Regexps are not great in general – whether something is sensitive or not is highly contextual. Regexps tend to be too narrow and produce a lot of noise = false

Regexps are not great in general – whether something is sensitive or not is highly contextual. Regexps tend to be too narrow and produce a lot of noise = false positives, so not terribly actionable. And false negatives (missed info) aren't much better either: sensitive data often lives in images, as people's profile photos or passport or ID scans, where you must really look at the pixels (OCR rarely helps). Here regexps instafail because they assume input is text. Personal war story: I encountered a bizarre category, sensitive data that's true negative which people nevertheless perceive as true positive. Think "specimen (invalid) passports" or "sample (invalid) credit cards". Not really sensitive (zero risk), but people still expect to see them detected. Creates some funny situations during testing. If you're curious, I wrote about it here [0], with some examples. [0] https://pii-tools.com/how-to-evaluate-pii-discovery/ https://pii-tools.com/how-to-evaluate-pii-discovery/