The non-human identity angle. We have internal AI agents and copilots touching Google Drive, and until DoControl we had no way to tell a human reading a file from an agent bulk-reading a folder outside its normal pattern. It inventories them alongside OAuth apps, scores them, and flags anomalous access. The identity threat detection baselines per user and per team are solid for humans too. Their newer AI assistant, Dot, is genuinely useful for investigation: I asked it which departing employees had downloaded more than 100 files in their last 30 days and got an answer in seconds.

Reliability of the automation. We run 30+ workflows now: expiring external shares after 60 days, revoking access for accounts disabled in Okta, quarantining files that match our secrets patterns, asking owners to re-certify vendor shares quarterly. They fire exactly as configured. That freed my team from being the cleanup crew and let them do detection engineering instead. The playbook library got us 80% of the way on day one; the custom 20% took some iteration but nothing we could not handle.

The ITDR piece. DoControl flagged a senior account manager who downloaded 2,000+ files over a weekend and shared a folder with a personal Gmail address. HR had not even announced the resignation yet; the system picked up the deviation from that person's normal pattern and from their team's baseline. Alerts go to our Slack channel and forward into our SIEM, so the SOC sees them in the same queue as everything else. For a financial services firm, this is the scenario that keeps a CISO up at night, and it works.