Data Security: PII Detection on Endpoints

Data Security is the part of a Risk Assessment that looks for personally identifiable information (PII) stored on a client’s devices and puts a dollar figure on it. If a client has HIPAA or other privacy requirements, read the section on masking before you scan.

​

How PII detection works

During each scan the Telivy agent reads files on the endpoint and looks for content that matches known PII patterns. For every file with matches, Telivy records the device, the file path, the PII type, how many matches it found, a confidence level, and a dollar-risk value based on a cost per match. Results roll up per device and per client, so you can see which machines hold the most exposure.

​

Requirements

• A Risk Assessment. External Assessments do not scan for PII.
• The Telivy agent on the devices you want scanned. The agent scans with system privileges and can read every file on the device. You can also scan without installing the agent, but then the scan runs as the signed-in user and only sees files that user can open.

​

PII types by country

Each assessment has a PII country, and the country decides which PII types are scanned for and how they are labeled. Telivy supports the United States, Canada, the United Kingdom, South Africa, Australia, New Zealand, Singapore, and Poland. Every country includes credit card numbers, phone numbers, email addresses, IP addresses, OAuth tokens, bank SWIFT codes, and passport numbers. On top of that, each country adds its own identifiers:

​

Reading the results

Open Inventory > Data, or the Data Security section of the Security tab, and select a device to open its data risk table. It lists one row per file with these columns: Status, Device, File, Size, Last Modified, PII Type, Confidence, Matches, and Risk in the assessment’s currency. The table shows how many matches a file has, never the matched values themselves. You can search by file path and filter by PII type, status, and confidence. Confidence is High, Medium, or Low. A match scores higher when, for example, it passes a checksum or has a context keyword such as “SSN” near it. Select View on a row to open the file details. This shows the file path, match count, confidence, the detection signals behind that confidence, and a Data Found section with the matched values. Use it to confirm whether a hit is real or a false positive, such as a test card number in a code sample. If a file is a false positive, select Mark False. Its status changes to False Positive and its dollar risk drops to zero. Unmark False reverses it. The CSV PII report includes match counts by PII type for the same files.

​

What leaves the device

By default, Telivy keeps a sample of each matched value along with the file path, device, and PII type, because confirming a finding requires seeing what was matched. The data flow is:

1. The agent scans files locally on the endpoint.
2. Matches are encrypted in an application-level payload before they are sent, in addition to TLS.
3. The Telivy platform decrypts the payload and stores it against the device.
4. Only users with access to the assessment can see it in the portal.

Passwords are handled differently. The password analysis never sends cleartext passwords off the device, only hashes. If storing PII samples is not acceptable for a client, turn on masking.

​

Mask PII Data

The Mask PII Data (may be required under HIPAA) setting removes matched values from the Data Found view, from CSV exports, and from anywhere else a raw match would appear. Match counts, file paths, devices, and dollar risk are still shown, so you can still act on the finding. Turn it on for clients that handle protected health information or whose vendor risk program does not allow a third party to store production PII. Some agencies turn it on for every client so there is one policy to explain.

​

Where to set it

PII settings live in a dialog called Configure PII Settings. You can open it in two places:

• For one assessment: select Configure PII Settings in the Data Security section of the Security tab, or on the Overview tab.
• As your agency default: go to Account > Assessment Defaults, find the PII Capture card, and select Configure default PII Settings. Only agency admins see this button.

The agency default applies to assessments created after you save it. Existing assessments keep their own settings, so change those one at a time.

​

Masking needs a rescan

The dialog groups its fields under two headings. Mask PII Data, Mask Dark Web Passwords, and Country are under “Settings that require Rescan All to take effect”. Changing them does not redact data that has already been collected. After you turn on masking, run Rescan All on the assessment, then open a file’s details and check that Data Found is redacted. Mask Dark Web Passwords is a separate toggle for leaked passwords found in dark web results. Turning on one does not turn on the other.

​

Dollar risk and cost per match

Currency and a cost for each PII type are under “Settings that take effect immediately”. Each cost field is labeled with the PII type, for example SSN (per match), and the list follows the country you picked. Risk values update as soon as you save, without a rescan, because only the valuation changes and not the matches. Change the costs when a client is in a regulated industry with known per-record penalties, when they operate in a different currency, or when you want a more conservative figure for a QBR.

​

Using the results with a client

Start by filtering the data risk table by device. A few machines usually hold most of the exposure: file servers, finance and HR laptops, and old devices full of years of exports. Sort by risk rather than match count, because a single large export can have thousands of matches. Check those devices against disk encryption findings too. An unencrypted laptop holding regulated PII is the most urgent fix. Typical fixes: delete or archive stale exports, move active datasets into managed cloud storage with access controls, encrypt devices that hold regulated PII with BitLocker or FileVault, and tighten file server permissions so teams only see their own data. When a file is deleted or moved, the next scan drops it from the results.

​

FAQ