Insider threat protection
Trusted access is still access. PostAuth keeps encryption and policy attached to the file, so what an insider takes stays unreadable — and can be revoked after it has already left.
of data breaches trace back to an insider — negligent or deliberate.
average spend to contain a single insider incident.
of exiting employees take sensitive company data with them.
THE GAP / WHY THE STACK MISSES IT
Trusted people need access to do their jobs. The gap opens when permission to access a file becomes permanent permission to use it.
Legacy tooling cannot track who opened what, when — so suspicious activity surfaces long after the fact.
Broad role-based access grants the folder and stops there. Nothing governs what happens to the file next.
Rights accrue with every project and rarely get revoked, widening the surface one grant at a time.
Personal laptops and untrusted networks sit outside device-based controls but inside the data.
At-rest and in-transit encryption dissolves on authentication. Inside the network, the file is plaintext.
Disabled accounts leave synced, downloaded and shared copies fully readable.
Pick what the insider does. Then toggle the data layer. The action always succeeds — only the outcome changes.
HOW PADS CLOSES IT
Put a policy check between trusted access and readable data. Protection follows the file, and every request has to meet your rules.
The copy moves.
The policy moves with it.
Decryption requires an authorized request.
Open in a familiar application.
Possession doesn’t grant access.
Encryption stays attached to the file across storage, devices, and collaborators.
FIPS 140-2 compliant AES-256 applied at creation, carried wherever the file travels.
Decryption keys stay in a Hardware Security Module and are issued per authorised request.
Protection is a property of the file, so an unmanaged laptop changes nothing about it.
A valid login starts the conversation. Context and policy determine file access.
Enforce on AD group, IP allow-list, geo-location and device identity at the point of access.
Files stay encrypted until PostAuth approves the request — which retires privilege creep.
Removing a user in your IdP removes their ability to open every encrypted file.
Revoke access as relationships change and bring file activity into your security workflow.
Access ends when employment ends, including on copies already outside the estate.
Send encrypted files externally and revoke access dynamically at any point afterwards.
Real-time file-access logs stream into existing tooling for anomaly detection and automated response.
THE EMPLOYEE LIFECYCLE
From the first day to the final handover, keep file access aligned with the relationship.
Policy attaches to files, not to a folder grant that nobody will revisit.
People open protected files in the apps they already use, on any approved device.
Context re-evaluates on every request, so a team change is enforced at the file.
IdP removal cuts key authorisation instantly — synced and shared copies included.
Offboarding should reach the files.
Including the copies that have already left.
Still specific to your estate? A 30-minute working session covers it faster than a doc.
It removes the assumption that access equals readability. Files stay encrypted with AES-256 and require an authorised request — evaluated against identity, device, network and policy — before decryption. A copied or exported file without that authorisation is ciphertext.
Yes. Every open, deny and share generates an audit event streamed to your SIEM, giving behavioural analytics and investigation a file-level record rather than a login-level one.
Deprovisioning in your SAML 2.0 identity provider revokes key authorisation immediately. Files they downloaded, synced or shared stop opening — there is no residual window to manage.
No. Network position grants nothing. Decryption keys live in an HSM and are released only for requests that satisfy policy, so lateral movement does not produce readable data.
Disk and transport encryption protect data at rest and in motion, then hand over plaintext once a session is authenticated. File-level protection persists through the authenticated session and travels with the file across systems and organisations.
Protected files open in their native applications with normal performance. Encryption and policy evaluation happen in the background; for the person doing the work, the file behaves like any other file.
Map one sensitive file's journey — creation, sharing, offboarding — and see exactly where persistent encryption changes the outcome.