What is your primary use case for Proofpoint Enterprise DLP?

My main use case for Proofpoint Enterprise DLP involves network scanning, email scanning, and endpoint DLP. I have built the solution for scanning on the network, including SSN numbers on SharePoint, OneDrive, and bank credit cards. I have handled confidential information such as National ID for different countries, so I have worked with various companies and government agencies. I have also worked in the banking sector, deploying Forcepoint solution. In the banking sector, I get the chance to perform assessments, where I mainly conduct most of the assessments. For a government bank, I was assessing their use of Forcepoint to understand how the Forcepoint DLP policy is behaving as they were encountering a lot of false positives. I found that they had built a policy for blocking the AI chatbot but had exceptions for certain users who could take screenshots from the chat, which they had not accounted for. They agreed that this was problematic. Additionally, I helped the banking sector increase their DLP coverage, checking for SSN on several servers and SharePoint while expanding to Teams and OneDrive to ensure no confidential details were being shared. That is how I used Forcepoint solution to ensure everything was working properly. My main use case is typically around DLP solutioning use cases, finding the insider threat for SSNs. I have also developed use cases for fingerprinting, as the organization wants to restrict their tax filings for a UK-based government agency, NHS. They wanted to restrict those filings to only one website, which they attempted with a proxy approach. However, they had exceptions and wanted to track who was sending what kind of files since people used to change the names and upload them to different websites. The company requested if I could create an Optical Content Fingerprinting solution for this, so we built use cases based on that.

Proofpoint Enterprise DLP is primarily utilized for protecting our data and resolving potential risks related to email, cloud applications, and endpoints. Since using Proofpoint Enterprise DLP, I have appreciated its human-centric approach combined with AI capabilities. My impression of Proofpoint Enterprise DLP's ability to monitor problematic Copilot use is positive, as it effectively addresses the risk of over-permissioning associated with Copilot, which gets installed by default with Windows. Proofpoint Enterprise DLP's approach to Copilot security uses agent-less AI-powered scanning to identify and classify sensitive data through tagging. We predominantly use Copilot in applications such as OneDrive and Teams, and because Copilot respects sensitivity labels, we can monitor sensitive information transfers in real-time, preventing unauthorized access.

My main use case for Proofpoint Enterprise DLP is incident management. A specific example of how I use Proofpoint Enterprise DLP for incident management is containment; when there's an incident, I ensure that there's no PII that has gone out from our organization. In addition to incident management, I mainly use Proofpoint Enterprise DLP for investigations, particularly when it comes to email security gateway.

Something that stood out to me most from the seminar is how they are integrating AI with Proofpoint Enterprise DLP and that is very interesting, especially in the current time where AI is affecting so much of data loss. I think that is a very good feature. Something that we have been seeing recently in the company is how the users and the people at the company are using AI and how that can affect or sometimes leak company data, which is definitely not good in terms of client privacy. Something that can help us catch who is using AI, not company-affiliated AI, is crucial so that we can ensure privacy and protect client data.

My main use case for Proofpoint Enterprise DLP is email filtering for both spam and malicious attachments and phishing.

My main use case for Proofpoint Enterprise DLP involved determining what classification solutions were in place in a couple of projects that we worked on, but the most important aspect was the critical data for the business, and building controls around those data sets and applying those policies was straightforward with Proofpoint compared to other solutions. It was more about a medical institution that we were trying to help, and for that particular entity, the patient information was critical. The way Proofpoint Enterprise DLP allowed us to build the policies around protecting the data was straightforward and intuitive. My main use case was around health data, and we knew where exactly the data was sitting. The kind of access towards that data on the communications part or the transfer of the data is where Proofpoint Enterprise DLP really helped.

Proofpoint Enterprise DLP is used primarily to prevent unauthorized transmission of sensitive data through email, which remains one of the highest risk channels for data leakage. It is used to detect and block outbound emails containing PII, financial data, client confidential documents, HR records, intellectual property, and also apply policy-based controls such as encryption enforcement, quarantine for review, user notification for justification prompts, and blocking high-risk transmission. This is critically important for regulatory alignment like GDPR, DPDPA, HIPAA, where applicable, and client contractual obligations.

Proofpoint Enterprise DLP depends upon an organization and what kind of organization it is. For example, if you are working for the healthcare industry, the intellectual property, confidential information, or PII includes health records numbers, personal details, account numbers, passport details, and social security numbers. When you take the service of Proofpoint Enterprise DLP, we first identify what our requirement is. If I was working for one of the banking solutions in Australia, their social security number is definitely there, as well as their passport. It depends upon the location. For the India location, we have the UID and Aadhaar identification. For Australia in the healthcare industry, they have HIPAA (Health Insurance Portability and Accountability Act), claim records, claim details, medical record numbers (MRN), and tax details numbers. All these things are required to protect. When anyone is trying to send all this information outside, Proofpoint Enterprise DLP provides the solution. We have created rules using Proofpoint Enterprise DLP so that whenever any user is trying to send any emails externally, we capture the keyword from the email body. The system will scan the email, and if that keyword is identified within the DLP solution with the rules we have incorporated, it will generate an alert. The email will be moved to the DLP quarantine folder. A user will receive an automated email or response stating that they are trying to send confidential information outside of the organization, and this has been blocked due to DLP policy. An analyst will create a ticket into our solution, and then the analyst will review that incident and start investigating. Let's say you're working for the electronics industry, and they have taken Proofpoint Enterprise DLP. For any electronics industry, they work in a situation where they want to protect the circuit design of any one of the latest or newly launched electrical or electronic devices. That electrical circuit design is a patent for them. They don't want to send this to an outside organization. The email will be scanned for the circuit design and patent information. If, for example, there is a project manager who wants to send one of the electronic circuit designs using VLSI technology and has worked for ten years in the organization and is now leaving, they want to send that patent information since they have created it, they will try to send it outside of the organization. In that case, the system will capture the alert, create an alert for that, and then the investigation starts. Let's say there is a user who has recently resigned from the organization due to some conflict or issues. Now they want to send important intellectual property, intellectual documents, or confidential information outside of the organization. In that case, Proofpoint Enterprise DLP works in the backend, triggers an alert, and starts the investigation.

Proofpoint Enterprise Data Loss Prevention (DLP) is currently being used in parts. The email protection plan is used, though uncertainty exists about whether an added-on plan for the DLP specifically is included. When first joined, Proofpoint was in the early phases of deployment and was told it was pretty straightforward, especially with the services they provide, such as white glove service. They respond quickly to questions.