Data Loss Prevention (DLP)

Analyzes data in motion, at rest, and in use using regular expressions, exact data matching (EDM), and indexed document matching (IDM) to identify sensitive content beyond simple keyword matching.

• Performs partial document matching to detect leaked source code snippets.
• Uses machine learning classifiers to identify unstructured sensitive data like intellectual property.
• Example: Blocking an email containing a CAD file that matches a fingerprint of a confidential design.

Evaluates the risk profile of a data transfer by combining content sensitivity with user identity, destination, and geolocation. This moves beyond binary block/allow decisions.

• Integrates with User and Entity Behavior Analytics (UEBA) to detect anomalous uploads.
• Applies Attribute-Based Access Control (ABAC) policies to weigh user clearance against data classification.
• Example: Allowing a CTO to send source code to a trusted CI/CD pipeline but blocking a junior developer from uploading it to a personal cloud storage service.

Executes real-time protective measures when a policy violation is detected, minimizing reliance on manual intervention.

• Encryption: Automatically applies TLS or AES encryption to data in transit.
• Quarantine: Isolates sensitive files in a secure sandbox for administrative review.
• Redaction: Dynamically masks or removes specific sensitive fields (e.g., credit card numbers) from documents.
• Example: A DLP agent automatically encrypting a spreadsheet containing PII before it is attached to an external email.

Extends policy enforcement across heterogeneous environments, including managed endpoints, cloud access security brokers (CASBs), and web proxies.

• Monitors USB ports, printers, and local clipboard operations on workstations.
• Inspects API traffic to sanctioned and unsanctioned SaaS applications via reverse proxy or API integration.
• Example: Preventing a user from pasting customer database credentials into a generative AI chatbot interface in the browser.

Generates immutable audit logs and detailed incident reports that capture the who, what, when, and where of a policy violation for compliance and legal hold.

• Records the original file, matched policy rule, and destination context.
• Provides visual data lineage to trace the path of exfiltrated data.
• Example: Producing a court-admissible report showing a departing employee synced a folder of financial models to a personal device 48 hours before resignation.

Leverages metadata tags from upstream classification tools to make more accurate blocking decisions without re-scanning the full content payload.

• Ingests Microsoft Purview or Titus classification labels applied at creation.
• Applies DLP policies based on header metadata rather than deep packet inspection to reduce latency.
• Example: Automatically blocking the transfer of any file tagged Confidential - Legal to external recipients, regardless of the file's internal content.