How to secure


your most critical


documents


inventory is required, and the work cannot be completed in a single quarter. Our message internally has been to start with pragmatic steps. Use established national guidance as a baseline, review how critical assets are protected end to end, and test controls in the workflows where sensitive files actually get created and shared.


If a document needs to remain confidential for years, we assume the clock is already ticking. That is why Indigo Vault Docs was built to be post-quantum ready.


Three document protection takeaways for security leaders


1. Treat documents as systems


If your most sensitive decisions live in Office and PDFs, the same rigour you apply to apps and databases must apply to files, especially at the moment they are opened and used.


2. Make the secure behaviour the default


The control plane: constraining what can happen to a file


The practical difference between a “secured file” and a “normal file” isn’t just where it is stored; it’s the set of actions that are permitted when someone opens it. Our approach is to apply multiple layers of protection by default, so a single mistake (or malicious act) does not become an incident. We also assume that controls will be tested in the real world, so we design for defence-in-depth rather than betting everything on a single gate.


• Identity-bound access: we bind document access to authenticated identity, so only explicitly permitted people can open a file, including protection against unauthorised administrative access.


• Controlled sharing by default: we constrain distribution to managed mechanisms rather than ad-hoc forwarding.


• Data leakage controls: where required, we can prevent copying, printing, screenshots, and screen recording.


• Application-level hardening: we can protect hidden rows, columns, or sheets in spreadsheets from being revealed.


• Time limits: we can set access to expire automatically.


• Remote revocation: we can withdraw permissions centrally at any time.


• Audit trail and alerts: we keep visibility into who accessed the document and when – enabling investigation, deterrence, and faster response.


AI changed the leakage pathway


Generative AI has added a new, low- friction route for sensitive content to escape: copy/paste into prompts, uploading documents for summarisation, or integrating files into assistants and plug- ins. Even where organisations set strong policy, the day-to-day temptation to “just drop the document in” is real. We treat AI leakage as another form of exfiltration from the point of view of document control. We aim to reduce the risk that critical content accidentally becomes part of an AI tool’s working set, index, or training exposure. In practice, that starts with controlling access to the file.


By default, we prevent AI from accessing critical documents and users from copying content into uncontrolled contexts, unless explicitly authorised by the document owner.


Looking ahead: post-quantum readiness is a migration, not a product


In the security community, the shorthand “Q-Day” is sometimes used for the point at which quantum capability makes widely used public-key cryptography no longer safe for protecting long-lived secrets.


Whether you believe that deadline is close or distant, the operational reality is the same: migration planning is required,


© CITY SECURITY MAGAZINE – SUMMER 2026 Advertorial


Security that relies on perfect user choices will fail at scale; security that fits existing habits (like saving to a normal folder) can succeed.


3. Layer, shorten exposure, and audit


Combine preventative controls (access, sharing limits) with containment (anti- copy/capture, geo/time limits), and pair it with auditability so incidents are detectable and investigable.


As attackers industrialise exfiltration and defenders navigate both AI adoption and post-quantum transition, we’ve found the question is no longer just “can we encrypt a file in storage or in transit?” but “can we control what happens when that file is opened?”


In our experience at WTW, the real test of document security is not whether a file can be stored safely, but whether it can still be controlled when people actually use it.


Mark Beardall


Willis Towers Watson (WTW) wtwco.com


You can protect your most critical documents with Indigo Vault Docs, the document management platform for now and the future.


For further information or to request a demo email: demo@indigovault.com or visit www.indigovault.com


>


18


Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25  |  Page 26  |  Page 27  |  Page 28  |  Page 29  |  Page 30  |  Page 31  |  Page 32  |  Page 33  |  Page 34  |  Page 35  |  Page 36