Language

🇬🇧English🇩🇰Dansk🇸🇪Svenska🇩🇪Deutsch

Context

The same file is fine, and a breach

A CV sent to the hiring manager is work. The same CV sent to an external address is a disclosure. Nothing about the document changed. Any DLP that decides from the document alone is going to be wrong in one of those two cases, and people route around a tool that is wrong.

Book a demoSee DLP
INTERNALEXTERNAL

False positives

0.003%

because the decision uses the class, not the pattern

  1. ClassifyDecide what the data actually is.
  2. VerifyLet the person who owns it confirm.
  3. Act (this page)Block, strip, relabel or remove.

DLP

A DLP policy showing scope, exclusions by domain and address, action and the classes it watches
Scope, exclusions, action, classes. Where several policies match, the most specific scope wins, and a more specific policy is allowed to be the weaker one.

What it weighs

Three kinds of context that decide it

A blocked send that should have gone through costs more trust than the leak it prevented.

1

What the content actually is

Not whether a string matches a pattern. A sixteen-digit number in an invoice reference is not a payment card. Semantic classification, in 28 languages, with the document class rather than the regex hit as the thing the policy acts on.

2

Where it is going

Internal or external, and which external. Exclusions by domain and by individual address, so a partner you work with daily is not treated like a stranger. One excluded recipient is enough to leave a mail alone, which is why a weaker policy usually sits below a stronger one to catch what the exclusion let through.

3

Who is sending it

Scope by everyone, by selected people, by AD group or by department. Where several policies match, the most specific scope wins, and a more specific policy is allowed to carry the weaker action: the legal team can be trusted with what the rest of the organisation is blocked from sending.

Why it matters

What context buys you

01

Trust

Fewer wrong blocks

The cost of a false positive is not the interruption. It is that people learn the tool is unreliable and start working around it, which removes the protection entirely.

02

Nuance

Degrees of response

Log silently, monitor, alert the person, block, or grace-block to hold enforcement for a window so a human can override. Not everything needs the same answer.

03

Coverage

The same engine everywhere

The classification that decides a DLP action is the same one that produced your risk assessment and your Purview labels. One definition of sensitive, not three.

04

Honesty

Start by watching

Run in Log or Monitor first and see what would have been blocked. Tune against real traffic before anyone is interrupted.

Questions about context

How is this different from Microsoft's DLP?+
The classification underneath it. Microsoft's out-of-the-box classifiers are largely pattern-based; see the benchmark for what that does to passports and payment cards.
Does context mean it is slower?+
No. The decision happens in real time, in the tenant, as the message or file moves.
Where do I set this up?+
In the DLP module: sources, policies, scope, exclusions and action. See Data Loss Prevention.

See what your rules would catch

Run it in Monitor on one source and compare what would have been blocked against what should have been.