Controlling sensitive data is a continuing challenge for enterprises. Hackers are responsible for more than their fair share of data leaks, but accidental disclosure by employees of things like social security numbers and banking details is also significant: folders get shared with too many people, e-mail addresses are fat-fingered to inadvertently include people outside the organization, and so on. The use of cloud-based apps like Salesforce, Google Apps, and DocuSign makes control of data even more complex, as even on-premises data can be inadvertently placed online. This isn't always done with the IT department's knowledge or oversight, as users turn to useful services to help them do their jobs without involving IT.

Mountain View-based startup Egnyte is hoping to offer a solution with its new Egnyte Protect service. It provides access control and will soon enable selective encryption and control over data residency and retention, spanning both local storage and common cloud services. Protect uses features of the files—things like "created by the finance department" or "contains a social security number"—to apply rules to them. For example, any files containing social security numbers can be blocked from public sharing, or any file with financial data must be encrypted.

Egnyte Protect is a software-as-a-service offering, using cloud-provided compute resources to continuously classify and analyze documents and file activity. Rules are a mix of IT-configured manual policies and automated rules from large-scale data analytics. These rules can be somewhat flexible; for example, sending an administrative alert only on the second attempt to share private data (so that accidental clicks don't necessarily cause an escalation and intervention). The rules are applied regardless of whether files reside on premises or in the cloud and are used both for local applications and online ones.

Egnyte claims that this SaaS approach gives the company a leg-up over existing data loss prevention software, which tends to focus on local data and local scanning. The company says that using the cloud gives it greater power for analytics, enabling it to detect behavior patterns that are anomalous or unusual, bringing big data heuristics to the world of data protection. The SaaS approach also means that the company's system can protect even cloud data accessed through cloud services, something that may be invisible to on-premises software.

Perhaps most interestingly, Egnyte says that the system can also detect the behavior of cryptolocker ransomware. The access patterns that this type of ransomware shows is unlike any normal access—it systematically overwrites data files with their encrypted versions. Protect can trap this kind of access and block it, ending the contagion. With ransomware an increasingly big business, this kind of protection is a smart capability. Similarly, Snowden-esque data dumps, where again one user accesses many files sequentially, can be detected and blocked.

Protect joins Egnyte's existing file sync and sharing product, now named Connect. Connect has given the company insight into which data usage patterns are normal or abnormal, and this information is used to drive Protect's rules. The company sells exclusively to enterprises—it's a pure paid product, without any freemium model. This means that unlike companies such as Box and Dropbox, which offer free pricing tiers and try to upsell, all of Engyte's customers are paying. The company says that it will be cashflow positive this year.