Data Security opens on an estate summary. Everything below it is one question asked seven ways, which is why they are tabs under Data Security rather than seven separate pages — a finding names a store, the store holds a data type, the type flows somewhere, and coverage says whether any of it was read.

​
The seven views

ViewAnswers
FindingsWhat is wrong, and where. Grouped by control by default; switch to the flat list for one row per finding.
Data TypesWhat you hold, across the estate. Which classifier, in how many stores, and under which jurisdiction.
Data StoresThe inventory. Every store, what was found in it, and whether it was read at all.
Data FlowsDeclared movement between stores — direction, whether it crosses a jurisdiction boundary, and whether it is encrypted in transit.
Asset GraphReachability. Which identities can reach which stores, which stores are reachable from the internet, and a blast-radius table ranking stores by how many principals can read, write or delete them.
CoverageThe denominator. How much of the estate has actually been read.
Region OverviewWhere the data physically sits — the residency question.
Filters live in a rail on the left and follow you between views. Every facet is multi-select, and the count beside each option updates as you narrow, so you can see what selecting a different value would give you before selecting it.

​
Reading a finding

Opening a finding shows the store it is on, and with it the four things that decide whether it matters.
1

What data is in it

The classifiers that matched, how many times, and in how many distinct objects. A store with no content scan says so rather than showing zero.
2

Who can reach it

Every principal with a grant on the store, worst first: admin, then external, then access nobody has used in ninety days. This is the identity data from Cloud Security joined onto the store — not a second scan, and not a second opinion about who has access.
3

How long it is kept

The retention period, and — the load-bearing part — whether a lifecycle rule actually enforces it or a tag merely declares it. A store tagged with a seven-year retention that expires nothing is called out, because the gap between the two is what a retention review is looking for.
4

What it breaches

Which frameworks this one store fails, so “if I fix this bucket, what stops failing” has an answer.

​
Access, and what “unused” means

The access panel separates three states that are easy to merge and should not be:
  • Active — used within the last ninety days.
  • Unused in 90 days — a grant nobody has exercised. The candidate for removal.
  • Activity unknown — the provider has never reported activity for this principal.
The third is not a synonym for the second. A role created yesterday and a role the provider cannot report on look identical, so counting either as unused would flag every new principal on the day it is created.

​
Why a store shows no accessors

Access is resolved by ARN. A store type that has no cloud ARN — Snowflake, Kafka, a Kubernetes volume, a Git repository — cannot be resolved that way, and the panel says access is unknown rather than showing an empty list. An empty list on a bucket eighty principals can write to would be the most dangerous thing this page could render.

​
Why a size or a record count is blank

Object stores expose neither a size nor an object count on any control-plane call, so both are measured from provider storage metrics or from a content scan’s own enumeration. Until one of those has run, the store’s size reads not measured rather than 0. The same rule governs record counts, coverage states and sensitivity verdicts throughout the product. A zero would be a claim; a blank is the absence of one.
If a number you expect is blank, check the Coverage view first. It separates read, could not be read and not read yet, and the reason is almost always there.

​
Risk scores

Each store carries a score out of 100 and the breakdown behind it, grouped into the axes that produced it: sensitive data, exposure, protection, volume, activity and environment. The breakdown is stored with the score rather than recomputed for display, so the console and the scanner cannot disagree about why a store scored what it did. An axis that could not be assessed is shown as not measured rather than as a zero-length bar — an unmeasured volume and a genuinely small store are different facts, and a short bar reads as the second.