Somewhere in your company there is a shared drive where the Q3 acquisition model sits two folders away from the holiday party menu.
Both files have the same permissions. Both sit under the same retention rule. Last spring, someone applied a "Confidential" label to the whole drive to close the audit, and the label has done nothing since. When every file gets one treatment, the treatment gets set for the average file.
This post is about shrinking your blast radius: how to sort files into data classification levels, what each level should get, and which files, a small number, actually earn per-file encryption.
If you want the definition of data classification first, we wrote it about here: What Is Data Classification, and Why Is It Not Enough to Protect Sensitive Data?. This post starts after that one ends, with the decision.
🛡️ Which Of Your Files Would Hurt Most If They Left?
Per-file encryption belongs on the few files whose loss would cost you contracts, cases, or competitive position. See how it works on a defined set of your own files in a two-week pilot.
Why One-Size-Fits-All Classification Fails
There are two ways to get this wrong, and most companies manage both at once.
The first is over-protection. Every file gets the strictest treatment because nobody wanted to make the call. Access requests pile up. Sharing slows down. People copy files to personal drives to get work done, and the strictest policy in the company ends up protecting a folder nobody opens.
The second is under-protection. The files that matter share a permission model with the files that don't. When one account is compromised, everything that account could reach is exposed at once.
Scale makes both worse. Gartner estimates that 70 to 90 percent of organizational data is unstructured, growing up to 50 percent annually. That is the contracts, models, drawings, and decks. It is also the data that classification programs reach last, because it has no schema to scan.
AI adoption accelerates this problem. Employees routinely feed unclassified documents, decks, and spreadsheets into public AI models, copilots, and autonomous agents. Without clear tiering, sensitive files flow into these tools as easily as public ones—leaving organizations with no recall mechanism and no audit trail.
A tiering model fixes this by forcing a choice. You decide, in advance, what a file's worst day looks like, and you spend protection accordingly.
A Four-Tier Data Classification Model
Four levels is enough for most organizations. More than that and people stop remembering the differences. Fewer, and the middle tier swallows everything.
| Tier | What it holds | Examples | Who can see it |
|---|---|---|---|
| 1. Public | Information you want read | Published pages, press releases, marketing PDFs | Anyone |
| 2. Internal | Routine business information | Meeting notes, org charts, internal procedures | Employees |
| 3. Confidential | Information that harms you if it leaks to the wrong party | Customer lists, contracts, pricing, financial results before release | Named teams and roles |
| 4. Restricted | Information whose loss is a regulatory event, a lost contract, or lost competitive position | M&A models, source code and design files, regulated personal data, export-controlled technical data, trade secrets | Named individuals, under stated conditions |
Name the tiers whatever your company already says out loud. The names matter less than the rule underneath them: each tier is defined by the damage of a leak, not by the department that owns the file.
The same logic appears in published guidance. Data classification policies built around public, internal, confidential, and restricted levels are common because they map to consequence, which is what a security budget actually responds to.
What Controls Belong at Each Level
This is the part most classification posts skip. A label with no control behind it is decoration.
Tier 1, Public. No access control. Make sure the file is actually meant to be public and that the version published is the version intended.
Tier 2, Internal. Standard permissions, single sign-on, and basic logging. Most of your volume lives here. Do not spend more on it.
Tier 3, Confidential. Role-based access, sharing restrictions for external recipients, AI egress controls that govern which data classes can be fed into AI tools or copilots, data loss prevention rules where you run them, and access logging you actually review. This tier is where most existing tools earn their keep.
Tier 4, Restricted. Everything in Tier 3, plus controls that stay with the file. This is where per-file encryption belongs. Each file gets its own key. Access is decided at the moment someone tries to open it, based on who they are, what device they are on, where they are, and when. Every attempt, granted or refused, is logged against that file.
The reason Restricted files get a different class of control is mobility. Every control in Tiers 1 through 3 is attached to a place: a drive, a tenant, an application. A Restricted file does not stay in one place. It gets downloaded, attached, forwarded to outside counsel, synced to a laptop, pasted into an AI tool. Your container security ends where the file does, and the file leaves the container every single day.
That is the new wall. The threat changed shape: attackers now arrive with valid credentials, and to every location-based control, a valid login is an authorized one. Theodosian moves the wall to the file itself, so the protection travels with it. Control that travels with the data matters most for exactly the files in Tier 4 and almost not at all for the files in Tier 2.
How to Decide Which Files Are Restricted
Not every file that feels important is Restricted, and not every Restricted file feels important. Run each candidate through five questions. Two or more yes answers put it in Tier 4.
- Would a leak trigger a legal or regulatory notice? Regulated personal data, health records, and export-controlled technical data usually do.
- Would it cost you a contract or a customer? A prime contractor's design files, a client's privileged matter file.
- Would it hand a competitor something they cannot get otherwise? Source code, formulas, pricing models, unreleased financials.
- Is it hard to take back once shared? Anything that leaves your environment on a regular basis—to contractors, advisors, supply chain partners, or AI tools and agents.
- Is your only protection the place it lives? If the file has no control of its own, the answer is yes.
The fourth and fifth questions are the ones teams skip. A file can be modest in value and still belong in Tier 4 if it travels constantly with no protection of its own.
Cost matters here too. Compare the price of the control to the price of the leak. IBM puts the global average cost of a data breach at $4.88 million, with a mean of 204 days to identify and contain one. Protecting a few thousand Restricted files is a small number next to that, and a large one only if you try to protect everything.
Finding the Files: Where Discovery Fits
Tiering assumes you know which files exist. Most organizations do not.
Legacy discovery and classification tools scan repositories, find sensitive content, and apply labels at scale. They give you a report on your exposure, but they leave the data itself ungoverned.
The next evolution of data-centric security platforms closes this gap by unifying discovery, protection, and governance into a single pipeline. Continuous discovery finds and inventories sensitive data across cloud storage, agentic engines apply classification labels, and those labels automatically drive proportional enforcement—from AI egress rules on confidential classes to per-file encryption on your Restricted crown jewels. Finding the files is the first step; ensuring the protection travels with the data completes the job.
A 30-Day Rollout
You do not need a year. You need one decision per week.
Week 1: Define the tiers. Agree on four levels, write one sentence per level, and name an owner for the Restricted list. Resist the urge to add a fifth tier.
Week 2: Inventory the top of the pile. Do not try to classify everything. Identify the first thousand Restricted files, or the folders where they live. Ask legal, finance, and engineering. They already know.
Week 3: Apply Tier 4 controls. Protect that first set with per-file encryption and context-aware access. Leave Tiers 1 through 3 alone.
Week 4: Read the log. Look at who tried to open Restricted files, from where, and what happened. You will find access you did not know about. That is the point.
What This Means for Your Security Budget
Tiering changes what you buy. Tiers 1 and 2 need almost nothing beyond what you already own. Tier 3 is where existing tools do their work. Tier 4 is where a specific, small investment makes the largest difference, because it is the only layer built for files that leave.
The temptation is to push every file into the strictest tier and call it done. Resist it. Overprotection is how a security program loses its users, and users who feel blocked find a route around you. A program people tolerate beats a perfect one they bypass.
Choose carefully. Spend precisely. Let everything else stay easy to use.
🛡️ Pick the Files That Matter. Protect Those First.
Start with a two-week pilot on your Restricted tier. You choose the files, we show you what happens when one is downloaded, forwarded, and revoked.
FAQs: Data Classification, AI Governance, and File Security
How many of our files would actually need per-file encryption?
Usually a small share, often a low single-digit percentage of total volume. The Restricted tier is defined by consequence, not by size. A pilot starts with a defined set, typically the files legal, finance, and engineering already know are most sensitive, so you see real numbers before you commit to a wider rollout.
Can we protect only the Restricted tier and leave everything else alone?
Yes, and that is the recommended way to start. Per-file encryption applies to the files you choose. Tiers 1 through 3 keep working the way they do today, and your users keep opening files in the applications they already use. You can expand the protected set later, one team or one file type at a time.
We have already labeled files in Microsoft Purview. Do we have to start over?
No. Labels tell you which files matter. Theodosian protects the files you identify as Restricted, and your existing labels are a sensible place to pull that list from. We map your current setup to the path a real file takes and show you where control ends, so you see what the labels do and do not enforce today.
What happens to a Restricted file after it is downloaded or shared outside the company?
It stays encrypted, with its own key, and every attempt to open it is evaluated against your policy at that moment: who is asking, from which device, from where, and when. You can revoke access after the file has left. In a pilot, you run this on your own files: download it, forward it to an outside address, revoke it, and watch what the recipient sees.
Does Theodosian help us find and classify files, or do we need a separate DSPM tool?
Theodosian includes continuous discovery and agentic classification across cloud storage platforms like SharePoint and Google Drive. It inventories sensitive data, identifies who and what can reach it, and applies policy automatically—eliminating the need to manage a separate standalone discovery report tool.
What does a two-week pilot cover, and what do we end up with?
The pilot protects a defined set of your Restricted files over your existing Microsoft 365, Google Workspace, or cloud storage. It does not require migrating data. At the end, you have the per-file access log from your own environment, a clear picture of which files were reached from where, and a direct answer to the question your classification program could not: what happens to the file after it leaves?
Related Reading:
What Is Data Classification, and Why Is It Not Enough to Protect Sensitive Data?
DSPM vs. File Encryption: Why Data Discovery Isn't Data Protection
What Is a Data-Centric Security Platform?
🔍 Contractor Access Audit: Restricted files held by outside contractors are the ones your tiering model reaches least. Use our Contractor Offboarding File Security Checklist to find out which copies are still out there.
🤖 AI Access Audit: A Restricted file pasted into an AI tool has left every control in Tiers 1 through 3. Use our Shadow AI Risk Assessment Checklist to map where that happens.