Understanding the Activity Mix Column
Activity Mix breaks each unsanctioned application's activity into three kinds — visits, uploads, and downloads — so that you can tell browsing apart from data actually leaving your organization.
The Total column tells you how much activity an application saw. Activity Mix tells you what kind it was, which is usually the more important of the two.
Table 1. What the three figures mean
| Figure | What it counts | What it suggests |
|---|---|---|
| Visits | Someone opened the application. | People are looking at the tool. Nothing has moved. |
| Uploads | Data was sent to the application. | Your data is leaving. This is the figure to watch. |
| Downloads | Data was retrieved from the application. | Content is coming in from a tool you have not sanctioned. |
The three percentages are proportions of that application's Total, so they add up to 100. The coloured bar shows the same split visually, in the order given by the legend above the table.
Reading it against the Total
A percentage on its own can mislead. Ten per cent uploads against a total of 1,000 is a hundred occasions on which data left your organization. Fifty per cent against a total of four is two.
Read the two columns together, and rank by uploads rather than by total activity. The application at the top of the table is the busiest, not necessarily the one exposing you to the most risk.