and detecting file datasets based on metadata may include (i) receive a group of files from a data storage, (ii) train a machine-learning model utilizing a set of properties derived from metadata associated with the files, (iii) identify, utilizing the machine-learning model, a dataset including at least one candidate file that performs an action in a set of predetermined actions, and (iv) prioritize the action based on the dataset. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for computing a risk score for stored information may include (1) extracting factor-specific information from metadata describing characteristics of files stored on multiple storage devices, (2) assigning at least one respective factor score to at least one respective factor based at least in part on the factor-specific information, and (3) calculating the risk score from the at least one factor score. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for identifying potentially risky data users within organizations may include (1) monitoring computing activity of a member of an organization with respect to the member's access to data related to the organization, (2) generating, based at least in part on the member's computing activity, a baseline representation of the member's access to the data, (3) detecting at least one attempt by the member to access at least a portion of the data, (4) determining that the member's attempt to access the portion of data represents an anomaly that is suspiciously inconsistent with the baseline representation, and then in response to determining that the member's attempt to access the portion of data represents the anomaly, (5) classifying the member as a potential risk to the security of the data. Various other methods, systems, and computer-readable media are also disclosed.