US Patent 11416641 Incident-driven introspection for data loss prevention

The technology disclosed teaches incident-driven and user-targeted data loss prevention that includes a CASB controlling exfiltration of sensitive content in documents stored on cloud-based services in use by organization users, by monitoring manipulation of the documents. CASB identifies the cloud-based services that the particular user has access to and at least one document location on the cloud-based services to inspect for sensitive documents, in response to receiving an indication that user credentials have been compromised. The CASB performs deep inspection of documents identified as stored at the location and detects at least some sensitive documents. Based on the detected sensitive documents, the CASB determines data exposure for the organization due to the compromised credentials of the particular user. The disclosed technology also teaches controlling infiltration of contaminating content on cloud-based services in use by users of an organization by monitoring content deposited to the cloud-based services.