Document triage is the process of sorting, scanning, and reviewing uploaded files to decide which ones contain useful, sensitive, or low-value information. In cyber security, it can be done by defenders to classify evidence, but it is also used by attackers after they trick a victim into uploading documents. The goal is to quickly identify identity documents, account details, tax forms, or other data that can be reused in fraud.
This matters because many scams do not end with the initial lure. In phishing and smishing campaigns, a fake portal may ask the target to submit files, then use automation or AI to triage the upload queue and separate valuable data from noise. That makes the criminal workflow faster, more scalable, and harder to spot. Defensive triage works in the opposite direction: security teams review suspicious uploads, isolate risky content, and detect what data may have been exposed so they can contain follow-on abuse.