Of all the security techniques aimed at ensuring data security and combating data breaches, data loss prevention tools are far and away the most common. DLP tools continuously monitor and analyze data to identify security policy violations and, if appropriate, stop them from continuing. DLP tools run the gamut, from those focusing on a single part of an organization, such as email services or laptops, to ones specializing in data backup, archival and restoration.
Some DLP tools encompass the entire organization -- and these are the focus of this article. First, let's discuss some must-have features and capabilities. Then, take a close look at six enterprise DLP tools for the information needed when evaluating the best product for your company's needs.
Must-have DLP tool features and capabilities
Enterprise DLP tools contain a wide range of features and capabilities. The following are the most essential:
- The ability to automatically discover, inventory and classify sensitive data and its metadata. Data is constantly being created and changed, so a DLP tool unable to keep pace with potential data leaks is always missing things.
- The ability to analyze data in the following circumstances:
- In any state -- in use, at rest or in transit.
- In any location, including user endpoints, on-premises servers, networks and cloud services.
- In any application, such as email, web, messaging platforms, social media, file sharing and generative AI technologies.
- The ability to use several types of analyses to accurately find problems. All analysis should take into consideration the context of the communication because activity that's completely normal in one context could be highly suspicious in another. Examples of analysis include the following:
- Looking for suspicious values -- e.g., "confidential."
- Doing complex pattern-matching -- e.g., to find credit card numbers.
- Finding copies of known sensitive data.
- Performing statistical analysis of data activity.
- Studying user behavior.
- The ability to act in one of several ways when the DLP software discovers a potential policy violation. For example, in one situation, you might want the tool to log a possible violation and alert an administrator. In another, you might want the tool to stop a data transfer, initiate an incident report through your SIEM system and immediately involve your incident response team in handling the attempted breach. Tools might also be able to proactively fix basic policy violations, such as encrypting sensitive stored data.
Leading enterprise DLP tools
The following six tools are a sampling of what's offered. Many other DLP tools are available, each with its own unique combination of features and capabilities. These organization-wide DLP tools were selected based on market research. They have sizable customer bases, are under active development and have publicly available user reviews contributed by verified purchasers of DLP products and services. This list is organized alphabetically.
CrowdStrike Falcon Data Protection
Key features
- Single platform for all protected endpoints and cloud instances.
- Visibility into data flows and understanding of a data flow's context based on defined data classifications.
- Includes methods for detecting and stopping data leaks involving the use of GenAI technologies.
Pros
- Makes use of the same agent already used for other Falcon products, like its endpoint detection and response offerings.
- Many users commented on the high quality of the visibility it provides into data flows.
Cons
- Some users cite the high price of Falcon Data Protection compared with other enterprise DLP tools.
- The learning curve and amount of time needed to deploy, configure and manage the tool are more extensive than users had expected.
Modules
- Falcon Data Protection for Endpoint.
- Falcon Data Protection for Cloud.
Digital Guardian by Fortra
Key features
- SaaS DLP with automated data discovery and data classification capabilities for both known and unknown data types.
- Granular policies available to protect sensitive data and restrict its movement.
- APIs and integration with several major technology vendors.
Pros
- Supports managed services.
- Offers excellent customer support and on-demand training.
Cons
- Configuring and managing policies can be challenging for some users.
- Users have reported implementation and operational complications that have taken longer to address than they expected.
Modules
- Analytics & Reporting Cloud (ARC).
- Endpoint DLP Agent for Windows, Linux and macOS.
- Network DLP as a physical appliance, VM or cloud-based image.
- Management Console.
Forcepoint DLP
Key features
- Performs several types of analyses, including optical character recognition, and detecs custom encryption usage.
- Uses a single analysis engine for data in motion, at rest and in use, ensuring consistency, in conjunction with GenAI technology to improve analysis accuracy.
- Provides policy templates for major security and privacy regulations around the world.
Pros
- Provides broad, highly effective monitoring and analysis capabilities.
- Offers exposed REST APIs for integration with various incident management tools.
Cons
- According to users, the learning curve for deployment can be steep, and agent deployment can be particularly time-intensive.
- Some users have noted significant negative impacts on performance.
Modules
- Forcepoint DLP Endpoint for Windows and macOS user endpoints.
- Forcepoint CASB (cloud access security broker) for popular SaaS applications.
- Forcepoint Web Security for web browsing and downloads.
- Forcepoint DLP Discovery for sensitive data discovery, inventory and classification.
- Forcepoint DLP Network for data sent over networks through email, web and FTP activity.
- Forcepoint DLP for Cloud Email for data sent through outbound emails.
- Forcepoint DLP App Data Security API for data in custom applications and services.
Proofpoint Enterprise DLP
Key features
- Supports integration with Proofpoint's data discovery and classification platform to improve Enterprise DLP's efficiency.
- Takes a people-centric approach to identifying and preventing data loss, emphasizing context such as content, behavior and threats.
- Can share customized policies and other configurations across Proofpoint DLP modules.
Pros
- Highly customizable rules and dictionaries.
- Relatively easy to set up and configure compared with other DLP products, according to some users.
Cons
- Some users complain of too many false positives and the effort needed to address them.
- UI lacks tools and templates found in competing products.
Modules
- Enterprise DLP, which includes Endpoint DLP, Cloud DLP and Email DLP capabilities.
- Endpoint DLP.
- Email DLP.
- Cloud DLP in Proofpoint's CASB offering.
Symantec DLP by Broadcom
Key features
- Provides a single console for monitoring and managing all DLP components.
- Uses a single policy mechanism for all its detection and enforcement capabilities.
- Offers a variety of enforcement capabilities, including integration with Microsoft Purview Information Protection.
Pros
- Many users find the UI flexible and easy to use.
- Fast data discovery and strong detection of policy violations reported.
Cons
- Considered more expensive than most other DLP tools.
- Operational disruptions are sometimes caused by upgrades.
Modules
- DLP Core Solution, a suite of 10 on-premises components, including DLP Endpoint Discover, DLP Network Protect and DLP Form Recognition.
- DLP Cloud, a bundle of six cloud-based components with an add-on for protection against malware.
Trellix DLP
Key features
- Offers several methods for protecting sensitive information, including options to block data from the following:
- Being saved to USB drives and other media.
- Being recorded via screen captures.
- Being sent to printers.
- Being posted to websites.
- Offers integrations with third-party tools for data classification, orchestration and incident response.
- Provides strong, flexible options for data classification.
Pros
- Users consider the data protection methods highly effective.
- Many users like the management console's UI.
Cons
- Some users have reported configuration and policy creation difficulties and a steep learning curve.
- Agents sometimes run slowly or interfere with other applications, especially on older platforms.
Modules
- Trellix DLP Discover.
- Trellix DLP Network Prevent.
- Trellix DLP Network Monitor.
- Trellix DLP Endpoint Complete.
- Trellix DLP Device Control.
Karen Kent is the co-founder of Trusted Cyber Annex. She provides cybersecurity research and publication services to organizations and was formerly a senior computer scientist for NIST.