Before and after: how to show progress over time

The first scan of an office is often a little uncomfortable. Files you forgot about show up. Then the real work begins, and a month later nobody remembers how much was found, what was done, or whether the numbers moved. A small amount of record-keeping fixes that.

Start with the baseline

The first scan of a path is a full scan, so it gives the most complete picture of where you started. Treat it as your baseline. Export it right away and file it somewhere safe with the date in the file name. The dashboard exports to PDF, CSV and XLSX, and the branded PDF exposure report includes five headline numbers: files scanned, files with exposed data, high-severity findings, devices affected, and an estimate of the ID numbers found.

Keep in mind what those numbers are. The ID-number figure is an estimate, not a count of people, and the counts reflect what the agent can read, in the locations you chose. They are good for comparing one scan with another, which is the point of a baseline.

Why re-scan

A single scan is a snapshot. Re-scanning does three things:

• It confirms your cleanup worked. A file you deleted should stop appearing.
• It catches new exposure. Sensitive files reappear whenever someone downloads an attachment or exports a spreadsheet.
• It gives you a baseline to compare each later report against.

Later scans can be incremental, which means only files that changed are re-read, so they are lighter than the first one. New organizations default to hourly incremental scans, and you can choose manual, hourly, daily or weekly schedules. Scans run at a balanced speed that backs off while someone is using the computer.

Keep a simple log of what you removed and why

MyVaultMate moves or deletes nothing on its own, so the cleanup is yours or your IT provider's (the program can lock a file away in its quarantine folder when someone at the computer asks it to). That makes your own log valuable. A spreadsheet with a few columns is enough:

1. Date. When you acted.
2. Finding. The file path or folder, and the kind of data.
3. Action. Deleted, moved to the secure system, encrypted, or kept.
4. Reason. "Old client copy, no longer needed" or "Required for open audit, moved to encrypted folder."
5. Who. Initials of the person who did it.

The reason column is the one people skip, and it is the one that makes the log useful months later. Be careful not to paste full sensitive values into the log. Paths and kinds of data are enough.

Keep exports with dates

Dashboards change; files in a folder do not. Each month, export the report and save it with a name like exposure-report-2026-11.pdf. Use CSV or XLSX if you want to compare specific findings. Keep these in a restricted folder, since the PDF lists file paths and redacted samples. If you ever need to explain what you knew and when, a run of dated exports is far more convincing than memory.

A simple monthly routine

1. Week one: Open the dashboard and review Critical and High findings first. Note any computers that have not reported.
2. Week two: Work through the highest-risk files. Mark each finding as a true or false finding as you go. Decide what to delete, move or encrypt and assign it.
3. Week three: Do the cleanup and record each action in your log.
4. Week four: Re-scan, export the report with the date, and compare to last month. Save the log and export together.

Expect some false alarms and note them in the log so they do not cost you time next month. Expect that the numbers may rise at times, for example when you add a new computer or folder to the scan. That is progress in visibility, not failure.

What the record does and does not show

A trail of dated reports shows that you looked, what you found, and what you changed. It does not show that you are compliant with any law or standard, and it does not cover file types the agent cannot read yet, such as RTF and PowerPoint files, Outlook .pst data files, or zip archives. Say that honestly when you describe it.

You can see what a report looks like at /sample, or start a 14-day trial at /trial/ (a card is required and never charged automatically: the 14 days start at your first computer, and you choose a plan when they end).