Key takeaway
Choose the three DLP types by channel and asset coverage, map overlaps and blind spots, then validate with policy tests.
DLP and data states
DLP is a set of policies and tools for detecting and preventing unauthorized loss, leakage and use. Data in use is open in an application; data in motion travels between networks and services; data at rest sits on a disk, server or cloud platform. A file can pass through all three states in a day, so one control may not cover its full path. Data states do not imply that every product supports all capabilities.
Network DLP
Network DLP inspects email, file transfers and web traffic. It can detect sensitive data sent to an unauthorized recipient and record when, by whom and where. Encrypted traffic and services outside the network can limit visibility, so include them in the coverage map. Visibility depends on routing, decryption and authorized inspection scope. Remote traffic can also traverse controlled gateways; test its actual route.
Endpoint DLP
Endpoint DLP can monitor file actions on supported managed platforms and channels. Verify printing, USB copying and app uploads by OS, browser, application and file type; mobile and server support varies by product. Test the agent off-network, cached offline rules and event delivery after connectivity returns.
Cloud DLP
Cloud DLP reviews files, sharing permissions and user activity across SaaS and cloud storage. It can classify sensitive content, identify unauthorized sharing and alert from application or API records. Confirm scan delay for new files, connected services and service-account coverage. API inspection may occur after object upload; inline transfer control requires a separate capability. DLP does not automatically include malware scanning.
Combine coverage
A sensitive file can sit on a device, cross a network and upload to the cloud. Compare which event each tool sees, its delay, owner and response options; record duplicate alerts and channels without full visibility. Connect DLP with EDR, identity, backup and incident response.
| Placement | Useful visibility | Boundary to test |
|---|---|---|
| Network | Transfers routed through the control | Encrypted and bypass paths |
| Endpoint | Supported local file actions | Offline enforcement and event reporting |
| Cloud | Integrated objects and sharing | API delay and unconnected apps |
Measure and respond
Test allowed and prohibited transfers with synthetic sensitive-data samples. Evaluate detection, blocking, approval and escalation, false positives and delivery to the alert owner. Set measurable acceptance criteria for remote-work, ransomware and exfiltration scenarios. In ransomware scenarios, test coordination with prevention, response and recovery; DLP alone cannot ensure prevention.