Excavate
Live demo
Use cases

What coverage
is used for.

The same preserved record answers all five. None of them needs its own project, its own budget line or its own approval.

01

Departing employees

Theft climbs for months before anyone resigns and spikes in the hours after they decide to. By the time the notice reaches you, most of it has happened.

Who it is for

Security or legal at a company whose value sits partly in what its people know: the customer list, the pricing logic, the model weights, the playbook.

Why it gets missed today

The trigger today is the resignation email, which arrives after the copying is finished. DLP fires on one bulk export and stays quiet through three weeks of ordinary-looking downloads. By the time you look, the laptop has been wiped and reissued, the mailbox is purged and the logs have rolled.

What you get

An exit review on every departure, opened by the resignation and concluded in writing before the last day. Most conclude with nothing of concern. The rest name the files, trace where they went, and carry an examiner’s signature.

02

IP and trade secret theft

The harder case is the person who is not leaving. Legitimate access, normal-looking behaviour, and activity that serves someone else.

Who it is for

Security at a company where engineers, researchers or commercial staff hold broad access by design, and where almost all of them use it exactly as intended.

Why it gets missed today

There is no single event to catch. A repository cloned the week a side company was registered, a customer export with no deal attached, compute funding personal work. None of it breaks a policy, so nothing fires. The pattern only exists if something kept the whole record while it formed.

What you get

A conclusion built from the sequence rather than one event: what was taken, over what period, to where, and how that compares with what the person was meant to be doing. Written to be handed to counsel.

03

AI and agent usage

Source code, customer records and unreleased work go into assistants and agents every day, by people trying to work faster. It does not look like exfiltration.

Who it is for

Anyone covering a company where AI tools arrived faster than the policy, and where the honest answer to what has been put into them is that nobody knows.

Why it gets missed today

The traffic is encrypted, the destination is sanctioned, and an employee doing legitimate work started it. Network tools see an allowed domain. DLP sees a paste. Neither can say whether what went in was a lunch order or the pricing model, or who is doing it repeatedly.

What you get

Per-person AI usage on the record alongside everything else: which assistants, by whom, how often, and what class of material went with it. Tracked in the readiness assessment rather than discovered during an incident.

04

Accidental exposure

Not every loss is deliberate. A folder shared with anyone who has the link, a forwarding rule set up years ago, a document that outlived its project.

Who it is for

Whoever gets asked, on the day it surfaces, exactly what was in it and exactly who reached it. Usually by a regulator, an insurer or a customer’s security team, with a clock running.

Why it gets missed today

The console that created the exposure can tell you it exists today. It cannot tell you when it opened, who reached it while it was open, or what was inside at the time. That is the scoping question, and it decides whether this becomes a notification.

What you get

A written scope: what was exposed, from when to when, who accessed it in that window, and what it contained. Produced from a record that already existed rather than reconstructed under deadline.

05

Investigations and legal holds

A grievance, a dispute, a preservation notice, a board asking how far it went. Each arrives as a demand for evidence about a period that has already closed.

Who it is for

Anyone who has to answer outside their own team: counsel, a works council, an insurer, a regulator or a court.

Why it gets missed today

Preservation that starts when the notice arrives has started too late. Reconstructing from what survived is slow, expensive and arguable, and every gap becomes a point the other side gets to make.

What you get

A record that was immutable from the day it started, chain of custody from intake to disposition, holds honoured until counsel releases them, and every access logged against a stated purpose, including your own team’s.

Tell us which one you are worried about.

Bring the systems you run and we will tell you what coverage would have caught.

Explore the live portal
The sources coverage reads →