4

Data Loss Prevention

SL-08

The last-mile control. Enforcement decisions are driven by what Discovery classified the data as and what consent it carries — not by static patterns, which is the difference between precision blocking and a wall of false positives.

DischargesS.8(4)R.6S.6S.9
TuningPolicies
Incidents (30 days)
72
Awaiting triage
12
View
Potential breaches
15
Involving children
7
Blocked or quarantined
54
Agents needing attention
12
View
Enforcement over the last fortnight

Blocked and quarantined transfers versus those allowed with a warning.

Incident classification

How each event was assessed.

  • Policy violation37
  • Security incident20
  • Potential personal data breach15
Incidents by channel

Where data actually tries to leave.

Most-triggered policies

A high hit count with a high false-positive rate is a tuning problem, not a security win.

All policies
  • MediumRedact identifiers in printed outputPrintSimulate38622.4% FP
  • HighWarn on personal data submitted to unsanctioned web servicesWeb & API20414.6% FP
  • CriticalBlock outbound email containing government identifiersEmail1483.1% FP
  • HighPrevent bulk copy to removable mediaEndpoint918.9% FP
  • CriticalQuarantine children's data leaving the departmentEmailCloud & SaaSWeb & APIConsent-aware626.4% FP
  • CriticalBlock sharing of data with withdrawn consentEmailCloud & SaaSWeb & APIConsent-aware341.2% FP
Recent incidents

Newest first. Anything classified as a potential personal data breach can be escalated to the war-room in one click.

All incidents

16 L records covered across all incidents in the period.

Related

PoliciesClassification-driven rules across every channel, including the consent-aware rule that blocks sharing after withdrawal.ChannelsEmail, endpoint, cloud, web and API, database and print — with coverage and enforcement mode for each.Tuning & simulationRun a policy in simulate mode and see what it would have blocked before it blocks anything.Classification workbenchDLP precision is bounded by classification quality. Fix it there and enforcement improves everywhere.