It's a tough ethical choice. On one hand, you want a company to avoid leaking data to bad actors, on the other hand, this would probably first used against legitimate whistleblowers.
I get how useful it can be, but repeating "positive" is not a magical solution.