What Is Data Loss Prevention?

Data loss prevention monitors and controls where sensitive data goes — across email, web uploads, removable media, cloud storage and endpoints. The technology works. The reason DLP programmes have a poor reputation is that they are commonly deployed in a way that guarantees failure.

The failure pattern is consistent: broad policies enabled in blocking mode from day one, generating false positives that interrupt legitimate work, followed by exceptions granted under pressure until the policy blocks almost nothing.

Three channels, three levels of difficulty

Data in motion — email and web traffic — is the most mature and usually where value appears first. Email in particular has clear policy points and a manageable volume of legitimate exceptions.

Data at rest — discovery across repositories — overlaps with classification and is where organisations learn where their sensitive data actually lives, which is frequently the most useful output of the whole programme.

Data in use — endpoint activity such as copying to removable media, printing or pasting into a browser — is the most intrusive, the most prone to false positives and the most likely to generate resistance. It is also where a determined insider is most visible.

Deploy in monitoring mode, for longer than planned

The single most important implementation decision is to start in monitoring mode and stay there until the policies are genuinely accurate. That period reveals the legitimate business processes that look like exfiltration — the finance team sending spreadsheets to an accountant, the clinician emailing a referral, the developer moving a data extract into a test system.

Some of those are processes that should change. Most are simply how the organisation works, and blocking them without warning is how a DLP programme loses executive support in a single week.

Where DLP does not reach

Encrypted channels it cannot inspect, personal devices outside management, photographs of a screen, and anything moving through a service the tool does not integrate with. As data moves to sanctioned and unsanctioned cloud applications, endpoint and network DLP see progressively less of it.

This is why DLP works best alongside classification, access control and a realistic view of where data legitimately needs to go — rather than as a perimeter that assumes it can see everything.

Insider risk needs a different posture

Most DLP policy is written against accidental disclosure — the wrong recipient, the wrong attachment, the convenient personal cloud account. That is the right priority, because accidents are far more common than malice.

A deliberate insider behaves differently. They know what the policies block, they will use channels that are not monitored, and they will move data gradually rather than in a single obvious transfer. Content-based blocking catches very little of that.

What does help is behavioural: unusual volume, access to material outside a person’s normal scope, and activity clustering around resignation. Those signals belong with HR involvement and a defined process, not in the same queue as someone emailing a spreadsheet to the wrong address.

Where to start

Run discovery in monitoring mode against email for a month and look at what is actually leaving. The result usually reframes the conversation from theoretical exfiltration to a handful of specific business processes that need attention.

See DLP policies that reduce risk without blocking work. GuardsArm runs security risk assessments.