The most expensive file in a company may be the one nobody remembers saving. It might contain passport numbers, a private key, an old customer export, or the internal memo now being scooped into an AI assistant’s retrieval system. The file is not dramatic. The ignorance around it is. BigID built its business in that gap - between the data an enterprise owns and the data it can actually see.
The New York company’s proposition sounds almost comic in its obviousness: scan the estate, identify what is sensitive, connect it to the people and systems that can reach it, then do something useful. Delete stale records. Tighten access. Fulfill a privacy request. Prove a control to an auditor. Keep a confidential document away from a chatbot. The obvious part ends when the estate includes databases, email, collaboration tools, cloud buckets, file shares, SaaS applications, vector stores and old on-premises systems spread across countries.
The breach was the brief
Dimitri Sirota and Nimrod Vax met at CA Technologies after CA bought Layer 7, the API-security company Sirota had co-founded. Both had lived through enterprise identity and security projects. Around 2015, the headlines shifted from stolen military plans to stolen lives: names, addresses, phone numbers and intimate account histories leaking by the million. The pair noticed that companies had tools to guard networks and manage identities, but no reliable way to answer whose personal information sat where.
They founded BigID in 2016 with $2.1 million in seed funding. Their timing was unusually tidy. Europe’s General Data Protection Regulation was coming, California would follow, and privacy officers were trying to inventory data with interviews, questionnaires and spreadsheets. That manual record failed first. It described what a department believed it held, not necessarily what sat inside the systems. BigID scanned the underlying data and correlated scattered records back to an identity or entity.
“You can’t protect what you can’t find.”Dimitri Sirota, co-founder and CEO
The regulatory deadline gave the product a wedge. In early 2018 BigID raised a $14 million Series A. Five months later, after GDPR took effect and BigID won the RSA Conference Innovation Sandbox, it added a $30 million Series B. The win supplied the kind of trust a young security vendor cannot manufacture with a landing page. Large companies were not buying another privacy policy. They were buying evidence.
Capital followed the widening problem
Selected announced financings. BigID’s Series D and extension totaled another $100 million across 2020 and 2021.
One map, many anxious departments
What changed BigID’s mind about being only a privacy company was visible in the work. The same map required for a data-subject request could reveal overexposed financial records. The same classifier that found a Social Security number could label intellectual property. The same inventory used for GDPR could guide retention, cloud migration or access reviews. Privacy was the beachhead; data intelligence was the expanding territory.
Today the platform spans discovery and classification, data security posture management, data loss prevention, access governance, privacy automation, retention, deletion, a data and AI catalog, and AI security. BigID says it can connect to hundreds of sources and offers thousands of pre-trained classifiers across more than 100 languages. Its technical distinction is context. A pattern match can spot a nine-digit number; BigID aims to decide whether it is a Social Security number, whose it is, who can reach it, why it exists and which rule applies.
That breadth is also the competitive argument. Varonis is a familiar alternative in data access and file security. Microsoft Purview brings governance and classification into the Microsoft estate. OneTrust is entrenched in privacy workflows. Cyera, Sentra, Wiz and other cloud security companies approach data posture from different angles; Collibra, Alation and Atlan start closer to cataloging and governance. BigID would rather replace several point solutions than win a narrow bake-off. The buyer must decide whether consolidation produces leverage or a very large implementation.
The business model follows enterprise complexity. BigID sells recurring software subscriptions directly and through cloud marketplaces, resellers and consulting partners. AWS can simplify procurement; Snowflake can place the controls beside data already in its cloud; integrators can carry the implementation into a larger transformation program. This is not a self-serve app adopted with a credit card on Tuesday and forgotten by Friday. A sale can involve the security chief, privacy office, data leaders, legal team, infrastructure owners and procurement. That committee is slow, but each additional use case can enlarge the account. The platform strategy is partly technical and partly commercial: one expensive discovery layer supports several departmental budgets.
The proof is in what gets deleted
The cleanest evidence is not the number of records scanned but what changed afterward. The University of Maryland says BigID helped identify risk across Google Drive, Box and Microsoft 365, remove more than 27,000 records containing sensitive personal information, and address an estimated $5 million in risk exposure. The U.S. Army used it to find vulnerable data, certificates and private keys while supporting cloud migration and retention. Telenor used discovery and automation for privacy rights, deletion and audits in a regulated telecom environment.
Those cases reveal the conditions for success. Discovery must end with an owner, a policy and permission to act. A dazzling inventory that nobody remediates becomes another dashboard. BigID can route and automate work, but deleting a record or revoking access remains an organizational decision with legal and operational consequences.
What it costs
There is no public menu price. BigID says quotes depend on the number of data sources, applications and connectors, the deployment type, and the level of service and support. The product can run as managed cloud software, in a single-tenant arrangement, in hybrid form or under customer control. That flexibility matters to governments and multinationals with sovereignty rules. It also means the honest cost includes implementation, tuning, integration and people who can own the findings - not merely a subscription.
AI reopened every old filing cabinet
Generative AI made BigID’s old premise newly urgent. A forgotten document was once a latent breach risk. Connected to a retrieval system, copilot or agent, it can become an answer. A loosely permissioned file is no longer waiting for a curious employee; software may fetch it automatically. BigID now inventories models, agents, prompts, training sets, vector databases and RAG sources, looking for shadow AI and sensitive flows while enforcing policy around who or what can use the data.
BigID Next, announced in 2025, packages that expansion as a modular cloud-native platform. The company added prompt-based classification and assistants for security, privacy and governance work. It landed in the AWS Marketplace’s AI Agents and Tools category, works with Snowflake, and has announced AI-governance collaborations with Cognizant and Atlan. In 2026 it was named a Leader in Forrester’s evaluation of sensitive-data discovery and classification and a Challenger in Gartner’s data and analytics governance quadrant.
Then came the uncomfortable mirror. In May 2026, Israeli business publications reported that BigID was cutting roughly 150 of about 650 jobs, more than a fifth of its workforce, as it adopted an AI-first operating model. The company was not retreating from AI; it was letting AI reshape the company selling AI governance. Product recognition and restructuring arrived in the same season. The story is less clean than a launch announcement, and more revealing.
Copy this
Start with one expensive obligation. Build a trustworthy inventory directly from systems. Add context. Tie every finding to an action and measurable outcome. Expand only after the map earns trust.
Skip this when
Your data estate is small, regulation is light, sources are already tidy, or nobody owns remediation. Enterprise discovery software cannot compensate for absent decisions.
The control plane or another pane of glass?
BigID’s opportunity is to become the shared intelligence layer between enterprise data and every team that needs to govern it. Its risk is the same as any platform’s: broad claims invite broad comparisons, and customers may prefer a strong native tool from a cloud provider or a specialist for one urgent job. Classification also needs tuning. False positives exhaust operators; false negatives create confidence where none is deserved. No classifier abolishes the need for sampling, review and clear thresholds.
Still, the founding observation has aged well. Networks, databases and models can be secured only imperfectly when nobody knows what they contain. BigID did not invent that problem. It found a way to make the inventory operational - first for privacy, then security and governance, and now AI. The company’s next test is whether one map can truly coordinate all those departments without becoming the sprawling system it promised to simplify.