Context
The same file is fine, and a breach
A CV sent to the hiring manager is work. The same CV sent to an external address is a disclosure. Nothing about the document changed. Any DLP that decides from the document alone is going to be wrong in one of those two cases, and people route around a tool that is wrong.
False positives
0.003%
because the decision uses the class, not the pattern
- ClassifyDecide what the data actually is.
- VerifyLet the person who owns it confirm.
- Act (this page)Block, strip, relabel or remove.
DLP
What it weighs
Three kinds of context that decide it
A blocked send that should have gone through costs more trust than the leak it prevented.
What the content actually is
Not whether a string matches a pattern. A sixteen-digit number in an invoice reference is not a payment card. Semantic classification, in 28 languages, with the document class rather than the regex hit as the thing the policy acts on.
Where it is going
Internal or external, and which external. Exclusions by domain and by individual address, so a partner you work with daily is not treated like a stranger. One excluded recipient is enough to leave a mail alone, which is why a weaker policy usually sits below a stronger one to catch what the exclusion let through.
Who is sending it
Scope by everyone, by selected people, by AD group or by department. Where several policies match, the most specific scope wins, and a more specific policy is allowed to carry the weaker action: the legal team can be trusted with what the rest of the organisation is blocked from sending.
Why it matters
What context buys you
Trust
Fewer wrong blocks
The cost of a false positive is not the interruption. It is that people learn the tool is unreliable and start working around it, which removes the protection entirely.
Nuance
Degrees of response
Log silently, monitor, alert the person, block, or grace-block to hold enforcement for a window so a human can override. Not everything needs the same answer.
Coverage
The same engine everywhere
The classification that decides a DLP action is the same one that produced your risk assessment and your Purview labels. One definition of sensitive, not three.
Honesty
Start by watching
Run in Log or Monitor first and see what would have been blocked. Tune against real traffic before anyone is interrupted.
Questions about context
How is this different from Microsoft's DLP?+
Does context mean it is slower?+
Where do I set this up?+
See what your rules would catch
Run it in Monitor on one source and compare what would have been blocked against what should have been.