> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/key-features.md). # Key features Cortex Data Security unifies posture management and detection and response on a single data layer, driven by one classification engine and one policy model. The following are the key features of the platform, grouped by capability. ## AI-powered data discovery and classification Stay on top of your sensitive data across every environment with secure scanning and automated classification: * **Broadest coverage:** Carry out automated discovery across cloud, on-premises, SaaS, DBaaS, code repositories, and endpoints (via direct API or the Broker VM), while residency and sovereignty are preserved during scanning. * **Advanced classification engine:** Use hundreds of out-of-the-box classifiers for structured, semi-structured, and unstructured data, plus a fully customizable engine that goes beyond regex with LLM-powered classification, Optical Character Recognition (OCR) for images and PDFs, and integration with common labeling frameworks such as Microsoft Information Protection (MIP). * **Uniform inventory:** Build a single data inventory and catalog for data stores, databases, and files across all environments, with AI-augmented visibility from the Cortex dashboard. ## Data Security Posture Management (DSPM), risk, and compliance Continuously assess data risk and compliance posture across every environment: * **Uniform data risk assessment:** Assess data risk across all environments and all major data security domains—access, configuration, residency, and hygiene (redundant, obsolete, and trivial data, or ROT). * **Automated compliance assessment and monitoring:** Assess and monitor key data and AI regulatory standards, such as SOC 2, GDPR, PCI, and NIST. * **Customizable data governance:** Govern organization-specific data policies and AI application guardrails with a fully customizable governance engine. ## AI Security Posture Management (AI-SPM) Gain visibility into the data that powers your AI pipelines and control the associated risk: * **Pipeline mapping:** Uncover the key components of AI systems—models, agents, endpoints, training datasets, and inference data—and the flow of data between them. * **Risk monitoring:** Monitor and govern sensitive data exposure, poisoning risk, privacy violations, and security breaches across the AI life cycle. * **Standards alignment:** Prioritize risks across AI pipelines, infrastructure, and supply chains, measured against standards such as the EU AI Act. ## Data Access Governance (DAG) Rightsize permissions for every identity before overexposure becomes a breach: * **Access auditing:** Track who and what accesses sensitive data—humans, service accounts, third parties, and AI agents. * **Least-privilege enforcement:** Identify and revoke unused permissions to regulated environments. * **AI-aware control:** Govern enterprise AI tool access (such as Microsoft Copilot) with granular, data-aware policies to enable safe AI adoption. ## Data Detection and Response (DDR) Detect and respond to data threats in real time with full classification context: * **Behavioral baselining:** Establish normal patterns for every human and non-human identity, then surface deviations across cloud, SaaS, browser, and agentic AI activity. * **Contextual alerts:** Generate alerts that include what was accessed, how sensitive it is, and who owns it, reducing false positives and accelerating triage. * **Threat coverage:** Detect unauthorized, malicious, and risky data activity such as mass downloads, risky data sharing, and ransomware, and reduce MTTD and MTTR with AI and automation. * **Audit and retention:** Comply with strict data regulations through audit and retention capabilities. ## Data Loss Prevention (DLP) Prevent sensitive data from leaving your organization: To enforce DLP policies directly on user endpoints (such as blocking unauthorized data transfers or browser-based exfiltration), you need the Cortex agent, which requires a base product like Enterprise Runtime Security ([Cortex XDR](/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/readme-1.md)) to deploy. You must also purchase the Endpoint DLP add-on license. Once this license is applied and policies are configured in your console, the Cortex agent will automatically download and activate the [Cortex Data Loss Prevention (DLP) module](/cortex-cloud-runtime-security/endpoint-security/endpoint-dlp/cortex-data-loss-prevention-dlp-module-overview.md) to enforce your data security rules directly on the device. ## Agentic operations and automated remediation Investigate, prioritize, and resolve data security issues at machine speed: * **Automated prioritization:** Evaluate sensitivity, access patterns, usage, and exposure to surface the most critical issues first. * **Orchestrated remediation:** Run data-specific remediation workflows—including access restriction, labeling, masking, encryption enforcement, and retention fixes—via Cortex XSOAR and Cortex AgentiX. * **Broad ecosystem:** Integrate with your enterprise workflow stack across IT, security, cloud, and DevOps tools through an extensive library of pre-built integrations and a no-code automation and playbook builder. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/key-features.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.