Executive Summary
Run every DLP policy in monitor mode first, on your own data. The false matches you count there decide whether the policy can ever block.
Data loss prevention (DLP) software finds sensitive data, watches where it goes, and stops it leaving through channels the policy does not allow: email, web uploads, cloud apps, USB drives, printers and prompts typed into AI tools. NIST defines data loss prevention as a system’s ability to identify, monitor, and protect data in use, data in motion, and data at rest through deep packet content inspection and contextual security analysis of transaction, within a centralized management framework.
DLP vendors fall into five approaches, by where the product sits: a suite with its own endpoint agent and network servers, a platform that scores user behavior as well as content, DLP built into the productivity suite, inline DLP in a security service edge (SSE), and DLP as one service of a SASE platform. The table in the vendor section names eight vendors across those five approaches. The choice usually follows what the organization already runs: its email and collaboration suite, its web proxy, or its endpoint agent.
Ownership has moved in this market. Four of the eight vendors in the table belong to a larger company or a private equity firm, and one of those four has agreed to buy a data security vendor. Section 5 sources each change to the companies’ own announcements.
What Is Data Loss Prevention Software?
DLP software does three jobs. It finds and classifies sensitive data where it is stored. It watches that data when people use it on a device or send it across the network. It applies a policy to each event: allow it, warn the user, ask for a justification, encrypt the file, move it to quarantine, or block it.
Detection decides whether a DLP program survives. Pattern matching with regular expressions and keyword dictionaries finds card numbers and national ID formats, and also finds numbers that only look like them. Exact data match (EDM) fingerprints the values in a real table, such as a customer list, and fires only on those values. Indexed document matching (IDM) fingerprints whole documents and forms, such as a contract template. Machine-learning classifiers recognize categories that no pattern describes, such as source code or a board paper. Optical character recognition (OCR) reads text in screenshots and scanned images.
Most DLP programs start with regulated data. HHS states that the HIPAA Breach Notification Rule requires HIPAA covered entities and their business associates to provide notification following a breach of unsecured protected health information. HHS states that if a breach affects 500 or more individuals, covered entities must notify the Secretary without unreasonable delay and in no case later than 60 days following a breach. HHS guidance specifies encryption and destruction as the technologies and methodologies for rendering protected health information unusable, unreadable, or indecipherable to unauthorized individuals, and covered entities and business associates that secure information as the guidance specifies are relieved from providing notifications following a breach of that information. Encryption is one of the actions a DLP policy can take, so the DLP encryption rules and the breach response plan should be written together.
Payment card data, personal data under state and national privacy laws, and intellectual property such as designs and source code are the other common starting points. Each needs a named owner who can say which channels may carry it and to whom.
Endpoint, Network and Cloud DLP, and Where DSPM Fits
DLP has three enforcement points, and most products are known for the one they started with. Endpoint DLP is an agent on the laptop or server. It sees copy and paste, printing, screen capture, USB drives and browser uploads, and it keeps working off the corporate network. Network DLP inspects traffic as it leaves: email through the mail gateway, and web uploads through a proxy or a security service edge. Cloud DLP connects to SaaS applications and cloud storage through their APIs and scans what is stored and shared there.
One policy across the three is the main thing to test. Separate tools each need their own classifiers, policies and incident queue, and they disagree about what is sensitive. Several vendors in Section 5 state that one policy covers several channels. Write one policy for a customer record type and check that the endpoint, the email channel and a cloud app enforce it the same way.
Generative AI added a channel. Text pasted into a chat prompt leaves the organization the way an email does, and a file uploaded to an AI tool is a web upload. Netskope states that Netskope One DLP provides real-time inline inspection for data flowing into and out of applications like ChatGPT. Ask each vendor which AI tools it inspects inline, which it sees only through the browser or endpoint, and which it cannot see.
Data security posture management (DSPM) overlaps with DLP at discovery. DSPM scans cloud data stores and SaaS for sensitive data, works out who can reach it, and flags exposure such as a public storage bucket or an overshared folder. DLP acts when data moves. The two are converging. Zscaler states that Zscaler Data Security unifies classification and data security posture management (DSPM) with an inline DLP proxy. One DLP vendor in Section 5 has also agreed to buy a data security platform vendor. The DSPM guide covers posture tools, and the CASB guide covers SaaS access and sharing controls.
| Where it runs | What it sees | What it misses | |
|---|---|---|---|
| Endpoint DLP | An agent on laptops, desktops and servers | Copy and paste, print, screen capture, USB, browser uploads, on or off the network | Devices without the agent, and data already in SaaS |
| Network DLP | Mail gateway, web proxy or security service edge | Email, attachments and web uploads as they leave | Traffic that bypasses the proxy, and encrypted traffic it does not decrypt |
| Cloud DLP | API connections to SaaS and cloud storage | Files stored and shared in sanctioned cloud apps | Apps it has no connector for, and data on devices |
| DSPM | Scans of cloud data stores and SaaS | Where sensitive data sits and who can reach it | Data in motion; it reports exposure rather than stopping a transfer |
How do you evaluate Data Loss Prevention (DLP) Software?
Test detection on your own data. Ask each vendor to run its classifiers over a sample of your real records and documents in monitor mode, and count the true matches and the false ones. A vendor’s demonstration data matches its classifiers by design.
Then test the actions. Blocking is one of several. Coaching shows the user why an action is risky and lets them cancel it or give a reason, and the reason is logged for the incident team. Encryption and quarantine protect the file without stopping the work.
Incident handling decides how many people the program needs. Ask how incidents are grouped, who can see file contents, how evidence is kept, and whether an incident can go to the data owner instead of the security team.
User risk is the newest axis. Some products score each user’s behavior and tighten the policy when it changes, such as a departing employee downloading files in bulk. Ask what signals feed the score, who can see it, and what your works councils or privacy officers need to approve before it is switched on.
| Capability | What it does | What to ask |
|---|---|---|
| Exact data match (EDM) | Matches the actual values from your own tables | How many rows, how often the fingerprints refresh, and where they are stored |
| Indexed document matching (IDM) | Matches documents and forms, or parts of them | Whether partial copies and edited versions still match |
| Machine-learning classifiers | Recognize categories such as source code or contracts | Which classifiers ship, and whether you can train your own |
| OCR | Reads text in images and scanned files | Which channels run OCR, and what it adds to inspection time |
| Endpoint agent | Controls copy, print, USB and uploads on the device | Which operating systems, and what it enforces off the network |
| Email and web inspection | Inspects messages and uploads as they leave | Whether it needs your proxy or gateway, and how it handles encrypted traffic |
| Cloud app coverage | Scans files stored and shared in SaaS | Which apps have API connectors, and how fast it acts on a share |
| AI prompts and uploads | Inspects text and files sent to AI tools | Which tools, and whether inspection is inline or after the fact |
| User coaching | Warns the user and records a justification | Whether messages can be written per policy and per language |
| Incident workflow | Groups events into cases for review | Role-based access to evidence, and routing to data owners |
| User risk scoring | Adjusts enforcement by user behavior | Which signals, and who can see a user’s score |
Vendors in Data Loss Prevention (DLP) Software
Representative vendors include Forcepoint DLP, Microsoft Purview DLP, Netskope One DLP, Palo Alto Networks Enterprise DLP, Proofpoint (Enterprise DLP), Symantec Data Loss Prevention (Broadcom), Trellix Data Loss Prevention and Zscaler Data Protection (Zscaler Data Security). The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors
The DLP vendors below are grouped by where the product sits. Ask each vendor to confirm in writing which channels, which operating systems and which deployment model the quote covers.
The first approach is a DLP suite with its own endpoint agent, network servers and discovery scans. Broadcom states that Symantec DLP scans laptops and mobile devices, network file shares, databases, and sanctioned and unsanctioned cloud apps, such as Office 365, G-Suite, Box, and Salesforce. Broadcom lists User Entity Behavior Analytics (UEBA) that assigns a risk score for people and behaviors. Broadcom states that incident remediation can be decentralized using ServiceNow, reducing the workload on InfoSec teams. Broadcom offers a Symantec Data Loss Prevention Cloud Solution that combines its CASB and DLP Cloud Services into a single bundle. Broadcom announced on Nov. 4, 2019 that it had completed its acquisition of the Enterprise Security business of Symantec Corporation. Trellix lists protection for Windows and macOS workstations and servers on-premises or via SaaS. Trellix lists finding and classifying sensitive data across more than 400 file types. Trellix lists integration of policies with email and web gateways to protect sensitive information. Trellix states that it partners with Skyhigh Security to extend its DLP into cloud data repositories. Trellix states that Symphony Technology Group (STG) launched Trellix in January 2022 from the merger of McAfee Enterprise and FireEye, as part of the STG portfolio. Fortra states that it has acquired Digital Guardian, a SaaS provider of data loss prevention (DLP) solutions for large and mid-sized organizations. A request for digitalguardian.com is answered by Fortra’s data loss prevention page. Fortra states that its Data Loss Prevention (DLP) is available as a Software-as-a-Service or managed service deployment. Fortra states that its endpoint DLP monitors user activity and blocks threats across Windows, macOS, and Linux.
Two vendors build enforcement around the user as well as the content. Forcepoint states that it uses artificial intelligence to discover, classify and monitor structured and unstructured data, with enforcement that reduces false positives and adapts based on context and user behavior. Forcepoint states that Forcepoint DLP unifies network DLP, endpoint DLP and cloud DLP under a single policy engine and console. Forcepoint lists 2,000+ classifiers and policy templates to identify and secure PII and other types of sensitive data. Forcepoint states that Forcepoint DLP is deployable on-premises, in the cloud or hybrid. Forcepoint states that Francisco Partners continues to own Forcepoint’s Commercial business. Proofpoint states that Proofpoint Enterprise DLP combines data visibility with user behavior insight to identify risk and prevent data loss. Proofpoint states that it protects sensitive data across email, cloud apps, and endpoints, with investigation and response in a single console. Proofpoint lists monitoring and control of USB transfers, web uploads, and other common exfiltration and data leak paths. On October 15, 2026, Varonis and Proofpoint, a portfolio company of Thoma Bravo, announced a definitive agreement under which Varonis will be acquired by Proofpoint. Proofpoint states that the transaction is expected to close in the first half of 2027, subject to approval by Varonis shareholders and regulatory approvals.
One vendor builds DLP into the productivity suite, so policies follow the mail, files and chat it already hosts. Microsoft states that DLP targets Microsoft 365 locations, like Exchange and SharePoint, and locations you add, like on-premises file shares, endpoint devices, and non-Microsoft cloud apps. Microsoft states that Endpoint DLP extends DLP activity monitoring and protection to Windows 10/11, macOS (the three latest released major versions) devices, and certain Windows server versions. Microsoft states that data security and compliance value associated with user-based protection in Microsoft 365 is available in the Microsoft Purview Suite, which requires Microsoft 365 E3, and that data security across data estates, networks, generative AI apps, and agents is pay as you go.
Two vendors run DLP inline in a security service edge, on the same proxy that inspects web and SaaS traffic. Zscaler states that Zscaler DLP is natively integrated in an inline security cloud and, as part of a security service edge (SSE), eliminates the costs and complexity of point products. Zscaler states that DLP scales to emails and attachments without configuration changes via SMTP relay. Zscaler states that Zscaler Endpoint DLP enforces DLP policies over key exfiltration channels like removable storage, network shares, and printing. Netskope states that Netskope One DLP uses a single policy framework that covers web, SaaS, email, endpoints, and AI environments. Netskope states that rather than silently blocking a user and generating a ticket for the security team, it delivers an in-context pop-up alert to the employee. Netskope states that by combining DLP with AI-driven UEBA (User and Entity Behavior Analytics), the platform detects patterns that indicate intent, not just content.
One vendor sells DLP as a cloud service of its SASE platform. Palo Alto Networks describes Enterprise DLP as a unified service with a single AI powered classification engine for all channels, where a policy is defined once and enforced everywhere. Palo Alto Networks states that Enterprise DLP combines regex, dictionaries, document types, Exact Data Matching (EDM), Indexed Document Matching (IDM), shadow data discovery, ML classifiers, and LLM-augmented detection. Palo Alto Networks lists thousands of data identifiers and over 100 trainable ML classifiers. Palo Alto Networks states that Enterprise DLP protects sensitive data at rest and in motion across web, email, SaaS, cloud, endpoints, browsers, and GenAI applications.
| Vendor | Approach | Where it fits |
|---|---|---|
| Palo Alto Networks Enterprise DLP | DLP as a SASE platform service | One classification engine for all channels; EDM, IDM, ML and LLM-augmented detection |
| Microsoft Purview DLP | DLP inside the productivity suite | Microsoft 365 locations, on-premises file shares, Windows and macOS endpoints; Purview Suite licensing |
| Netskope One DLP | Inline DLP in a security service edge | One policy for web, SaaS, email, endpoints and AI; user coaching; UEBA |
| Zscaler Data Protection (Zscaler Data Security) | Inline DLP in a security service edge | Inline DLP on the SSE proxy; email via SMTP relay; endpoint DLP on the same policies |
| Symantec Data Loss Prevention (Broadcom) | Multi-channel DLP suite | Scans endpoints, file shares, databases and cloud apps; UEBA risk scores; a Cloud Solution bundle with CASB |
| Trellix Data Loss Prevention | Multi-channel DLP suite | Windows and macOS endpoints on premises or SaaS; discovery across 400+ file types; Skyhigh Security for cloud repositories |
| Forcepoint DLP | User-risk DLP | One policy engine for network, endpoint and cloud; 2,000+ classifiers and templates; on premises, cloud or hybrid |
| Proofpoint (Enterprise DLP) | User-risk DLP | User behavior with data detection across email, cloud apps and endpoints; one console |
Eight vendors across five approaches; three approaches hold two vendors each. Each approach was written before a vendor was assigned to it, and the eight rows carry over the vendors the previous edition evaluated. Placement in this table is not for sale. Fortra (Digital Guardian) appears with the first approach in the text above, and any DLP vendor can make its own case in the Spotlight below.
How much should you budget for Data Loss Prevention (DLP) Software?
DLP is sold as a subscription, usually per user per year. Some suites price network servers, discovery scanners and cloud connectors separately, and a bundle with a CASB, a web gateway or an email gateway changes the per-user rate. Compare quotes for the same channels and the same number of users.
None of the vendor pages checked for this edition publishes a DLP list price, so every figure comes from a quote. Licensing structure is published in one case. Microsoft states that data security and compliance value associated with user-based protection in Microsoft 365 is available in the Microsoft Purview Suite, which requires Microsoft 365 E3, and that data security across data estates, networks, generative AI apps, and agents is pay as you go. Ask each vendor which features sit in which tier, and whether endpoint, email and cloud coverage are priced separately.
A managed service changes the cost from staff to subscription. Fortra states that its Data Loss Prevention (DLP) is available as a Software-as-a-Service or managed service deployment. Ask any vendor offering a service who tunes the policies, who reviews incidents, and what response time the contract states.
The larger cost is people. Policy tuning, incident review and exceptions take analyst time every week, and the number of false matches decides how much. A product that costs less per user but fires more false matches can cost more to run.
| Model | You are charged for | Grows with | Where it goes wrong |
|---|---|---|---|
| Suite license, per user | Endpoint, network and discovery modules | Users and modules | Network and discovery servers left out of the hardware and hosting budget |
| Productivity suite tier | DLP inside a higher tier or add-on of the suite | Every user on that tier | Paying the whole tier for users who never touch sensitive data |
| SSE or SASE module | DLP as an add-on to the proxy or platform | Users and bandwidth | Coverage only for traffic that passes through the proxy |
| Managed service | The product plus analysts who run it | Users and service level | Response times and tuning effort not written into the contract |
How long does implementation take for Data Loss Prevention (DLP) Software?
A DLP rollout moves from finding data, to watching it, to coaching users, to blocking, one channel at a time. Microsoft advises planning DLP policies and deploying them in simulation mode, and evaluating their impact, before running them in more restrictive modes. Use the same order whichever product you choose.
Name the data types to protect and their owners. Build EDM and document fingerprints from real sources, and scan file shares and cloud storage to find where the data sits.
Turn policies on in monitor or simulation mode for every channel. Count true and false matches per policy each week, and tune until data owners agree the alerts are right.
Switch the tuned policies to user notifications and justifications. Read the justifications: they show which business processes need an approved path.
Block on one channel at a time, starting where false matches are lowest, usually email to external recipients. Review exceptions monthly and retire policies nobody owns.
What should you ask vendors about Data Loss Prevention (DLP) Software?
Ask each vendor to answer in writing and to demonstrate on your own data, in your own tenant or network.
-
Does most of your sensitive data live in one productivity suite?Yes Start with that suite’s DLP, and test what it misses on endpoints and other cloud apps.No Compare suites and platforms that cover several clouds and on-premises stores.
-
Does your web and SaaS traffic already pass through a security service edge?Yes Price DLP as a module of it, and test endpoint and email coverage.No Weigh a standalone suite against adding a security service edge.
-
Is insider risk the main concern?Yes Shortlist products that score user behavior, and involve privacy and HR early.No Weight detection accuracy and channel coverage first.
Data Loss Prevention (DLP) RFP package: 123 questions, 10 demo scenarios and a vendor scorecard
RFP packages are a separate paid product. Vendors do not pay to appear in buyer guides.