Thales launches real-time file activity monitoring with AI help

Thales has introduced a new File Activity Monitoring capability within its CipherTrust Data Security Platform that offers real-time oversight and control of unstructured data across on-premises, hybrid, and multicloud environments.

File Activity Monitoring (FAM) is designed to help organisations monitor file activity as it happens, identify risks including unauthorised downloads and sharing, and streamline compliance processes related to standards such as GDPR, HIPAA, and PCI DSS. The capability incorporates a built-in Generative AI assistant to aid audit processes, reduce complexity, and improve response times within a single platform engineered to secure both structured and unstructured data.

Unstructured data challenge

According to IDC, unstructured data currently accounts for 90% of all worldwide data, making its management and protection a significant concern for businesses. FAM enables security teams to monitor the movement and activity of unstructured data, including files such as emails, chat logs, media files, and application logs, which can all house sensitive information. The platform delivers real-time alerts, analytics, and encryption tracking to support faster threat detection and protection for sensitive data.

Thales stated that the new capability addresses a major blind spot in data security by delivering continuous data discovery, classification, and monitoring. This approach provides the necessary foundation for effective Data Security Posture Management, and also aids compliance and the identification of unauthorised activities that might lead to data exposure.

The platform's centralised management is intended to streamline audit reporting and improve threat response, reducing operational complexity across the data lifecycle.

Industry perspectives

Leila Kuntar, Principal Information Security Engineer at Amadeus, commented on the launch:

"Thales' innovative approach to File Activity Monitoring tackles key challenges like blind spots in hybrid environments, offering real-time visibility and smart anomaly detection — a potential game-changer for teams overwhelmed by false positives. By striking the right balance of depth and simplicity, FAM shows promise in helping us strengthen the SOC without added complexity. With tighter SIEM integration, it can sharpen response and let teams focus on what matters most. We're excited to see how FAM evolves and enhances our data security."

Kuntar's remarks reflect the challenges security teams face in managing complex hybrid data environments, and the need for visibility without an increase in operational burden or false positives.

Todd Moore, Vice President of Data Security Products at Thales, said:

"As unstructured data grows rapidly across distributed environments, organizations need more integrated ways to track and safeguard their most sensitive information. With File Activity Monitoring, Thales reinforces its leadership in enterprise data security by delivering real-time insight, intelligent automation, and unified visibility through a single, powerful platform."

Capability detail

File Activity Monitoring strengthens Data Security Posture Management (DSPM) by allowing security teams to discover, classify, observe, and control sensitive data across all infrastructure types. It can pinpoint the location of sensitive data, identify who has access, and determine if it is secured in real time, supporting the detection of suspicious behaviours such as unauthorised copying or sharing. The tool can transform static data classification into dynamic risk intelligence by incorporating behavioural context, and supports remediation techniques including rapid incident reconstruction via audit logs and the application of strong encryption where needed.

AI-powered assistance

To assist with compliance and security workflows, FAM includes a Generative AI-powered Data Security Assistant. This chatbot provides capabilities to query audit information, generate custom reports, and facilitate compliance processes, lessening the administrative load on IT and security professionals while supporting regulatory obligations.

Moore also addressed the need for adaptable security controls, stating:

"As technology evolves rapidly, our controls must be flexible enough to keep pace without adding complexity. Automation and intelligence help overwhelmed security teams scale operations and focus on what matters most. With tools like our chatbot, they can ask natural language questions and get instant, actionable answers, accelerating response times and improving operational efficiency."

Thales has previously focused on structured database activity protection and is now extending this experience to include unstructured data. The platform aims to offer similar oversight and operational experience for both data types, addressing growing organisational requirements for data control and security as data volumes increase and diversify.