- Classification-heavy, "allow-and-deny" DLP creates false positives, endpoint performance issues, and blind spots like shadow AI—failing to protect data that is now decentralized, cloud-based, and more portable than ever across both structured and unstructured formats.
- Detecting real risk means understanding where files originated, where they're going, who's moving them (whether human or agent), and when—balancing content monitoring with other risk signals to catch data loss across all risk surfaces.
- Mimecast Incydr surfaces known and unknown risks from day one with AI-driven prioritization (no policy setup required) and offers a wide range of adaptive controls—from in-the-moment education to blocking to automated containment on the endpoint—so everyday mistakes and genuine insider threats are handled appropriately.
Blog
An evolving take on DLP for modern data security
Beyond allow-and-deny: why modern DLP demands context, user behavior, and risk-based response
By The Mimecast Cyber Insights Blog Team
Key Points
Understanding the evolving landscape of DLP
As we've developed the Mimecast Incydr product strategy, we've seen the urgency of organizations' need for data protection guidance in their questions about Data Loss Prevention (DLP). Inquiries on this subject remain consistently high, especially with the prevalence of GenAI tools and AI agents being adopted at a rapid pace. This reflects the significance of the data loss problem and underscores the volume of concerns surrounding data loss—despite investment.
The initial wave of DLP was primarily about defining parameters, setting up strict boundaries and monitoring transgressions. It was an era dominated by 'allow and deny' policies, heavy content inspection, and classification. It was also an era of complexity, endpoint performance issues, and false positives. But as workplaces grew more decentralized, cloud-based, and reliant on AI, the complexity of data protection increased.
Traditional, content-heavy, classification-based DLP solutions, while still prevalent, are not catering to the dynamic data security requirements of modern organizations to protect humans, data, and AI. So, with a persistent need for data protection that covers all risk surfaces including the endpoint, email, AI tools, and cloud, a wide array of options developed. Now, DLP isn't just a standalone product. It's a capability integrated into platforms from email security to agentic protection platforms. DLP also isn't complete without an underlying understanding of risk regardless of where it happens.
In fact, according to the Gartner Marketing Guide for Data Loss Prevention, 2025, Gartner projects that by 2027, 70% of CISOs in larger enterprises will adopt a consolidated approach to address both insider risk and data exfiltration use cases. The need to consider employee behavior, AI tools and agents, and changing patterns of work will drive evolution in DLP. It's not simply that files containing sensitive information live in one clear location or match certain patterns; the valuable data that drives businesses exists at the perimeter, and is more portable and being generated faster than ever.
Risk context is essential for effective operations around DLP. Human behavior can signal intent and risk, and is at the core of what Mimecast does. With the proliferation of AI tools and agents, if agentic risk is looked at without the human risk context, it creates noise and confusion for analysts. Modern DLP tools must understand and protect all of a company's risk surfaces and all of its data, both structured and unstructured.
Related Tags
- Data Protection
