We have been called to look at enough switched-off DLP deployments to know the pattern. Somebody enabled vendor default policies in blocking mode, finance could not send an invoice, and within a fortnight the whole thing was disabled and written off as unworkable. The tool was fine. The rollout order was wrong.
Monitor before you enforce
Run every policy in audit mode first. You are not looking for violations at this stage. You are learning what normal traffic looks like in your business, which is the only way to tell a genuine risk from a routine Tuesday.
- Run for several weeks, long enough to cover a month-end and any reporting cycle
- Review what would have been blocked, and be honest about how much of it was legitimate
- Tune the rules against that real data rather than against the vendor's assumptions
- Only then enforce, starting with the clearest high-risk cases
Classification is a business decision
IT cannot judge what is sensitive. A contract, a design file and a client list all look like documents from a console. Getting the data owners to agree classification is the step that determines whether DLP produces signal or noise, and it is the step most often skipped because it requires meetings rather than configuration.
- Use a small number of labels. Elaborate schemes do not get applied
- Automate classification where content patterns allow it, such as card numbers or ID formats
- Accept that most company data is not sensitive and should be left alone
- Get the owners of each data category to sign off, so the policy has business backing
Protect less, protect it properly
Trying to protect everything equally is how DLP becomes noise, and noise is how it gets switched off. Protect the small share that genuinely matters.
Warn before you block
| Action | When to use it | Effect on staff |
|---|---|---|
| Audit only | Initial deployment, and permanently for low-risk cases | None |
| Warn and justify | Most policies, most of the time | User proceeds with a logged reason |
| Block | Bulk sensitive data to personal destinations | Hard stop, needs strong justification |
Warn-and-justify is the mode that does most of the work. It makes the person pause, records why they proceeded, and gives you a genuine audit trail without stopping legitimate business. Most policies should live here permanently rather than graduating to blocking.
Which routes actually matter
- 1Email to personal addresses, which is the most common route by a wide margin
- 2Personal cloud storage synced onto a work machine
- 3Removable media, which matters more in design and engineering than in professional services
- 4Over-shared links set to anyone with the link and then forwarded
- 5Screenshots and photographs of a screen, which no DLP tool catches and which you should plan for accordingly
Tell people it exists
Covert monitoring damages trust badly when it is discovered, and it will be discovered. Disclosure costs you almost nothing in effectiveness, because the people you are actually worried about are careless rather than sophisticated. Put the policy in writing and tell staff what it covers.
Plan the response, not just the alert
Decide before you deploy who receives alerts, who reviews them with context, and what happens when one turns out to be genuine. Agree it with HR and management in advance. DLP that only generates logs nobody acts on is an expensive way to feel protected.
Deploying DLP, or restarting a failed one?
We deploy monitor-first, facilitate classification with your data owners, and agree the response process before anything is enforced.
