EXPOSURE.

24 columns flagged across 11 unstructured stores. 6 contain raw SSN or PAN in plaintext. 2 production logs are leaking email + IP every request.

PII you didn't catalog is PII you'll discover during a breach.

PI-018 · access-logs (s3://prod-logs/) PLAINTEXT

Email + IP + user-agent persisted unredacted, 90-day retention.

Redact-at-source, rotate retention to 14d, expire archives.