How risk categorization works in Dropbox Protect

Dropbox Protect uses sharing exposure and, when available and enabled, data classification to automatically assign a Risk category and identify items that may have the highest exposure risk. Risk categories may change when an item’s sharing permissions or classification results change. You can filter your items by their risk category to help you prioritize items that may need the most attention. 

Learn more about filtering in Protect.

Risk categories

Dropbox Protect assigns one of the following categories to reviewed items:

• Critical: The item has the strongest combination of exposure and supported sensitive-data signals.
• High: The item has significant exposure or sensitive-data signals and should be prioritized.
• Medium: The item has elevated exposure or classification signals that may require review.
• Low: The item has relatively limited exposure based on the signals Protect evaluated.

How Protect determines an item’s risk category

When determining an item’s risk category, Protect considers the following details:

• Sharing exposure: How broadly the item is shared, such as with specific internal users, groups, your organization, external accounts, personal accounts, or anyone with a public link. Learn more about shared links.
• Data classification: Whether personally identifiable information (PII) or payment card information (PCI) is detected in the item and the confidence of the detection.

Generally, the more broadly an item is shared and the more sensitive information it contains, the higher its risk category.