1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to: monitor security of a plurality of registered digital documents in a system, the monitoring including determining whether signatures associated with the registered digital documents are included in data propagating in network traffic of the system; detect a particular signature of a particular document in the plurality of registered digital documents from the data propagating in the network; determine, based at least in part on the detecting, that detection of the particular signature exceeds a threshold detection rate for registered digital documents in the system, wherein the threshold detection rate comprises a threshold percentage of digital documents detected in the network traffic over a time period; remove the particular signature from a signature database based on determining that detection of the particular signature exceeds the threshold detection rate, wherein the signature database includes the signatures of the plurality of registered digital documents; and perform a security action to protect access to the registered digital documents, wherein the security action is not performed on the particular document based on removal of the particular signature from the signature database.