The permissions nobody granted on purpose.
Inheritance cut years ago, access handed to a person instead of a group, entries pointing at accounts that no longer exist. None of it shows up in a group review. All of it is still live.
Syslog CEF and REST, into the tool you already run
Why this is the finding that matters.
A file estate does not become dangerous through one bad decision. It becomes dangerous through ten years of small, reasonable ones — each made for a deadline, none reviewed since. Broken permissions are what that history looks like when you finally measure it, and they decide three separate things.
How far ransomware gets
Blast radius is not a property of the malware. It is a property of what the compromised account could reach. Every broken permission is a little more reach.
What an AI agent will answer
A copilot inherits the permissions of the person asking. Anything an over-entitled account can open, the agent will happily summarize — faster than anyone could have browsed to it.
Whether the audit holds
NIS2, DORA and ISO 27001 all expect access to be granted on need and reviewed. A review that misses direct grants and orphaned entries is not a review.
What “broken” actually means.
Eight distinct conditions, each one detectable, each one with a different fix. The platform names which one it found, on which path, and what sits behind it.
Broken inheritance
A subfolder is cut loose from its parent, usually years ago and usually for one good reason that no longer applies. From then on, every tightening applied at the top silently stops one level above it.
Direct permissions on files and folders
Access granted to a person rather than through a group. It works, so nobody revisits it — and it appears in no group membership review, because there is no group.
Orphaned SIDs
An entry for an account that no longer exists. The directory object is gone; the access control entry stays behind, pointing at an identifier that can in some circumstances be reissued.
Everyone, Authenticated Users, Domain Users
The group that means “anyone who can log in”. Attached to a sensitive folder it is an open share with an official-looking name, and it is the single entry an AI agent needs to surface the contents to whoever asks.
Nested group loops and depth
Groups inside groups inside groups, occasionally circular. The nesting is legitimate; the depth is what makes the question “who is actually in this” unanswerable by hand.
Stale and disabled accounts
Accounts that are disabled, expired, or have simply not been used in a year, still holding access to live data. Disabled is not revoked.
Deny rules that cancel a grant
A deny entry somewhere up the tree overrides a grant further down, or the other way round. The effective result is not what either rule reads like on its own.
Folders whose owner has left
Ownership sits with an account that is gone, so there is nobody to approve a change, confirm a classification, or answer for the data during an audit.
Let’s solve your data challenges.
Connect with our engineers to find the right approach for your infrastructure.
How we find them.
A scheduled scan collects file, folder and permission metadata from each system through its own native interface, then joins it with your directory — following every group to the people actually inside it. What comes out is the effective permission per path, which is the only level at which these conditions are visible at all.
What the first scan usually turns up.
The same shape, in landscape after landscape. The numbers below are what we typically see in a first assessment — your own will differ, which is rather the point of running one.
No figures are quoted here on purpose: we have not measured yours. The risk check gives you a first estimate in two minutes, and an assessment gives you the real list.
Talk to an engineer who knows your data.
Four fields, and somebody who knows ONTAP, PowerScale and what FPolicy does. Not a qualification call.