Finding sensitive data is only the beginning