Data Loss Prevention (DLP)

Data loss prevention (DLP) is a class of controls that inspects content in motion and blocks, quarantines, or warns when something sensitive is about to leave the organization — source code pasted into a public site, a customer list attached to a personal email, credentials in a chat message. It predates generative AI by two decades, but AI tools changed the shape of the problem, because the exfiltration path is now a text box that looks like a search bar and is used by people who do not think of themselves as moving data anywhere. DLP enforcement lives in a few places, and coverage rarely spans all of them. Endpoint agents see clipboard and file activity on the device. Browser extensions and secure web gateways see paste and upload events into specific web applications, which is the layer most organizations reach for when they want to govern staff use of consumer AI products. Cloud access security brokers cover sanctioned SaaS via API. An API gateway in front of your model provider covers your own product's traffic, but nothing an employee does in a browser. The gap between these is where shadow AI lives — tools nobody approved, used through personal accounts, invisible to whichever layer you deployed. For buyers evaluating an AI vendor, DLP shows up in procurement as two different questions: can our existing DLP see and control traffic to this tool, and does the tool itself provide comparable controls for what our users put into it. The second is worth asking specifically about admin visibility: whether an administrator can see which workspaces submitted what, export those events, and set organization-wide rules rather than relying on per-user settings that any user can turn off.