GITNUXSOFTWARE ADVICE
Cybersecurity Information SecurityTop 10 Best GDPR Data Discovery Software of 2026
Ranked roundup of gdpr data discovery software tools, comparing BigID, Microsoft Purview, and Google DLP with Osano, TrustArc, and SAS.
How we ranked these tools
Core product claims cross-referenced against official documentation, changelogs, and independent technical reviews.
Analyzed video reviews and hundreds of written evaluations to capture real-world user experiences with each tool.
AI persona simulations modeled how different user types would experience each tool across common use cases and workflows.
Final rankings reviewed and approved by our editorial team with authority to override AI-generated scores based on domain expertise.
Score: Features 40% · Ease 30% · Value 30%
Gitnux may earn a commission through links on this page — this does not influence rankings. Editorial policy
Osano is the best fit overall if your privacy team needs repeatable GDPR-ready evidence for personal data mapping across mixed sources, while TrustArc Data Discovery suits larger governance programs turning discovery into decisions and SAS Data Management is the better pick when you must anchor repeatable discovery to SAS metadata and lineage.
Editor’s top 3 picks
Three quick recommendations before you dive into the full comparison below — each one leads on a different dimension.
Osano
Recurring scan scheduling with finding grouping for investigation workflows and evidence exports.
Built for fits when privacy teams need repeatable personal data discovery evidence across mixed sources..
TrustArc Data Discovery
Editor pickGDPR-focused governance workflow integration that routes scan findings into compliance evidence and remediation handling steps.
Built for fits when privacy teams need GDPR-aligned discovery outputs feeding governance decisions across many data sources..
SAS Data Management
Editor pickSAS metadata-driven discovery that ties sensitive identification outputs into governed catalog and stewardship workflows.
Built for fits when governance teams need repeatable discovery tied to SAS metadata, lineage, and controlled access patterns..
Related reading
Comparison Table
Osano
SMBPrivacy management software with data mapping and vendor visibility for compliance programs.
Recurring scan scheduling with finding grouping for investigation workflows and evidence exports.
Osano’s data discovery works across unstructured and structured sources, then clusters results into actionable items for classification and risk triage. The workflow supports automated discovery cycles so teams can rerun scans when systems change and track whether sensitive data reappears. A governance layer gates who can view findings and who can export evidence for internal review and downstream processes.
A practical tradeoff is that coverage depth depends on connector setup for each data source and on tuning detection to reduce noise. Osano fits best when a security or privacy team needs repeatable evidence collection across mixed storage types, not just one-time investigations.
- +Automated discovery cycles for repeated evidence collection
- +Role-based access controls for investigation and exports
- +Structured and unstructured scanning with grouped findings
- +Audit trail captures investigator actions for review
- –Connector coverage requires setup per data source
- –High-precision results need tuning to control false positives
- –Remediation workflows require integration with existing processes
- –Large environments can produce high volumes of alerts
Privacy operations teams
Run recurring GDPR discovery evidence scans
Faster evidence preparation
Security engineering teams
Triage sensitive findings across endpoints
Lower manual investigation time
Show 2 more scenarios
Compliance program managers
Govern access and review actions
Better internal accountability
Osano applies RBAC and keeps audit logs for who viewed, exported, or acted on findings.
Data governance leads
Support data mapping readiness
More complete data inventory
Osano outputs location-focused evidence that can feed downstream mapping and data flow documentation.
Best for: Fits when privacy teams need repeatable personal data discovery evidence across mixed sources.
More related reading
TrustArc Data Discovery
enterprisePrivacy platform capability for identifying, classifying, and mapping personal data.
GDPR-focused governance workflow integration that routes scan findings into compliance evidence and remediation handling steps.
Data Discovery is designed for privacy and compliance teams that need faster personal data inventory refresh cycles across heterogeneous storage, not just one-off scans. It supports automated discovery runs and produces inventory outputs that can feed governance processes tied to GDPR obligations. Integration depth is anchored in connector coverage for typical enterprise environments and the ability to route findings into governance workflows. The admin surface includes configuration options for discovery scope and governance reporting that keep discovery results consistent across teams.
A key tradeoff is that getting high precision depends on tuning detection rules and managing source coverage, especially when sensitive patterns appear in free-form text. It fits best when organizations already run GDPR governance workflows and need discovery outputs that can connect to downstream handling decisions. Teams should plan for ongoing configuration maintenance as data sources and file formats change.
- +GDPR-oriented workflow outputs align discovery results with compliance governance needs
- +Automation supports repeatable discovery cycles across multiple data sources
- +Configurable scanning scope reduces noise when data volumes are large
- +Inventory reporting supports evidence gathering for ongoing privacy reviews
- –Precision depends on detection tuning for unstructured content sources
- –Connector coverage may require validation for niche data stores
- –Governance configuration takes time when many business units share sources
- –Large estates can require careful throughput planning for scheduled scans
Privacy operations teams
Maintain personal data inventory updates
More current personal data inventory
Risk and compliance analysts
Prioritize remediation by sensitivity
Faster risk-based remediation
Show 2 more scenarios
Security engineering teams
Track sensitive content across repositories
Reduced exposure of sensitive data
Repeated scans surface sensitive content patterns across structured and unstructured repositories.
Data governance program owners
Standardize discovery across units
Consistent governance evidence
Discovery scope configuration enforces consistent coverage and reporting outputs for shared sources.
Best for: Fits when privacy teams need GDPR-aligned discovery outputs feeding governance decisions across many data sources.
SAS Data Management
enterpriseData management platform with data quality, cataloging, and sensitive data discovery capabilities.
SAS metadata-driven discovery that ties sensitive identification outputs into governed catalog and stewardship workflows.
SAS Data Management supports automated discovery that derives inventory signals from connected data sources and ingests metadata into a governed catalog layer. It includes data classification capabilities that can drive downstream actions for handling sensitive records, including exports of discovery findings for governance reporting. Administration features such as RBAC controls and audit log coverage make it suitable for organizations that require consistent stewardship across multiple business units. Integration depth favors environments already using SAS components and metadata services rather than stand-alone scanners.
A key tradeoff is operational complexity, since discovery accuracy depends on connector coverage, sampling choices, and repeatable configuration of scanning and classification rules. A practical fit is GDPR-driven records of processing activities preparation where data owners need repeatable identification of sensitive attributes across pipelines and curated datasets. Another fit is governance operations that already run data quality, lineage, and stewardship workflows and want discovery results to flow into those same processes.
- +Governance-aligned workflows integrate discovery outputs with SAS metadata
- +Classification results can feed consistent handling actions and reporting
- +Audit log and RBAC support controlled stewardship across teams
- +Connector-based discovery supports enterprise source coverage
- –Requires heavier setup and sustained configuration discipline
- –Unstructured scanning tuning can increase false positive review effort
- –Less suitable for ad hoc discovery without existing SAS governance
- –Automation and integrations may demand dedicated admin ownership
Data governance leads
Centralize sensitive data inventory outputs
Consistent inventory and handling decisions
Privacy operations teams
Support data mapping for GDPR workflows
Faster mapping for requests
Show 2 more scenarios
Platform data engineers
Automate discovery across data sources
Reduced manual inventory effort
Schedule connector-driven scanning and classification updates with controlled access.
Compliance audit owners
Produce auditable discovery evidence
Stronger operational audit evidence
Rely on audit log records and role controls for governed discovery activity trails.
Best for: Fits when governance teams need repeatable discovery tied to SAS metadata, lineage, and controlled access patterns.
BigID
enterpriseData discovery and classification software focused on privacy, security, and governance.
Policy-driven discovery results that connect sensitive data findings to governed evidence outputs for compliance workflows.
BigID focuses on GDPR-oriented data discovery that targets sensitive personal data across structured and unstructured locations. It automates scanning and classification with controls for tuning detections to manage false positive rate and operator review load.
Governance centers on how discovery outputs are configured and retained for audit evidence, rather than only exporting raw scan reports. Admin workflows for configuration and evidence collection are designed to support internal review and downstream remediation.
Integration is a key part of the product experience, with connectors and API capabilities used to push findings into external systems. This reduces manual translation between discovery outputs and records used in operational compliance workflows.
- +Discovery coverage spans database fields and unstructured file stores.
- +Classification logic can be tuned to lower false positive rate.
- +Audit-friendly evidence generation ties scans to governed policies.
- +API and connectors support operationalizing findings in workflows.
- –High-accuracy tuning requires ongoing configuration work.
- –Connector coverage may lag for niche platforms without add-on paths.
- –Large estates can need staged scanning to manage throughput.
- –RBAC controls need careful role mapping during rollout.
Best for: Fits when GDPR teams need automated discovery across data stores plus API-driven workflow integration.
OneTrust DataDiscovery
enterprisePrivacy platform module for locating and classifying personal data across enterprise systems.
DSAR workflow integration that turns scan findings into targeted search scope across data sources.
OneTrust DataDiscovery scans data across connected systems to surface personal data locations for GDPR workflows. The product focuses on automated PII detection, classification outputs, and linking discovered results to privacy governance processes.
It supports data subject access request workflows by helping teams connect data stores to data categories and records. It also emphasizes workflow configuration and administrative controls for managing scan scope, findings, and ongoing discovery operations.
- +Automated PII detection produces actionable personal data inventory outputs
- +Privacy workflow alignment supports GDPR tasks like access-request search
- +Configurable scan scope reduces noise in recurring discovery runs
- +Admin controls support governance over connectors and discovery settings
- –Connector coverage can lag behind specialist data discovery needs
- –Tuning accuracy may require iterative configuration to control false positives
- –Large estates can require careful scheduling to avoid scan delays
- –RBAC and audit log depth can require governance setup discipline
Best for: Fits when privacy teams need automated GDPR-ready locations and privacy workflows with controlled scan scope.
Securiti
enterpriseData intelligence platform with data discovery, classification, and privacy controls.
API-first integration that lets discovery results feed external data catalog and governance workflows with programmable updates.
Securiti supports GDPR data discovery through automated scanning, classification, and inventorying across enterprise data sources.
Its workflow centers on unstructured and structured content analysis to identify sensitive fields and persist findings as a personal data inventory that can feed downstream governance tasks.
The differentiator is Securiti’s extensible connector and API surface for integrating discoveries into existing catalogs, risk workflows, and access control processes.
Admin controls focus on scoping scans and managing how discovery results are grouped for audit support and remediation planning.
- +Connector-led discovery across mixed unstructured and structured repositories
- +Configurable classification rules reduce manual labeling work
- +API access supports automation of inventory updates and downstream actions
- +Admin scoping helps control scan coverage and data exposure
- –Tuning detection thresholds can take repeated iterations to manage false positives
- –Some advanced governance workflows depend on integration effort
- –Large estates can require careful job scheduling to protect scan throughput
- –Centralized reporting depends on consistent connector metadata quality
Best for: Fits when governance teams need automated inventorying from many data sources with API-driven workflows.
DataGrail
enterprisePrivacy management platform with system detection and personal data discovery for compliance operations.
Central inventory normalization that turns connector findings into a curated GDPR-ready view for remediation workflows.
DataGrail focuses on GDPR-oriented personal data discovery using built-in inventory and mapping workflows across many data stores. It combines connector-based scanning with normalization of findings into a central inventory view for audits and operational remediation.
Automation can keep discovery results current through recurring ingestion and scripted refresh patterns through its API. Administrative control concentrates around workspace permissions and traceability of changes so governance teams can review what was found and when.
- +Connector-first discovery that populates an operational personal data inventory view
- +Automation via API supports recurring refresh patterns and integration into workflows
- +Governance controls include workspace permissions and change traceability for findings
- +Clear separation between raw scan results and curated inventory outputs
- –Coverage depends on available data source connectors for each environment
- –Large estates may require careful tuning to keep unstructured scanning usable
- –Role-based access controls can be limited for highly granular team structures
- –Deep data flow mapping requires additional configuration effort
Best for: Fits when compliance teams need automated personal data inventory refresh across mixed data sources.
Varonis
enterpriseData security platform that discovers and classifies sensitive and personal data across repositories.
Access and exposure correlation that ties sensitive data findings to actual user and system activity for prioritization.
Varonis focuses GDPR-oriented discovery around security telemetry and file and data access patterns, not only document text scanning. The product builds personal data inventory signals by connecting to endpoints, cloud storage, and databases, then links exposure to who can access what.
Its governance workflow emphasizes audit log visibility and repeatable classifications for ongoing personal data discovery. Varonis also supports automation through APIs for integrating discovery results into downstream remediation and reporting.
- +Correlates sensitive content with actual access paths and user activity
- +Strong connector coverage across common storage and endpoint sources
- +Automation-ready results export using documented API and webhooks patterns
- +Audit log linkage supports GDPR monitoring and evidence collection
- –Best outcomes depend on accurate data source connector configuration
- –Unstructured detection coverage can produce manual review workload at scale
- –Advanced workflows require deeper admin setup and tuning discipline
- –Cross-environment mapping may need extra integration for complex estates
Best for: Fits when enterprises need GDPR discovery tied to access evidence and ongoing governance workflows.
Spirion
specialistSensitive data discovery and classification software for privacy and regulatory compliance.
In-place unstructured scanning that produces a location-based sensitive data inventory from recurring runs.
Spirion is a data discovery product that performs unstructured file scanning and in-place analysis to locate sensitive data across endpoints, servers, and cloud-connected storage. It uses pattern-based detection to identify personal data, then creates an inventory view that supports data governance workflows like classification and risk reporting.
Configuration supports recurring scans and result scoping so teams can rerun discovery across new storage without repeating full rework. Its governance emphasis is tied to auditability of what was found and where, rather than building a full data catalog replacement.
- +Unstructured file scanning with in-place analysis and targeted rescans
- +Pattern-based detection yields actionable findings by storage location
- +Governance oriented reporting supports GDPR reviews tied to discovered stores
- +Recurring configuration helps keep a personal data inventory current
- –Discovery coverage can be limited when data sits only inside custom apps
- –Tuning false positives for complex documents needs ongoing administrator attention
- –Depth of integration with enterprise catalogs and pipelines can be narrow
- –Cross-system data flow mapping and lineage require additional tooling
Best for: Fits when organizations need repeatable discovery of sensitive personal data in files and shared storage.
Metomic
SMBSaaS data security and sensitive data discovery platform focused on cloud collaboration apps.
API-first discovery output designed for automated inventory workflows across engineering and privacy tooling.
Metomic focuses on automated personal data inventory for engineering and privacy teams that need faster scanning of production systems. It combines unstructured and structured discovery with an API-first workflow so results can flow into downstream governance and reporting.
Metomic also supports automation around continuous re-scanning and findings management, which reduces manual spreadsheet work. Governance features center on control of scanning scope, ownership workflows, and audit-ready outputs for privacy reviews.
- +API-first findings export for automation and ticketing workflows
- +Supports continuous re-scanning to keep inventories current
- +Handles both structured and unstructured sources during discovery
- +Clear ownership workflows for managing discovered datasets
- –Deep integrations require implementation support and pipeline tuning
- –Finding accuracy can vary by data format and source configuration
- –Advanced governance controls are less granular than enterprise suite tools
- –Large estates may need staged rollouts to control scanning throughput
Best for: Fits when privacy and engineering teams need automated personal data inventory with an API-driven workflow.
Conclusion
After evaluating 10 cybersecurity information security, Osano stands out as our overall top pick — it scored highest across our combined criteria of features, ease of use, and value, which is why it sits at #1 in the rankings above.
Use the comparison table and detailed reviews above to validate the fit against your own requirements before committing to a tool.
How to Choose the Right gdpr data discovery software
This buyer’s guide covers GDPR data discovery software across Osano, TrustArc Data Discovery, and BigID through Metomic, with each tool reviewed for how it turns scan results into evidence and operational workflow outputs. Osano leads on recurring scan scheduling with finding grouping and evidence exports, while TrustArc Data Discovery focuses on GDPR-aligned governance workflow integration that routes scan findings into compliance and remediation handling steps.
BigID is included for policy-driven discovery that connects sensitive data findings to governed evidence outputs, and Metomic is included for API-first discovery output designed for automated inventory workflows. The guide frames differences around connector coverage setup work, detection tuning to control false positives, and the availability of an automation and API surface for feeding downstream governance tools.
GDPR data discovery software that identifies, validates, and exports personal data locations for compliance workflows
GDPR data discovery software scans structured databases and unstructured file and content repositories to locate personal data and sensitive data patterns, then converts findings into an actionable personal data inventory for privacy and compliance teams. Osano supports repeatable discovery cycles with recurring scan scheduling and evidence exports, and it groups findings for investigation workflows. Tools like TrustArc Data Discovery route discovery outputs into GDPR-focused governance workflows that connect scan results to compliance evidence and remediation handling steps.
Some platforms shift more work into detection tuning, which affects false positive volume, while others emphasize connector-led discovery that depends on connector coverage across the environments in scope. Across the reviewed tools, the differentiator is whether discovery results can be operationalized through automation and API-driven updates into governed workflows rather than ending as a one-time scan report.
GDPR data discovery features that determine audit-grade outputs
GDPR data discovery software has to turn scan results into repeatable evidence and actionable locations, not just a one-time report. The strongest tools align discovery findings with the downstream workflows that privacy and governance teams run.
These features focus on where discovery output becomes operational, where errors come from, and how automation keeps personal data inventories current. The differences show up in scan scheduling and evidence exports, GDPR governance routing, and API-driven inventory refresh.
Recurring scan scheduling and evidence exports
Osano groups findings for investigation workflows and exports evidence from scheduled discovery cycles across mixed sources. This recurring model reduces gaps between scan snapshots compared with tools that emphasize manual runs.
GDPR governance workflow routing for remediation handling
TrustArc Data Discovery routes scan findings into GDPR-focused governance decisions and remediation handling steps. This matters when discovery output must feed compliance workflows instead of ending in a static inventory.
Policy-driven tuning to control false positives
BigID uses policy-driven discovery logic and supports classification tuning to lower false positive rate. SAS Data Management can connect outputs into governed catalog and stewardship workflows, but it requires heavier setup and configuration discipline to keep tuning under control.
API-first discovery output for automated inventory pipelines
Securiti and Metomic both provide API-first discovery outputs designed for programmable updates and automation. Metomic emphasizes continuous re-scanning to keep inventories current, while Securiti targets discovery-to-workflow integration for external governance systems.
Connector-led inventory normalization into a curated GDPR view
DataGrail normalizes connector findings into a curated GDPR-ready view for remediation workflows. This reduces manual consolidation compared with Varonis, which prioritizes access and exposure correlation to support prioritization.
Choose by operational workflow shape, connector dependency, and automation surface
The first selection fork is how discovery results move into compliance work. Osano and TrustArc Data Discovery route output into investigation or GDPR governance steps, while Securiti and Metomic emphasize API-first outputs for automation and pipeline updates.
The second fork is where the main workload sits. Some tools center recurring scan scheduling and evidence exports, while others shift effort into detection tuning to control false positives or into connector setup validation for niche data stores.
Match the tool to the workflow where discovery evidence is consumed
If discovery evidence must be packaged repeatedly for investigations and exports, Osano’s recurring scan scheduling with finding grouping is the direct fit. If discovery findings must land inside GDPR governance workflow steps for remediation handling, TrustArc Data Discovery is the closer match.
Decide whether automation should run through APIs or through routed governance workflows
Select Securiti when automated inventorying across mixed repositories needs programmable updates into external catalog and governance workflows. Select Metomic when engineering and privacy tooling needs an API-first inventory workflow with continuous re-scanning to keep inventories current.
Estimate the tuning and setup effort based on content type
If unstructured content precision depends on detection tuning, TrustArc Data Discovery requires detection tuning for unstructured sources to maintain precision. If the environment is SAS-heavy and governed by SAS metadata, SAS Data Management ties sensitive identification outputs into SAS metadata-driven discovery and stewardship workflows, which increases setup effort.
Validate connector coverage against the actual environments in scope
If the estate includes common storage and endpoint sources and prioritization needs access and exposure correlation, Varonis provides strong correlation but depends on accurate connector configuration. If the estate relies on many connectors feeding an operational personal data inventory view, DataGrail’s connector-first normalization must match the available source list for each environment.
Quantify the false positive review workload during proof-of-work
Run targeted tests for BigID where high-accuracy tuning requires ongoing configuration work to reduce false positives. Run targeted tests for OneTrust DataDiscovery where tuning accuracy may require iterative configuration to control false positives when connector coverage is uneven for specialist stores.
Teams that get the most from GDPR data discovery software
GDPR data discovery software becomes valuable when discovery output supports ongoing privacy and governance operations, not just compliance reporting. The best fit depends on whether the organization needs evidence exports, governance workflow routing, or automation via API-first outputs.
The reviewed tools divide clearly by who owns connector configuration, who runs detection tuning, and who operationalizes inventories into workflows and downstream systems.
Privacy operations teams running DSAR and investigation workflows
Osano supports repeatable evidence collection with recurring scan scheduling and grouping that supports investigation workflows across mixed sources.
Governance and compliance teams that manage remediation decisions
TrustArc Data Discovery aligns discovery outputs with GDPR governance workflow integration so scan findings route into compliance evidence and remediation handling steps.
Engineering teams building automated inventory pipelines
Metomic and Securiti both provide API-first discovery output designed for automated inventory workflows, including continuous re-scanning for inventory freshness.
Data governance teams focused on SAS ecosystems and metadata stewardship
SAS Data Management connects discovery outputs to governed catalog and stewardship workflows using SAS metadata-driven discovery and controlled access patterns.
Enterprise security teams prioritizing exposure using access evidence
Varonis correlates sensitive data findings with user and system activity for prioritization, with results dependent on connector configuration accuracy.
Common GDPR discovery mistakes that create untrustworthy inventories
The most common failure mode is treating discovery as a one-time scan without configuring the workflow that consumes evidence. Another failure mode is underestimating where the workload shifts during tuning and connector setup.
The reviewed tools show predictable error sources tied to connector coverage gaps and detection threshold tuning, especially for unstructured sources.
Ending with raw scan results instead of evidence-ready exports or workflow outputs
Osano and TrustArc Data Discovery are built to operationalize discovery into evidence exports or GDPR governance workflow routing, while tools that stop at discovery reports force extra manual steps.
Underestimating detection tuning effort required to control false positives in unstructured content
BigID needs ongoing configuration work to maintain high accuracy and reduce false positives, and TrustArc Data Discovery requires detection tuning for unstructured sources to sustain precision.
Assuming connector coverage gaps will be negligible for niche data stores
Connector coverage requires validation for niche data stores in TrustArc Data Discovery and BigID, and connector coverage may lag for specialist needs in OneTrust DataDiscovery.
Skipping connector configuration validation when results depend on access and activity correlation
Varonis ties discovery priorities to actual user and system activity, so incorrect connector configuration increases manual review workload at scale.
Choosing a connector-first normalization approach without verifying connector availability across environments
DataGrail’s curated GDPR-ready view depends on connector coverage for each environment, so large estates require connector mapping and tuning effort to keep unstructured scanning usable.
How We Selected and Ranked These Tools
We evaluated Osano, TrustArc Data Discovery, SAS Data Management, BigID, OneTrust DataDiscovery, Securiti, DataGrail, Varonis, Spirion, and Metomic using feature coverage at 40%, ease of implementation and day-to-day operation at 30%, and value fit for GDPR discovery workflows at 30%. Features weighted recurring scan scheduling, evidence export output shape, and the ability to route discovery results into governance workflows or API-driven automation. Ease weighted connector setup dependencies and how configuration work shifts between connector coverage validation and detection tuning for false positive control.
Value weighted how quickly discovery output becomes usable inventory or evidence for privacy and compliance teams. Osano ranked highest because recurring scan scheduling with finding grouping and evidence exports directly supports repeatable discovery evidence collection across mixed sources.
Frequently Asked Questions About gdpr data discovery software
How do BigID and OneTrust DataDiscovery turn scan results into GDPR-ready workflow inputs?
Which tools support a programmatic workflow layer through API access to discovery results?
When does recurring discovery matter more than one-time scans for GDPR evidence?
What breaks if a data discovery rollout needs to map sensitive findings into existing catalogs and governance systems?
How do Varonis and Osano differ in what they use as discovery signals for personal data inventory?
How does SSO and administrative access control show up in day-to-day governance with discovery workflows?
Which tool best fits a DSAR-driven operating model where discovery must feed targeted searches?
How do TrustArc Data Discovery and Securiti handle GDPR-oriented evidence generation from scan findings?
What tradeoff appears when an organization needs deep extensibility rather than a fixed discovery workflow?
Tools reviewed
Primary sources checked during evaluation.
Referenced in the comparison table and product reviews above.
Keep exploring
Comparing two specific tools?
Software Alternatives
See head-to-head software comparisons with feature breakdowns, pricing, and our recommendation for each use case.
Explore software alternatives→In this category
Cybersecurity Information Security alternatives
See side-by-side comparisons of cybersecurity information security tools and pick the right one for your stack.
Compare cybersecurity information security tools→