Key Takeaways
- 01Identity gets the budget, networks get the segmentation projects, data tends to get a DLP rule and a quarterly classification reminder. That is the gap most enterprises will spend the next several years closing.
- 02What works: schema-aware tagging (sensitivity flows with the column, not just the document), tokenization at rest for the highest-sensitivity classes, Data Detection and Response for movement signal, lineage for analytics + AI pipelines, and egress controls keyed to classification (not to user role).
- 03Move detection upstream — into the database, document store, data warehouse — where schema and lineage tell you what the data is. Then the egress DLP only enforces a small set of clean rules. Free-text regex DLP at egress is the noise generator everyone complains about.
- 04Generative AI changed the data perimeter. Treat prompts and embeddings as first-class data classes — prompt-layer DLP, embedding leakage detection, and entitlement-aware RAG are now table stakes.
Identity gets the budget. Networks get the segmentation projects. Data tends to get a DLP rule and a quarterly classification reminder. That is the gap most enterprises will spend the next several years closing.
What works in real programs
- 01Schema-aware tagging — sensitivity flows with the column, not just the document
- 02Tokenization at rest for the highest-sensitivity classes
- 03Data Detection and Response (DDR) for movement signal
- 04Lineage for analytics and AI pipelines — provenance, not just classification
- 05Egress controls keyed to classification, not to user role
DLP without the noise
Traditional DLP fails when the rule set is built from regex on free text. Move the detection upstream — into the database, the document store, the data warehouse — where the schema and lineage tell you what the data is. The egress DLP then only has to enforce a small set of clean rules.
AI training and inference
Generative AI changed the data perimeter. Treat prompts and embeddings as first-class data classes. Prompt-layer DLP, embedding leakage detection, and retrieval-augmented generation that respects user-level entitlements are now table stakes.
#Data Security#DLP#Tagging