DLP (Data Loss Prevention)
Cloud DLP scans content across SWG, CASB, and ZTNA channels to detect and block sensitive data exfiltration. Modern DLP goes beyond regex: exact data matching (EDM), indexed document fingerprinting (IDM), and OCR for image-based detection. Deploy in monitor mode first — expect 15-20% false positive rate initially. Tune for 4-6 weeks before enabling enforcement.
DLP is the component most organizations deploy last and wish they had deployed first. Every other SASE component focuses on keeping bad things out. DLP focuses on keeping valuable things in — and in 2026, with every employee one browser tab away from pasting your source code into ChatGPT, it has become the most urgently needed capability in the stack. DLP catches the incidents that nothing else can: departing employees uploading CRM exports to personal cloud storage, developers pasting AWS credentials into AI coding assistants, finance analysts emailing pre-earnings data to personal Gmail. Without DLP, every one of those incidents goes completely undetected because the user had legitimate access — they just misused it.
DLP technology has evolved significantly from its early-2000s origins as a pattern-matching engine that flagged anything resembling a credit card number or Social Security number. Modern SASE-integrated DLP combines multiple detection techniques: regular expression pattern matching for structured data like credit card numbers and SSNs, exact data matching (fingerprinting) that creates a hash of actual sensitive records from your databases and detects when those exact records appear in transit, machine learning classifiers trained to recognize categories of content like source code, legal documents, financial reports, or medical records without needing explicit patterns, and optical character recognition (OCR) that extracts text from images and screenshots to detect sensitive data that has been screen-captured to bypass text-based detection.
The integration of DLP within SASE is a fundamental advantage over standalone DLP products. Because the SASE platform already inspects all web traffic (SWG), all SaaS application traffic (CASB), all non-web traffic (FWaaS), and all private application traffic (ZTNA), DLP policies can be applied consistently across every channel through a single policy engine. There is no gap between web DLP, email DLP, endpoint DLP, and cloud DLP — it is all the same engine, the same policies, and the same incident workflow.
What it does
Data Loss Prevention identifies sensitive data in transit across the network, at rest in cloud applications, and in use on endpoints, then enforces policies that prevent unauthorized disclosure, exfiltration, or mishandling of that data. DLP uses multiple detection techniques in combination: regular expression pattern matching identifies structured data like credit card numbers (PCI), Social Security numbers (PII), medical record numbers (PHI), and API keys. Exact data matching (fingerprinting) hashes actual sensitive records from your databases and detects when those exact records appear in any channel. Machine learning classifiers recognize categories of sensitive content — source code, legal contracts, financial statements, engineering designs — without needing explicit patterns. OCR extracts text from images and screenshots to catch data that has been screen-captured to evade text-based detection. The policy engine applies enforcement actions — block, quarantine, encrypt, alert, coach, or watermark — based on the data type, the user's identity, the destination, and the channel.
How it works
DLP in a SASE architecture operates across multiple inspection points simultaneously. At the SWG layer, DLP scans web uploads, form submissions, and file transfers to internet destinations, detecting sensitive data being exfiltrated to personal cloud storage, webmail, or AI chat services. At the CASB inline layer, DLP applies granular controls to SaaS application interactions — for example, allowing a user to upload files to corporate SharePoint but blocking uploads containing PCI data to a personal OneDrive. At the CASB API layer, DLP scans data at rest in sanctioned SaaS applications, classifying files, applying retention labels, and alerting on overshared sensitive documents. At the FWaaS layer, DLP can inspect non-web protocols for sensitive data exfiltration through channels like FTP, custom database exports, or SSH file transfers. At the ZTNA layer, DLP inspects traffic flowing through authorized tunnels to private applications, detecting data exfiltration even through legitimate access channels. For each detection, the DLP engine calculates a confidence score based on the number of matching patterns, the proximity of related context (a credit card number near an expiration date is higher confidence than a 16-digit number alone), and the volume of sensitive data in the transaction.
Why it matters
Data breaches through legitimate channels are the hardest threat to detect and the most damaging when they occur. An employee with authorized access to a customer database does not trigger any threat detection system when they export that database — they are doing something they are allowed to do. DLP is the only control that examines the content of what is being transferred, not just whether the user is authorized to perform the transfer. For regulatory compliance, DLP provides the technical control that maps to specific requirements in GDPR (Article 32, security of processing), PCI-DSS (Requirement 3 and 4, protecting stored and transmitted cardholder data), HIPAA (Technical Safeguards, access controls and transmission security), and SOX (internal controls over financial reporting). Beyond compliance, DLP protects competitive advantage: source code, product designs, pricing models, M&A plans, and customer lists are the crown jewels that competitors and nation-state actors target. A single source code leak can cost millions in competitive advantage; a customer data breach triggers notification requirements, regulatory fines, and reputational damage that dwarfs the cost of the DLP deployment.
Watch out
The number one mistake in DLP deployment is enabling blocking on day one. Every DLP implementation, without exception, generates false positives. Blocking legitimate business activity because a DLP rule incorrectly flagged a transaction as containing sensitive data will crater user productivity, flood the helpdesk with tickets, and create political opposition that can kill the entire project. Start every DLP deployment in monitor-only mode for 4-6 weeks minimum. During this period, tune detection rules to reduce false positives: adjust confidence thresholds, add context-based exceptions (the finance team legitimately handles PCI data), refine ML classifier training data, and build a whitelist of known-good destinations for sensitive data types. When you do begin enforcement, use coaching actions first — pop-up notifications that warn users and ask them to justify the action — before moving to hard blocks. Coaching reduces risky behavior by 60-70% with dramatically lower operational impact than blocking. Only apply hard blocks to the highest-risk channels: uploads to personal cloud storage, emails to personal webmail domains, and posts to AI chat services.
Vendor comparison — DLP
Cloud DLP with exact data matching (EDM), indexed document fingerprinting (IDM), OCR for images and screenshots, and 80+ predefined dictionaries for PCI, PII, PHI, and GDPR. Policies apply consistently across SWG, CASB, and email channels.
FortiSASE DLP provides pattern matching with predefined and custom data patterns for PCI, PII, PHI, and GDPR compliance. Supports file type filtering and keyword-based detection. Lacks advanced features found in specialized DLP platforms: no exact data matching (EDM), no indexed document matching (IDM), and limited OCR support for image-based data detection.
Enterprise DLP with exact data matching (EDM), indexed document matching (IDM), ML-based data classification, OCR for images, and 100+ predefined data patterns for global compliance frameworks. Policies apply consistently across SWG, CASB, email, and endpoint channels. Advanced features include proximity-based detection and multi-pattern correlation for reduced false positives.
Cloud DLP with predefined data patterns for common compliance frameworks (PCI-DSS, HIPAA, GDPR). Keyword matching, regex patterns, and file type controls. Policies apply across SWG and CASB channels. Lacks advanced capabilities found in enterprise DLP platforms: no exact data matching (EDM), no document fingerprinting (IDM), limited OCR, and basic pattern matching without ML-enhanced classification.
Enterprise DLP with exact data matching (EDM), indexed document matching (IDM), optical character recognition (OCR), and 80+ predefined dictionaries covering PCI, PII, PHI, GDPR, and custom patterns. Policies enforce consistently across SWG, CASB, and email channels. Strong capability set but configuration is complex — initial DLP tuning typically takes 4-6 weeks to reduce false positives to acceptable levels.
Best-in-class DLP with 3,000+ data classifiers, 1,800+ file type support, exact data matching, indexed document matching, ML-based classification, and OCR for images and screenshots. IDC MarketScape Leader for Data Security 2025. DLP On Demand (April 2025) extends inline DLP to email and endpoint channels. GenAI-specific DLP inspects prompts submitted to LLMs in real time — 47% of customers already deploy this. The Dasera acquisition adds DSPM for data-at-rest classification across cloud environments.
Inline DLP scanning integrated into the SPACE single-pass engine with predefined data patterns for PCI, PII, PHI, and GDPR compliance. Supports regex pattern matching, keyword detection, and file type controls across SWG and CASB channels. The 20MB file scanning limit is a real constraint for organizations dealing with large documents, presentations, or data exports. No audio or video content scanning. Classification maturity trails Netskope (ML-based classifiers) and Microsoft Purview (exact data matching, document fingerprinting at scale). Adequate for standard compliance use cases but not for organizations with sophisticated DLP requirements.
DLP ships predefined profiles (PCI, PII, credentials) on PAYG plans, but custom DLP policies with user-defined patterns require contract-tier licensing. The DLP engine scans HTTP traffic inline through Gateway SWG and integrates with CASB for SaaS data-at-rest scanning on enterprise plans. Missing EDM (exact data matching), IDM (indexed document matching), and ML-based classification that Cisco, Palo Alto, and Netskope offer. Adequate for basic compliance patterns, not yet competitive for enterprise data protection programs.
Related guides & articles
DLP is part of the SASE/SSE stack. See how all six capabilities fit together and compare vendors.