Case Study
At a glance
The data landscape
Profile
Global private equity firm
Petabytes of sensitive data
Regulated investor and deal data
Environment
Azure
Snowflake
SharePoint and OneDrive
SaaS collaboration platforms
Microsoft Purview
The challenge
Static rules, contextual risk, and a regulatory deadline
Contextual MNPI and strict information barriers. Static, rule-based classification couldn't capture contextual MNPI, whose sensitivity shifts with deal timing, or reliably enforce the strict information barriers between the Private Equity and Credit teams.
Inconsistent detection and operational friction. Existing detection, including custom Microsoft Purview types, missed the firm's highest-value materials like side letters and term sheets and returned inconsistent results, eroding confidence and leaving Snowflake and other cloud data uncovered.
Manual processes couldn't keep pace. Parts of the firm's data scanning ran on limited infrastructure and moved slowly, so teams manually reran scans and checked findings with document owners. Manual validation had become the safety net, and at petabyte scale it couldn't hold.
A regulatory deadline forced resolution. A December 2025 Regulation S-P deadline demanded a complete, audit-ready inventory of sensitive data and proof that safeguards were operational, which periodic scans and manual review couldn't satisfy.
“We can’t implement a RegEx search on Material Non-Public Information. Dept A can’t talk to Dept B about MNPI. We need automated non-RegEx based trust boundaries.”
The firm's Head of Security Architecture & Engineering
“We faced a persistent challenge in moving beyond simple discovery. We didn’t just need to find data; we needed to understand the true risk profile of every identity and asset. This is an ‘existential problem’ for our organization.”
The firm's CISO
Why Bedrock Data
Data security built for context, access, and lineage
In-environment scanning at enterprise scale
A serverless, agentless deployment ran discovery and classification inside the firm's own Azure environment, so results stayed within its security boundary instead of copying sensitive data to an external service, across Snowflake and SaaS collaboration systems.
AI-driven classification, without regex
Bedrock's models learn the firm's specific business context, analyzing data semantics and structure rather than regex or predefined rules to identify the sensitive types that matter to the firm, like side letters and term sheets, while incorporating its existing classification criteria.
Full-context entitlement analysis
Maps the complete access chain for every identity, resolving nested groups and federated identities to calculate effective permissions for users and service accounts, so access can be tested against least-privilege and internal information barriers.
Correlation-Based Lineage
Traces how data actually moves across structured and unstructured systems, even when it changes format or crosses platforms, so the firm can confirm sensitive data isn't crossing the barriers between its Private Equity and Credit teams.
Sensitivity labeling across existing systems
Integrates with the firm's existing classification and labeling systems, including Microsoft Purview, applying native tags that mirror Bedrock's classifications directly where data resides, strengthening labeling without disrupting existing hierarchies.
Continuous monitoring
Replaces manual rescans and reactive reviews with a regular cadence of automated discovery that detects new sensitive data and configuration changes as environments evolve.
Results
From discovery to operational governance
Complete, audit-ready inventory of sensitive data. The firm built a complete inventory across Snowflake and SaaS collaboration platforms, able to point to the specific datastores, drives, and sites holding regulated content to demonstrate compliance under Regulation S-P.
Less manual validation effort. Automating discovery and classification cut reliance on repeated scans and document-by-document review, freeing security and compliance teams for higher-value work.
Validated trust boundaries across business units. Correlation-Based Lineage traced how data actually moved across systems, even when it changed format or crossed platforms, confirming it was not flowing across the barriers separating the Private Equity and Credit teams.
Reduced external-sharing risk. External sharing was identified and addressed, improving control over how sensitive data is accessed and shared beyond the firm.
Stronger access controls and least-privilege enforcement. Mapping entitlements exposed unused and excessive access rights, letting the firm tighten permissions and reduce unnecessary exposure across business units.
Continuous, operational governance. The firm shifted from reactive scanning to operational governance, with continuous monitoring that detects drift as environments evolve and reduces reliance on manual validation.
Because classification, entitlement analysis, and lineage all draw on the same metadata lake, the firm could correlate what its sensitive data is, who can access it, and how it moves, building one understanding of risk rather than a set of disconnected findings.
The vision
Operationalizing governance, not just scanning for risk
“Bedrock Data has given us a level of visibility into our data lineage and effective entitlements that was previously unattainable. We are no longer just scanning for risks; we are operationalizing a program that can detect drift and enforce policy in near real-time.”
The firm's Head of Security Architecture & Engineering
What's next
Where this is heading
Building on this first phase, the firm is extending governance coverage across additional enterprise systems, and now operates with a governance model built to scale with AI.