Skip to content

Challenging Convention: Ediscovery Software Shouldn't Be Used for Data Breach Response

Canopy Team January 21, 2020
Person trying to fit a square block into a round hole


Data privacy regulations are growing in number and complexity, but one thing remains the same through this evolution: the time constraints are severe. That’s just one of the many reasons we caution clients against using unspecialized software tools when responding to a data breach.

In the past few years, during a surge in business email compromises and other corporate cyber incidents, too many enterprises and service providers have attempted to get more mileage from their investments in ediscovery review platforms by using them to identify the people affected by a corporate breach. That’s the epitome of jamming a square peg into a round hole.

Since ediscovery software is built for an entirely different purpose, we find those projects result in far greater costs because of the complications arising from using the wrong tool for the job. While the goal may have been to increase ROI on the existing tech resources, the approach often backfires.


Divergent Purposes

As commonly portrayed in the litigation market, ediscovery software is leveraged over the course of several months to “separate the wheat from the chaff” — leaving the legal team with only the most relevant evidence in a case.

Quite conversely, following a data breach, there is no wheat or chaff — or months to spare. There’s just a massive dataset with millions of fragments of sensitive information spread across countless files. Within a matter of days, the response team needs to find every fragment, classify them by type, determine the relationships among them, and specify exactly which people were affected by the breach.

When ediscovery software is applied to this use-case, the result is significant cost overruns, staff burnout, questionable accuracy, and perhaps even noncompliance because of missed deadlines.


The Right Tool for the Job

Unlike ediscovery review platforms, Canopy is specifically designed to solve the problems that arise when identifying and making sense of PII, PHI, and other protected data or sensitive information. Drawing upon deep backgrounds in the ediscovery software and services market, our team conceptualized Canopy after witnessing the limitations of using ediscovery technology to respond to breach incidents. Knowing that a purpose-built application would accelerate the identification of the actual people who are affected by data breaches, we officially launched CanopyCo in 2018.


Challenging Convention

Canopy approaches the data breach response field in a unique way. Pairing our significant experience in the eDiscovery market with our tendency to challenge convention results in a revolutionary way to handle the task at hand with precision and speed. This unique, purpose-built and machine-learning approach has helped Canopy to become a disrupter in the evolving data breach discovery and data privacy space.

You can visit our Data Breach Response webpage to learn more about how Canopy Software accelerates breached data assessment and dramatically reduces the volume of false-positive hits earmarked for human review.


It’s a New Year; Turn Over a New Leaf

Let us prove to you that our purpose-built software outperforms ediscovery review software during a data breach response. We’ll use breached data from your client project to demonstrate how Canopy accelerates breach review and dramatically reduces false positives. Your free report will reveal the composition of your 5 GB sample dataset, including:

  • The breakdown of sensitive documents
  • The locations of PII, PHI, PIPEDA, FERPA, PCI, CCPA, HIPAA and GDPR data in the population
  • An initial gauge of the severity of a suspected breach
  • Metrics to define the scope and budget for the subsequent human review