Rick Orloff, Chief Information Security Officer (CISO) at Everpure, opened Cybersecurity Awareness Month with a hard truth: awareness isn’t enough anymore. Attackers move at machine speed, and the real question is how fast you recover, not whether you get hit. I want to build on that from the angle my team works on every day: the data itself, and what you actually know about it before protection or recovery kicks in.
Every resilience decision, from what to lock down to what to restore first, is only as good as the context behind the data it touches. Skip that step, and you’re not being resilient. You’re guessing.
Blind decisions don’t scale
Most storage and security tools still treat data as a uniform blob: back it up, replicate it, maybe encrypt it, done. That works until an incident hits, and you need answers fast. Is this dataset regulated? Who and what touches it? Does it feed a revenue-critical process or a dev sandbox nobody has opened in a year? Did someone clone production customer data into a test environment?
The frameworks already expect us to know. NIST CSF 2.0 suggests organizations to maintain inventories of data and its metadata (ID.AM-07) and to prioritize assets by classification, criticality, and business impact (ID.AM-05). Very few enterprises can do that at the level that matters, especially across unstructured content, SaaS, and mainframe, where most of the meaning, and most of the risk, actually lives.
Contextual Visibility is start of the journey, Semantic Context is the navigator
Traditional metadata tools answer storage questions: Where is the file? Who modified it? What schema does the table have? Useful, but they don’t tell a security team or an AI system what the data means. Resilience and AI both need different answers: What business entity is this about? What else is it connected to? Which obligations follow it? Can it be used safely, for this purpose, right now?
That’s the gap data intelligence closes. Everpure Data Intelligence discovers data across cloud, SaaS, on-premises, mainframe and data in motion; classifies PII, PHI, PCI, secrets and intellectual property (98.6% accuracy at the data-element level in third-party testing by the Tolly Group); and then contextualizes every asset with three layers: risk (sensitivity, exposure, who can reach it), regulation (GDPR, HIPAA, PCI DSS, CCPA and residency) and business context (ownership, usage, meaning and relationships).
Just as important, that context is active, not passive. A catalog that’s curated once and left alone goes stale the day after an audit. Active metadata is recomputed continuously as data changes, gets copied or moves, so the picture your security and recovery tools rely on reflects today’s estate, not last quarter’s. Classification tells you what data is. Context tells you what to do about it.
Context lives at the entity and data level, not the file
Most tools stop at the asset: file, folder, table. Attackers and regulators don’t think that way. They think in terms of customers, patients, accounts, and contracts. So we build context at the entity level, in a semantic knowledge graph. CustomerID 123 in a CRM table, “J. Doe” in a PDF contract and john.doe@example.com in an email archive are resolved into one canonical Customer entity using shared identifiers, probabilistic attribute matching, co-occurrence evidence and ontology rules. Each entity carries its own governance context:
Customer:CUST001 is_PII = true governed_by = [GDPR, CCPA] residency = USA
source_of_truth = CRM_v3 last_verified = 2026-09-15
CUST001 —[MADE_PURCHASE]→ TXN456 —[INCLUDES]→ PROD_XYZ
Relationships are extracted from unstructured content too. A call transcript or clinical note becomes edges like Physician→TREATED→Patient, linking dark unstructured data to the systems of record. For resilience, this changes the most stressful question in any incident: not “how many files were touched?” but “how many real people, accounts, and obligations are affected?” In one deployment, entity resolution collapsed 180 million customer records into 30 million real identities, an 83% reduction. That’s the difference between an accurate breach scope and an inflated, slow one.
AI agents raise the stakes
Machine identities now outnumber human ones by roughly 109 to 1 (Palo Alto Networks’ 2026 Identity Security Landscape report). Every agent, copilot, and workflow carries credentials and makes access decisions thousands of times a day with no person watching. IBM’s 2026 Cost of a Data Breach report found that 92% of organizations with an AI-related breach lacked proper AI access controls, and 68% of breached organizations lacked governance to manage AI or detect shadow AI. Breaches involving shadow AI averaged USD 5.39 million, roughly USD 400,000 above the global average.
You can’t set a meaningful guardrail for an agent if you don’t know what the data underneath it is. With entity-level context, policy can evaluate not just who is asking, but why, what (entity type and sensitivity), where (residency), and how the data will be used downstream. That makes purpose-aware rules possible, such as “customer PII is allowed for fraud-model retraining, not for marketing fine-tuning.” It also enables dynamic masking of sensitive properties, blocking cross-border joins, and keeping agents inside an approved data neighborhood instead of letting them silently expand scope. Every access writes lineage back to the graph, so each AI answer or autonomous action can be explained after the fact.
What context changes for resilience
Everpure is extending cyber resilience across three pillars this October: built-in security, connected detection, and dynamic response and recovery. Context makes each of them sharper.
- Secure-by-design gets sharper. Immutability, retention, encryption, and replication policies follow the sensitivity and criticality of the data, not just the volume it sits on.
- The attack surface shrinks first. Context exposes toxic combinations: over-permissioned access to sensitive data, production data in non-production, redundant copies of crown jewels, and sensitive files flowing to third parties. Data that’s remediated can’t be stolen or encrypted.
- Detection gets connected. Sensitivity and business context flow into SIEM and SOAR, so an anomaly on a store of regulated customer data outranks the same anomaly on a scratch volume. The SOC gets a ranked action list, not more noise.
- Recovery and response get prioritized. Business-aware context decides what comes back first and scopes the blast radius by entity, which matters when GDPR gives you 72 hours to notify a supervisory authority and the SEC expects a material-incident filing within four business days.
This is the through-line Rick called out. Reducing the likelihood of disruption and reducing its impact are two outcomes of the same context-aware approach.
AI governance is the same problem, one layer up
As Gartner puts it, AI-ready data “is not something you can build once and be done.” Readiness depends on the use case, so it has to be judged continuously, in context. NIST’s AI Risk Management Framework and the EU AI Act’s data governance requirements (Article 10) both assume you can show what data trains, tunes, and grounds a model, and whether you’re allowed to use it. The same context answers three questions: Responsible AI (is this data appropriate and complete?), AI governance and controls (can we control and prove what feeds models and agents?), and AI sovereignty (are residency and ownership rules being honored?). Data that’s owned, understood, and policy-aligned can confidently feed RAG and agents; data with unmanaged PII, secrets, or residency conflicts gets surfaced for remediation first.
What this looks like in practice
Everpure Data Intelligence already runs at more than 50 Global 1000 enterprises, managing 1.7 billion entities across 200 PB. A national payment processor found 91 million card records sitting unprotected and closed the gap. A Global 100 card and payments leader scanned 14,500 databases in under two weeks and cut data subject request response from days to minutes. In each case, the win came from context, not just coverage.
Awareness starts the cybersecurity awareness month conversation. Context finishes it.
Cybersecurity Awareness Month is a good moment to ask three questions about your data: What is it, really — the customer, the account, the record? Who depends on it — people, agents, systems?
What breaks, and who do you call, if it’s gone? What breaks, and who must you notify, if it disappears or leaks? If you can’t answer those today, your recovery plan is a hypothesis, not a plan.
That gap, between “we have backups” and “we know what our data means and what to protect, govern, and restore first,” is where organizations get caught during a real incident. Closing it isn’t a future roadmap item for us. Data intelligence is shipping into the Everpure platform now, and in the weeks ahead we’ll share more on how that context gets built, connected to storage and security, and put to work across protection, detection, and recovery.
