What is DLP?

DLP inspects data in three states: data in motion (email, web uploads, chat attachments, API calls leaving the network), data at rest (files on file shares, cloud storage buckets, databases, endpoints), and data in use (clipboard copy-paste, screen capture, printing, USB transfer). Each state needs a different sensor: a mail gateway or proxy for motion, a crawler or cloud connector for rest, and an endpoint agent for in-use activity.

Detection relies on several techniques layered together. Regular expressions catch structured patterns like credit card numbers (passing a Luhn check), Social Security numbers, or API key formats. Exact Data Match (EDM) fingerprints a real source dataset, customer records exported from a database, and flags any document containing a matching subset of that data, which is far more precise than a regex alone. Indexed Document Matching (IDM) does the same for unstructured files like contracts or source code. Machine-learning classifiers add a layer for content that does not follow a fixed format, distinguishing an internal financial model from a public press release based on structure and language patterns.

A typical policy: any outbound email containing five or more matches against the EDM fingerprint of the customer database, sent to a non-corporate domain, gets blocked and the sender's manager notified. New policies usually start in monitor-only mode for a few weeks so the security team can tune out false positives (internal test data, sample records, legitimate business processes) before flipping to block or quarantine.

DLP deployment points include network proxies inspecting outbound web and email traffic, endpoint agents watching file operations and removable media, cloud access security brokers (CASB) extending policy into SaaS apps like Google Workspace and Salesforce, and email security gateways applying content inspection before delivery. Attackers who have already gained a foothold sometimes try to evade DLP by splitting data across multiple small transfers, compressing and password-protecting archives to blind content inspection, or encoding data with base64 to obscure recognizable patterns, all of which DLP and downstream SIEM correlation should account for.