# Risk Scoring Context‑aware scores rank exposure by people, content, and access. ## Overview ### Identity‑centric risk scoring ### The Lightbeam Advantage - Identity‑centric risk scores across all data sources - Risk density maps surface hotspots instantly - Automated remediation when risk thresholds trip - Posture you can measure, trend, and prove ### Traditional Industry Approach - Score by attributes, owner, and exposure to fix what’s riskiest. - See sensitive data concentration and then prioritize action. - Auto‑trigger revocation, quarantine, or review when risk spikes. - Track scores, benchmark apps, and export audit‑ready evidence fast. ## From alert to outcome: remediation that runs itself, at scale ### Automate least‑privilege and cleanup with identity context; Playbooks execute instantly across cloud, SaaS, and On-Prem. Lightbeam links sensitive content to real people, then enforces policy without manual spreadsheets. When objects violate rules, open access, excessive rights, or external sharing, playbooks revoke or narrow permissions, label, archive, or delete, and log every step. Automated access revocation applies controls the moment conditions are met, cutting manual effort and drift across cloud, SaaS, and On-Prem. ### Close the blast radius in seconds, not hours, with behavior‑aware actions and a single console from detection to resolution. User and entity behavior analytics (UEBA) and Ransomware Protection watch for write spikes, mass deletes, or unusual access to sensitive folders. When behavior turns risky, Lightbeam suspends sessions, revokes rights, or quarantines files automatically, with one console from detection to fix and a clean audit trail. Copilot governance extends control to AI prompts, responses, and shared files to prevent oversharing. ## KEY BENEFITS ### Faster time‑to‑containment Detect, decide, and act in one place. Suspend sessions, revoke access, or quarantine files to stop spread and shrink resolution times with incident logs ready for leadership. ### Identity‑aware context Tie every remediation to a human identity and business context. Prove who had access, whose data was protected, and why decisions were made. ### Policy precision at scale Enforce by file type, label, source, or folder, including SMB shares, so code, PHI, or contracts follow rules automatically across ecosystems, without manual work. ### Audit‑ready proof Every alert, review, and action is logged immutably. Export evidence for SOC 2, ISO 27001, PCI, and more, without chasing spreadsheets, and share reports in seconds. ### Risk‑based prioritization Use contextual risk and density scores to focus Playbooks where they matter most, track posture over time, and measure impact on exposure over time. ## Customers on automated remediation outcomes #### “Lightbeam dramatically improved our PCI compliance processes, enabling accurate, efficient audits, and rapid response to potential compliance risks.” David Hanna IT Security, Veridian Credit Union ## FAQs ### How does Lightbeam know when to remediate automatically versus requiring review? Policies define conditions (e.g., open or excessive access, PHI in shared folders, file‑type rules, or behavior anomalies) and actions. High‑risk violations can trigger automatic revocation, redaction, archival, or deletion; medium‑risk events route to review with one‑click fixes. Risk Scores, UEBA signals, and identity context ensure precision and auditability. ### Will automation work across legacy SMB shares and modern SaaS like Microsoft 365 and Google Workspace? Yes. Lightbeam enforces policies on SMB file shares/folders and across cloud and SaaS sources like SharePoint, OneDrive, Google Drive, and more. Actions and evidence stay in one console, with granular control by file type, label, or location. Playbooks trigger revocation, account disablement, or quarantine with full logs preserved, no extra agents or scripts. ### Can we prove to auditors that remediation happened, who approved it, and when it occurred across systems? Every alert, review, and action is captured with timestamps, approvers, and outcomes. Access Review exports audit‑ready CSVs for SOC 2 and ISO 27001, and incident reports map behavior, identities, and files involved. Ransomware Protection preserves a timeline of actions and blast radius—so evidence is ready without spreadsheet hunts. Three‑state reviews keep accountability clear.