As a representative of a Next-Gen DLP vendor – a key instrument for ensuring information security – I can say that AI tooling does, in fact, enhance the effectiveness of addressing security challenges. The key question, however, is how well these capabilities are integrated into the system. Let me share our experience with the effective implementation of AI capabilities within a DLP solution.
AI should be implemented to address tasks where it is proven to be effective, rather than delegating the entire security function to it.
AI functionality has proven its effectiveness in detecting suspicious behaviour. Advanced Next-Gen DLP systems leverage these capabilities for proactive risk identification, enabling organisations to respond in a timely manner and take measures to prevent incidents. The role of AI lies in the fact that it improves the accuracy of detecting suspicious behaviour and decreases the rate of false positives in behavioural analytics systems. Modern systems can already distinguish genuine risks from normal user activity, whereas just a few years ago false positives accounted for nearly a third of alerts. As AI capabilities continue to evolve, detection is becoming more accurate, consistent and practical for real-world use.
Integrate for effectiveness
The effectiveness of information security can be enhanced by integrating DLP with a SIEM system. On the infrastructure side, SIEM platforms remain a cornerstone of identity protection. They consolidate and analyse events across the entire environment – recording who logged in, when, from where, and what actions were performed. This unified visibility helps security teams quickly spot anomalies, such as unusual activity under an employee’s account.
The implementation of AI capabilities within DLP makes it possible to address areas that have traditionally remained a blind spot in information security.
Preventing data leaks through atypical channels
An employee can attempt to take a photo of sensitive information displayed on their workstation screen. By integrating computer vision technology, the DLP system can help proactively prevent such data leaks. Traditionally, if an insider attempts to capture confidential data using a smartphone they leave no digital trace of the incident. AI-enhanced DLP system allows to configure a policy that activates the webcam whenever a user opens documents containing sensitive content. If the system detects an object resembling a smartphone pointed at the screen, it instantly identifies the potential threat and alerts the information security team. This enables a rapid response to prevent the leak before it occurs – closing a critical gap in traditional monitoring tools. In addition, in the event of such a violation, a DLP system can add a special label that remains on the image, making it easy to identify the culprit if a data leak occurs: a watermark containing an indicator that points to a specific PC and its owner.
Combatting phishing
AI functionality has also proven effective in countering phishing or other text-based attacks.
Organisations use Next-Gen DLP systems to minimise risks associated with phishing. AI functionality can support the analysis of linguistic patterns to reveal whether a message was written by a human or generated by a machine-learning model. In video calls and conferences, AI-powered liveness detection verifies that the participant on screen is a real person, not a synthetic or manipulated feed. This functionality should be combined with DLP capabilities for detecting shortened and obfuscated links (such as bit.ly, tinyurl, etc.) using regular expressions, as well as for identifying words and phrases indicative of phishing attempts.
In addition, a DLP system can help detect emails with attachments that have potentially dangerous file extensions (such as executable .exe files). This functionality helps minimise the risk of malicious emails bypassing anti-spam solutions.
A less obvious application of AI is the use of neural networks for real-time translation of texts from any language. This functionality is particularly relevant for companies engaged in cross-border business, working with international partners, or operating geographically distributed partner networks.
Power of AI
Another capability to consider is AI-powered summarisation. Many of us have already used neural networks to generate summaries of web pages or texts – applying this functionality to security use cases is a logical next step. AI can produce summaries of communications taking place on corporate devices. Combined with automated translation, this capability enables information security specialists to quickly identify the nature of an incident, even if key points are spread across different messages in a conversation, highlight major details, and provides brief overviews in multiple languages.
AI tools can not only be integrated into DLP systems, but DLP can also be used to monitor and control employees’ use of AI tools.
For example, if an organisation chooses not to block access to AI tools, a DLP solution plays a critical role in enabling their safe and responsible use while minimising associated risks. The system prevents an unintentional disclosure of sensitive data – for instance, when a user attempts to input confidential information into a browser-based chatbot. At the same time, DLP can be configured to fully restrict access to AI tools if needed. Using HTTP(S) traffic filtering, security teams can block connections to AI-based services, enforcing the company’s security policy and regulatory requirements.
In conclusion, it is worth noting that AI functionality not only enhances the effectiveness of DLP systems in addressing information security tasks, but also helps reduce computing resource requirements and lower overall organisational costs.
One example is the replacement of traditional OCR in DLP with neural network-based approaches. Implementing neural networks for the classification of graphical files – including screenshots, photos, scans – enables organisations to classify information without relying on OCR or text analysis, which significantly accelerates document scanning and classification. As a result, security policies can be applied to sensitive files more quickly and efficiently, eliminating the need for dedicated hardware to perform OCR-based analysis on servers.
Final word
When it comes to AI, the principle of ‘thoughtful implementation’ applies – functionality should be introduced and used deliberately, with a clear purpose, and focused on solving specific tasks that cannot be effectively addressed by other tools. If this principle is followed, the implementation of AI capabilities will deliver tangible and measurable benefits for the customer.
