All Resources
In this article:
minus iconplus icon
Share the Blog

Thoughts on Sentra and the Data Security Landscape After Our Series A

February 1, 2023
3
Min Read

By Asaf Kochan, Co-Founder and President, Sentra

Series A announcements are an exciting time for any startup, and we look forward to working with our new investors from Standard Investments, Munich re Ventures (MRV), Moore Strategic Ventures, and INT3 to grow the cloud data security and data security posture management (DSPM) categories. 

I wanted to take a moment to share some of my thoughts around what this round means for Sentra, cloud data security, and the growth of the DSPM category as a whole. 

Seeing is Believing: From Potential Customer to Investor

The most amazing part of this round is that we didn’t originally intend to raise money. We approached Standard Industries as a potential customer not an investor. It was incredible to see how bought-in the team was to Sentra’s approach to data security. They understood instantly the potential for securing not only Standard’s data, but the data of every cloud-first enterprise. The total addressable market for data security solutions is already large, and it’s growing every year, as more and more new companies are now cloud-native. The global need for solutions like Sentra was obvious to their team after seeing the product, and I’m excited to have a forward-thinking investor like Standard as part of our journey. 

It’s a Vote of Confidence in the Sentra Team and Product

Any Series A is first and foremost a vote of confidence. It’s an endorsement of the vision of the company, the approach the product is taking, and the potential of the core team to continue to grow the business. Anyone who has spoken with our talented team understands the level of expertise and perseverance they bring to every task, meeting, and challenge. I’m proud of the team we’ve built, and I’m excited to welcome many new Sentrans to the team in the coming months. 

As I mentioned, the round is also a mark of confidence of the development and direction of the product itself. Working with our existing customers, we’ve regularly added new features, integrations, and capabilities to our solution. As we continue to discover, classify, and secure larger amounts of data in all cloud environments, the benefits of a data centric approach become clear. We’ve successfully reduced the risks of catastrophic data breaches by reducing the data attack surface, improved relationships between engineering and security teams by breaking down silos, and even helped our customers reduce cloud costs by finding and eliminating duplicate data. 

Data Security is a Must, Not a Nice to Have

Raising money in the current economic climate is not to be taken for granted. The significant investment in Sentra’s vision speaks not only to the value provided by Sentra’s product and team, but also to how critical data security has become. Compliance, privacy, and security concerns are present regardless of how the NASDAQ is performing.

Certainly we’re seeing no slowdown in data security regulations. Global enterprises are now responsible for ensuring compliance with a growing number of data regulations from different government and commercial sources across the globe.  When it comes to security and IP protection, the threat of a catastrophic data breach is top of mind for all cloud security teams. As the reality sets in that breaches are not a matter of “if” but “when”, the logic of the data centric approach becomes clear: If you can’t prevent the initial breach, you can make sure your most sensitive data always has the proper security posture. In the future we’re building, not every breach will be newsworthy, because not every breach will involve sensitive data. This funding round demonstrates the growing acceptance that this is the direction cloud security is and should be heading. 

DSPM will Come to Dominate Cloud Security

There’s always some skepticism in the cyber world when a new category is created. 

  • Is the problem it claims to solve really that serious?
  • Can we just use existing paradigms and tools to address it?
  • Is implementing a new tool going to make a real difference for the business? 

These questions are valid, and any cyber company operating in a new space must address them forthrightly and clearly. We have been clear from the beginning - a data centric approach to security with DSPM is not a small step, but a giant leap forward. Data is the core asset of most companies, and that asset is now stored in the cloud. Old approaches will not be sufficient. This new round is led by investors who recognize this new reality and share our vision that we need to put data at the core of cloud security strategies.

I want to end by again emphasizing how thankful I am for having amazing investors, partners, and team members join us over the last 18 months. So much has been accomplished already, but the industry shift to data centric security has only just begun. I’m looking forward to continuing to protect the most important business asset in the world - our data.

For four years, he was the commander of Israel’s Unit 8200, leading the world's most innovative cyber team. During those years, he saw threat actors continuously exploit sensitive data that was improperly secured, and worked to mitigate the damage this was causing to both the public and private sectors. Reflecting on these experiences, it was clear to him that sensitive data had become the most important asset in the world. In the private sector, enterprises that were leveraging data to generate new insights, develop new products, and provide better experiences, were separating themselves from the competition. As data becomes more valuable it becomes more of a target. And as the amount of sensitive data grows, so does the importance of finding the most effective way to secure it. That’s why he co-founded Sentra, together with accomplished co-founders Yoav Regev, Ron Reiter, and Yair Cohen.

Subscribe

Latest Blog Posts

David Stuart
David Stuart
Romi Minin
Romi Minin
March 11, 2026
4
Min Read

Data Security Governance in the Age of Cloud and AI

Data Security Governance in the Age of Cloud and AI

Cloud adoption, SaaS expansion, and GenAI applications are transforming how organizations approach data security governance. What was once primarily a compliance exercise is now a strategic priority. In fact, 67% of security leaders say information protection and data governance are top priorities, as it directly affects how companies protect sensitive data, manage risk, and support digital growth.

What Is Data Security Governance?

Data security governance is the framework of policies, technologies, and processes organizations use to protect sensitive data, control access, ensure regulatory compliance, and reduce risk across cloud, SaaS, and on-prem environments. It combines data discovery, classification, access governance, monitoring, and incident response to ensure that the right users can access the right data - securely and responsibly. As data environments expand across cloud platforms, SaaS applications, and AI systems, effective governance helps organizations maintain visibility, enforce policies, and respond quickly to emerging threats.

Quick Answer: What Makes Data Security Governance Effective?

Effective data security governance programs typically include five key elements:

  • Continuous data discovery and classification
  • Strong data access governance
  • AI-driven monitoring and risk detection
  • Zero trust security controls
  • Clear policies supported by a security-first culture

Organizations that combine these capabilities gain better visibility into sensitive data, reduce exposure risks, and strengthen compliance across complex cloud environments. But the landscape is evolving quickly. Security leaders must manage growing cloud ecosystems, keep up with complex regulations, and respond to new threats while maintaining business agility. Sentra offers a streamlined approach: unified, agentless data security governance that connects visibility, automation, and intelligent threat response.

Here are five steps to building an effective governance program in 2026 and beyond.

1. Lay the Foundation: Build a Governance Program That Evolves

Effective data security governance begins with a strong organizational foundation. As data environments expand across cloud platforms, SaaS applications, and AI systems, organizations need structured governance programs that define how sensitive data is discovered, classified, accessed, and protected.

Adoption is rapidly increasing. Today, 71% of organizations report having a formal data governance program in place, reflecting growing recognition that coordinated governance improves data quality, analytics, and compliance outcomes. However, effective data security governance frameworks cannot remain static. They must evolve alongside business operations, regulatory requirements, and emerging technologies.

Organizations should establish:

  • Clear data ownership and accountability
  • Policies for data classification, access control, and retention
  • Strong collaboration between security teams, IT, data teams, and business stakeholders

Security leaders should also conduct regular governance reviews, measure risk reduction and compliance outcomes, and continuously refine policies as data usage expands. Sentra helps organizations strengthen this foundation by providing unified visibility into sensitive data across cloud,SaaS, and OnPrem environments, enabling teams to align governance policies with real-world data risk.

2. Automate Data Security Governance with AI

Manual governance processes cannot scale with today’s massive data volumes and complex cloud environments.

Leading organizations are increasingly adopting AI-driven data security governance to automate critical tasks such as:

  • Sensitive data discovery and classification
  • Automated metadata tagging
  • Anomaly detection and threat identification
  • Policy enforcement and data masking

These capabilities embed security directly into operational workflows and significantly reduce manual overhead. Sentra combines Data Security Posture Management (DSPM), Data Access Governance (DAG), and Data Detection & Response (DDR) into a unified, agentless platform.

Security teams gain:

  • Real-time visibility into sensitive cloud and SaaS data
  • Detailed access mapping across identities and systems
  • Rapid remediation for misconfigurations and excessive permissions

This automation allows security teams to focus on strategy instead of constant reactive firefighting.

3. Implement Zero Trust and Manage GenAI & SaaS Data Exposure

The rapid adoption of GenAI and SaaS tools introduces new governance challenges. Many organizations face risks from shadow AI, where employees use AI tools (ex. Copilot) without security oversight. Gartner predicts that 40% of enterprises will experience security or compliance incidents due to “shadow AI” by 2030. Modern data security governance frameworks should apply zero trust principles, which assume risk is always present.

Key practices include:

  • Inventory and monitor both sensitive data and the AI tools accessing it
  • Continuous monitoring of data access behavior
  • Detecting unusual activity and privilege misuse
  • Identifying excessive permissions and dormant accounts

Sentra’s automated risk scans and access controls help organizations quickly detect exposures and ensure both traditional and AI-generated data remain governed and protected.

4. Unify Identity Governance and Privacy Controls

As automation and AI expand, the distinction between human and machine identities is becoming increasingly blurred. Modern data security governance programs must manage both. Many data breaches originate from credential misuse, excessive permissions, or compromised identities, making identity governance a critical part of protecting sensitive data.

Effective programs should:

  • Map identities to the data they access
  • Enforce least-privilege access controls
  • Monitor identity activity across environments
  • Automate privacy and data protection policies

Sentra enables organizations to unify identity governance with data security by mapping every user, application, and machine identity to sensitive data assets. This reduces risk, strengthens compliance, and limits the impact of credential abuse or privilege creep.

5. Foster a Security-First Culture and Business Alignment

Technology alone cannot ensure effective data security governance. People and processes are equally critical. Organizations that succeed build a security-first culture where employees understand policies, participate in training, and recognize their role in protecting data.

Leading organizations embed governance responsibilities across departments, aligning security with:

  • Digital transformation initiatives
  • Regulatory compliance requirements
  • ESG commitments
  • Customer trust and brand reputation

Sentra customers achieve this by integrating governance into everyday business workflows, enabling innovation while maintaining strong risk controls.

Key Takeaways: Building Effective Data Security Governance

  • Data security governance protects sensitive information through policies, monitoring, and access controls across cloud and SaaS environments.
  • Modern governance programs rely on AI-driven automation for classification, monitoring, and risk detection.
  • Zero trust security models help detect abnormal data access and reduce risk from excessive permissions.
  • Identity governance ensures both human and machine identities only access the data they need.
  • Strong governance requires both technology and organizational alignment.

Conclusion

In the age of cloud computing, SaaS expansion, and AI innovation, data security governance has become a critical driver of secure business growth. Organizations that combine strong governance foundations, AI-driven automation, zero trust principles, and identity-aware security can better protect sensitive data while enabling innovation. By following these five steps and adopting unified platforms, companies can reduce risk, maintain compliance, and confidently scale their digital initiatives.

Want to unify data visibility, automate governance, and secure cloud and AI data?Schedule a personalized demo to see how Sentra’s DSPM + DDR platform accelerates modern data security governance.

<blogcta-big>

Read More
Linoy Levy
Linoy Levy
March 10, 2026
4
Min Read

PDF Scanning for Data Security: Why You Can’t Treat PDFs as a Second-Class Citizen

PDF Scanning for Data Security: Why You Can’t Treat PDFs as a Second-Class Citizen

If you had to pick one file format that carries the bulk of your organization’s most sensitive documents, it would be PDF.

Contracts and NDAs, medical records, financial statements, invoices, tax forms, legal filings, HR packets - all of them default to PDF, and all of them tend to be copied, emailed, uploaded, and archived far beyond the systems where they originated. Adobe estimates there are trillions of PDFs in circulation; for most enterprises, a non‑trivial percentage of those live in cloud storage with overly broad access controls.

Despite that, many data security programs still treat PDF scanning as an afterthought. Tools that are perfectly happy parsing an email body or a CSV row suddenly become half‑blind when you hand them a complex multi‑page PDF,  and completely blind if that PDF is just a scanned image.

That is exactly the gap we set out to close with PDF scanning for data security in Sentra.

Why PDFs Are a First‑Class Data Security Risk

PDFs sit at the intersection of three uncomfortable truths:

  • They are the default format for high‑risk documents like contracts, patient records, tax filings, and financial reports.
  • They are easy to copy and spread - attached to emails, dropped into shared drives, uploaded to SaaS tools, and mirrored into backups.
  • They are often opaque to legacy DLP and discovery tools, especially when content is embedded in images or complex layouts.

From a risk perspective, treating PDFs as “less important than databases” makes no sense. If anything, the opposite is true: a single mis‑shared PDF can expose entire customer lists, PHI packets, or undisclosed financials in one move.

How Sentra Scans PDFs for Sensitive Data

Sentra’s PDF scanning is built on the same file parser framework we use for other unstructured formats, with specialized handling for both native text PDFs and image‑based PDFs. Our engine operates in two complementary modes.

Text Mode: Deep Inspection of Native PDF Content

In text mode, we extract all embedded text from each page and separately detect and pull out tables.

That distinction matters. In invoices, financial statements, and tax forms, the critical data often lives in rows and columns, not in narrative paragraphs. Sentra:

  • Detects table boundaries in PDFs.
  • Extracts cell values into a tabular representation.
  • Treats those cells as structured data, not just part of a flat text blob.

Once extracted, this structured view flows into Sentra’s classification engine, which analyzes it with specialized classifiers for:

  • PII such as names, email addresses, national IDs, and phone numbers.
  • Financial data such as account numbers, routing codes, and transaction details.
  • Regulated records such as tax identifiers or health‑related codes.

This approach is far more precise than a naive “search the whole document for 16‑digit numbers” method. It lets you distinguish, for example, between a random ID in the footer and a full set of cardholder details in an itemized table.

Image Mode: Solving the Scanned PDF Problem

A huge fraction of enterprise PDFs are actually just images of paper forms: patient intake sheets, signed contracts, faxed tax returns, screenshots dumped into PDF containers. To a legacy DLP engine, those documents are empty. To Sentra, they are just another OCR input.

Sentra:

  • Detects embedded images in PDF pages.
  • Extracts those images safely, including JPEG‑compressed content.
  • Processes them through our ML‑based OCR pipeline built on transformer‑style models.
  • Passes the resulting text into the same classifier stack we use for native text.

The result is that a scanned W‑2 receives the same depth of inspection as a digitally generated one. No practical difference, no exceptions.

Metadata, Encryption, and Hidden Exposure

Most tools stop at visible text. Sentra goes further.

PDF Metadata as a Data Source

PDF metadata can leak far more than people expect:

  • Author names and usernames
  • Internal file paths and system details
  • Document titles and descriptions that reference customers or projects

Sentra parses this metadata, normalizes it, and runs it through the same unstructured classification engine we use for body text and document context. That makes it possible to surface cases where you are unintentionally exposing sensitive details in fields that almost never get reviewed.

Encrypted and Password‑Protected PDFs

Password‑protected or encrypted PDFs are not invisible to Sentra. When our scanners encounter PDFs that cannot be opened for content inspection, we still:

  • Identify them as PDFs.
  • Record their location and basic properties.
  • Surface them in your inventory so you can see where opaque, potentially sensitive PDFs are accumulating, instead of silently skipping them.

In practice, a cluster of unreadable encrypted PDFs in an unexpected bucket is often a sign of data hoarding, shadow IT, or deliberate attempts to evade controls.

Security Architecture – Scanning Inside Your Cloud

All of this processing happens inside your cloud environment, using Sentra’s agentless, in‑cloud scanners rather than shipping PDFs out to a third‑party service. Our parser framework is designed around streaming and format‑aware readers, which means:

  • Files are processed as streams, not as long‑lived replicas.
  • PDF contents are analyzed in memory by the scanner, avoiding new long‑term copies in external systems.
  • The same engine powers analysis across databases, object storage, file systems, and SaaS sources.

The net effect is that Sentra reduces your blind spots around PDFs without turning the security solution itself into a new source of data exposure.

Regulatory Reality – PDFs Are Always in Scope

From a regulatory standpoint, PDFs are undeniably in scope. Frameworks and regulations such as:

  • GDPR for data subject rights, record‑keeping, and deletion
  • HIPAA for PHI in healthcare organizations
  • PCI DSS for cardholder data stored in receipts, statements, and chargeback files
  • SOX and other financial reporting controls

do not distinguish between data in databases and data in documents. A stack of PDFs in cloud storage, email archives, or shared drives counts just as much as a customer table in a production database when regulators and auditors review your posture. If your data security strategy covers only structured data and a narrow slice of text documents, you are leaving a disproportionate share of your most sensitive content unprotected.

Bringing PDFs into Your DSPM Strategy

PDFs are not going away. Digital‑first operations guarantee we will see more of them every year, not fewer. That makes them a natural priority for any serious Data Security Posture Management (DSPM) program.

Sentra’s PDF scanning is designed to make PDFs a first‑class citizen in your data security strategy:

  • Native text and scanned PDFs both receive full, ML‑powered inspection.
  • Tables and forms are treated as structured data for higher‑fidelity classification.
  • Metadata and unreadable encrypted PDFs are surfaced instead of ignored.
  • Everything runs inside your cloud, alongside support for 100+ other file formats.

You can explore how we extend the same approach across the rest of your data estate, or see it in action by requesting a demo.

<blogcta-big>

Read More
Nikki Ralston
Nikki Ralston
David Stuart
David Stuart
March 10, 2026
4
Min Read

How to Protect Sensitive Data in AWS

How to Protect Sensitive Data in AWS

Storing and processing sensitive data in the cloud introduces real risks, misconfigured buckets, over-permissive IAM roles, unencrypted databases, and logs that inadvertently capture PII. As cloud environments grow more complex in 2026, knowing how to protect sensitive data in AWS is a foundational requirement for any organization operating at scale. This guide breaks down the key AWS services, encryption strategies, and operational controls you need to build a layered defense around your most critical data assets.

How to Protect Sensitive Data in AWS (With Practical Examples)

Effective protection requires a layered, lifecycle-aware strategy. Here are the core controls to implement:

Field-Level and End-to-End Encryption

Rather than encrypting all data uniformly, use field-level encryption to target only sensitive fields, Social Security numbers, credit card details, while leaving non-sensitive data in plaintext. A practical approach: deploy Amazon CloudFront with a Lambda@Edge function that intercepts origin requests and encrypts designated JSON fields using RSA. AWS KMS manages the underlying keys, ensuring private keys stay secure and decryption is restricted to authorized services.

Encryption at Rest and in Transit

Enable default encryption on all storage assets, S3 buckets, EBS volumes, RDS databases. Use customer-managed keys (CMKs) in AWS KMS for granular control over key rotation and access policies. Enforce TLS across all service endpoints. Place databases in private subnets and restrict access through security groups, network ACLs, and VPC endpoints.

Strict IAM and Access Controls

Apply least privilege across all IAM roles. Use AWS IAM Access Analyzer to audit permissions and identify overly broad access. Where appropriate, integrate the AWS Encryption SDK with KMS for client-side encryption before data reaches any storage service.

Automated Compliance Enforcement

Use CloudFormation or Systems Manager to enforce encryption and access policies consistently. Centralize logging through CloudTrail and route findings to AWS Security Hub. This reduces the risk of shadow data and configuration drift that often leads to exposure.

What Is AWS Macie and How Does It Help Protect Sensitive Data?

AWS Macie is a managed security service that uses machine learning and pattern matching to discover, classify, and monitor sensitive data in Amazon S3. It continuously evaluates objects across your S3 inventory, detecting PII, financial data, PHI, and other regulated content without manual configuration per bucket.

Key capabilities:

  • Generates findings with sensitivity scores and contextual labels for risk-based prioritization
  • Integrates with AWS Security Hub and Amazon EventBridge for automated response workflows
  • Can trigger Lambda functions to restrict public access the moment sensitive data is detected
  • Provides continuous, auditable evidence of data discovery for GDPR, HIPAA, and PCI-DSS compliance

Understanding what sensitive data exposure looks like is the first step toward preventing it. Classifying data by sensitivity level lets you apply proportionate controls and limit blast radius if a breach occurs.

AWS Macie Pricing Breakdown

Macie offers a 30-day free trial covering up to 150 GB of automated discovery and bucket inventory. After that:

Component Cost
S3 bucket monitoring $0.10 per bucket/month (prorated daily), up to 10,000 buckets
Automated discovery $0.01 per 100,000 S3 objects/month + $1 per GB inspected beyond the first 1 GB
Targeted discovery jobs $1 per GB inspected; standard S3 GET/LIST request costs apply separately

For large environments, scope automated discovery to your highest-risk buckets first and use targeted jobs for periodic deep scans of lower-priority storage. This balances coverage with cost efficiency.

What Is AWS GuardDuty and How Does It Enhance Data Protection?

AWS GuardDuty is a managed threat detection service that continuously monitors CloudTrail events, VPC flow logs, and DNS logs. It uses machine learning, anomaly detection, and integrated threat intelligence to surface indicators of compromise.

What GuardDuty detects:

  • Unusual API calls and atypical S3 access patterns
  • Abnormal data exfiltration attempts
  • Compromised credentials
  • Multi-stage attack sequences correlated from isolated events

Findings and underlying log data are encrypted at rest using KMS and in transit via HTTPS. GuardDuty findings route to Security Hub or EventBridge for automated remediation, making it a key component of real-time data protection.

Using CloudWatch Data Protection Policies to Safeguard Sensitive Information

Applications frequently log more than intended, request payloads, error messages, and debug output can all contain sensitive data. CloudWatch Logs data protection policies automatically detect and mask sensitive information as log events are ingested, before storage.

How to Configure a Policy

  • Create a JSON-formatted data protection policy for a specific log group or at the account level
  • Specify data types to protect using over 100 managed data identifiers (SSNs, credit cards, emails, PHI)
  • The policy applies pattern matching and ML in real time to audit or mask detected data

Important Operational Considerations

  • Only users with the logs:Unmask IAM permission can view unmasked data
  • Encrypt log groups containing sensitive data using AWS KMS for an additional layer
  • Masking only applies to data ingested after a policy is active, existing log data remains unmasked
  • Set up alarms on the LogEventsWithFindings metric and route findings to S3 or Kinesis Data Firehose for audit trails

Implement data protection policies at the point of log group creation rather than retroactively, this is the single most common mistake teams make with CloudWatch masking.

How Sentra Extends AWS Data Protection with Full Visibility

Native AWS tools like Macie, GuardDuty, and CloudWatch provide strong point-in-time controls, but they don't give you a unified view of how sensitive data moves across accounts, services, and regions. This is where minimizing your data attack surface requires a purpose-built platform.

What Sentra adds:

  • Discovers and governs sensitive data at petabyte scale inside your own environment, data never leaves your control
  • Maps how sensitive data moves across AWS services and identifies shadow and redundant/obsolete/trivial (ROT) data
  • Enforces data-driven guardrails to prevent unauthorized AI access
  • Typically reduces cloud storage costs by ~20% by eliminating data sprawl

Knowing how to protect sensitive data in AWS means combining the right services, KMS for key management, Macie for S3 discovery, GuardDuty for threat detection, CloudWatch policies for log masking, with consistent access controls, encryption at every layer, and continuous monitoring. No single tool is sufficient. The organizations that get this right treat data protection as an ongoing operational discipline: audit IAM policies regularly, enforce encryption by default, classify data before it proliferates, and ensure your logging pipeline never exposes what it was meant to record.

<blogcta-big>

Read More
Expert Data Security Insights Straight to Your Inbox
What Should I Do Now:
1

Get the latest GigaOm DSPM Radar report - see why Sentra was named a Leader and Fast Mover in data security. Download now and stay ahead on securing sensitive data.

2

Sign up for a demo and learn how Sentra’s data security platform can uncover hidden risks, simplify compliance, and safeguard your sensitive data.

3

Follow us on LinkedIn, X (Twitter), and YouTube for actionable expert insights on how to strengthen your data security, build a successful DSPM program, and more!

Before you go...

Get the Gartner Customers' Choice for DSPM Report

Read why 98% of users recommend Sentra.

White Gartner Peer Insights Customers' Choice 2025 badge with laurel leaves inside a speech bubble.