13. A method comprising: monitoring, using at least one data processing apparatus, security of a plurality of registered digital documents in a system, the monitoring including determining whether signatures associated with the registered digital documents are included in data propagating in network traffic of the system; detecting, using at least one data processing apparatus, a particular signature of a particular document in the plurality of registered digital documents from the data propagating in the network; determining, using at least one data processing apparatus, based at least in part on the detecting, that detection of the particular signature exceeds a threshold detection rate for registered digital documents in the system, wherein the threshold detection rate comprises a threshold percentage of digital documents detected in the network traffic over a time period; removing, using at least one data processing apparatus, the particular signature from a signature database based on determining that detection of the particular signature exceeds the threshold detection rate, wherein the signature database includes the signatures of the plurality of registered digital documents; and performing, using at least one data processing apparatus, a security action to protect access to the registered digital documents, wherein the security action is not performed on the particular document based on removal of the particular signature from the signature database.
13. A method comprising: monitoring, using at least one data processing apparatus, security of a plurality of registered digital documents in a system, the monitoring including determining whether signatures associated with the registered digital documents are included in data propagating in network traffic of the system; detecting, using at least one data processing apparatus, a particular signature of a particular document in the plurality of registered digital documents from the data propagating in the network; determining, using at least one data processing apparatus, based at least in part on the detecting, that detection of the particular signature exceeds a threshold detection rate for registered digital documents in the system, wherein the threshold detection rate comprises a threshold percentage of digital documents detected in the network traffic over a time period; removing, using at least one data processing apparatus, the particular signature from a signature database based on determining that detection of the particular signature exceeds the threshold detection rate, wherein the signature database includes the signatures of the plurality of registered digital documents; and performing, using at least one data processing apparatus, a security action to protect access to the registered digital documents, wherein the security action is not performed on the particular document based on removal of the particular signature from the signature database. 16. The method of claim 13 , further comprising intercepting registered documents included in the data propagating in the network based on detection of a corresponding signature for the registered documents.