The ill-preparedness of a lot of companies to comply with recent data-privacy laws suggests a number of culprits. Perhaps the legislation was overdue, or companies have been lazy, or there’s a disconnect between lawmakers and businesses. It may also be that data-discovery technology needs an upgrade already.

The last view is the one reached by Nimrod Vax (pictured), co-founder and head of product at software security solutions company BigID Inc., four years ago. “The tools were very siloed. There was nothing for big data; there was nothing for cloud business applications. And so we identified that there is a gap here,” he said.

Vax spoke with  John Furrier, host of theCUBE, SiliconANGLE Media’s livestreaming studio, during AWS re:Invent. They discussed how a new approach to automated data discovery enables easier compliance with data-privacy legislation. (* Disclosure below.)

People lead, deep learning sieves

Software security tools’ crucial weakness for companies today is that they do not provide an adequate means to comply with many new laws. For example, both GDPR and CCPA grant covered citizens the right to be forgotten. This means they can opt to have all of their data permanently deleted from a company’s database.

“Organizations had no way of doing it because the tools that were available could not tell them whose data it is that they found,” Vax said.

Companies have been struggling to comply with the right to be forgotten with time-consuming manual processes. Such difficulties leave some doubting whether they can afford the risk associated with storing customer data at all, raising serious questions about the future of data-driven business.

A unique solution was necessary, according to Vax. “Instead of looking at the data, we started by looking at the identity, the people, and finally looking at their data, learning how their data looks and then searching for that information,” he explained.

Data discovery has been around for 20 years, and it’s a tough technology to get right. Most such tools rely on pattern matching, which is not adequate to identify sensitive information, Vax explained. One must distinguish between, for example, sensitive dates, like birthdates, and other non-sensitive dates; a last name and a first; a phone number and any other series of numbers; a resume and an application form.

What Vax calls “discovery in depth” improves on traditional pattern matching by not relying on a single method to classify data. BigID introduces contextual data discovery with convolutional neural network (also known as CNN or ConvNet) deep learning and natural language processing to identify and extract sensitive data.

Discovery is the starting point for BigID’s higher-level features. The software is downloadable from the Amazon Web Services Inc. Marketplace and scans everything in the AWS environment — not just S3 storage buckets. It can even scan Google Drive and Microsoft Office 365 for specific data. Vax likens it to a phone registry that can look up any type of data and reveal where it’s located.

“So you know where you have sensitive information, and you can immediately address that and apply controls to that information,” he said.

BigID Application Framework — a bit like an Apple app store for data — offers apps for specific use cases. For example, it has a subject-access-request app to expose all data being stored on specific individuals.

BigID has collected an armful of awards recently, including the RSAC Innovation Sandbox Award and the Gartner Cool Vendor Award.

Watch the complete video interview below, and be sure to check out more of SiliconANGLE’s and theCUBE’s coverage of AWS re:Invent. (* Disclosure: BigID Inc. sponsored this segment of theCUBE. Neither BigID nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE