Case Study
At a glance
The data landscape
Profile
SaaS platform serving over 50,000 customers
Card payments handled by a third-party processor
More than a decade of customer-generated content
Environment
25+ AWS accounts
Snowflake, fed by 40+ systems
Multi-petabyte Amazon S3 store
Google Workspace and Microsoft 365
The challenge
A PCI control the team could not yet prove
A control with no easy answer. A new PCI DSS 4.0.1 requirement asked the team to prove that no unknown caches of card data sat anywhere in the estate. Its transactional systems were clean. The risk lived downstream, in notes, replicated tables and drives.
Content no one controls. Customers and mobile workers type free-form notes and add their own content, and it piles up where no one routinely looks. Most of it is harmless. Some of it is a photo of a card, taken at the point of service.
Legacy scanning priced out. A brute-force full scan of the S3 store alone was estimated at $180,000 to $200,000 for a single pass. Repeating that on any real cadence was out of the question.
No owner for what a scan finds. Access to sensitive data had built up over years of growth, third-party app entitlements were hard to see, and no single team owned remediation.
“We definitely had to address one PCI control that said: how do you know your environment does not contain large caches of credit cards that you didn't know about? And that's what initially drew us to you.”
The Company's CIO
“[A worker] might have just taken a screenshot of [a customer's] credit card number… I can't tell you how many times that has actually happened, and it's hiding inside that S3 bucket.”
A data engineering leader at the Company
Why Bedrock Data
Scanning built for depth and cost
A serverless Outpost with zero data access
Ephemeral functions classify data inside the Company's own environment. Only anonymized metadata leaves, and databases are scanned from snapshots, so production is never touched.
Adaptive Scanning
Intelligent sampling covers the estate at a small fraction of the cost of a brute-force scan.
Selective full scans
Sparse, high-stakes content such as free-text notes gets a complete pass. The two teams built this together after sampling missed a known high-risk table.
AI-driven classification
Classification by meaning, which cuts the false positives that pattern matching produces.
Full-context entitlement analysis
Nested and chained roles are resolved to show who can actually reach sensitive data.
A unified metadata lake
A graph-based system of record, with lineage that traces where sensitive data travels, built without storing customer data.
Results
What the scan surfaced
An open question became a number. OCR scanning crawled about 300 million files in S3 and estimated roughly 25,000 containing card data.
A first phase at a fraction of legacy cost. The whole first phase cost a small fraction of a single brute-force scan.
Exposures nobody expected. Credentials stored where they should not be, sensitive PII outside sanctioned systems, and a third-party integration with more standing access than anyone realized.
A view of who can reach the data. Effective access across the estate, including nested Snowflake roles, showed access no permissions list would.
A distributed ownership model. Each domain now has an owner accountable for remediation: data engineering for Snowflake, IT for SaaS and Microsoft 365, and infrastructure teams for databases.
Answers on demand. Questions that once took a multi-team hunt now run as a rule set against a data set.
The Company came to answer one PCI control. It now knows where its sensitive data sits, who can reach it, and which team owns each finding.
The vision
What success looks like, in the CIO's words
“Full org adoption. Our internal processes nailed down, our rule sets configured, our owners with their processes dialed in, and when there are findings, those create tickets, the right team gets it, they own the resolution, and it all works together. That's what success looks like.”
The Company's CIO
What's next
Where this is heading
Closed-loop remediation: findings flow into ticketing, reach the right team, and fixes are re-validated in the source system.
Leaner PCI: less audit preparation and a smaller PCI scope, by finding shadow and duplicated cardholder data.
Governed AI and least-privilege access: guardrails for sensitive data used by AI tools, and tighter limits on broad default access to PII.
Selective full scans on the highest-risk free-text tables, on a regular cadence.
Identity resolution: moving from deduplicating PII records to tying records to single identities, which could lower cyber-insurance costs.
