What needs improvement with Proofpoint Enterprise DLP?

I found that they had built a policy for blocking the AI chatbot but had exceptions for certain users who could take screenshots from the chat, which they had not accounted for. They agreed that this was problematic.

Proofpoint Enterprise DLP could improve by reducing the overwhelming amount of information on their dashboard, which makes training necessary for both users and admins. The platform has room for improvement, especially with their AI functionality, to address issues such as false positives in phishing alerts. Sometimes, we need to wait for support to respond, which can frustrate customers who expect immediate feedback on genuine inquiries.

Usability has improved over the years; initially, it was difficult to navigate around the tooling, and my only other concern is around the number of products and how it's packaged up, as it gets a bit confusing at times. Proofpoint Enterprise DLP can be improved by providing more ease of use and navigation around the toolset itself. When roadmaps are developed and communicated in conferences, it is always hard and difficult to understand the number of products, what they do, and how they integrate, and where the gaps are within our organization because there are so many products now. I have not used the LLM classifiers that protect newly developed content. I think it is quite effective in detecting and preventing data loss through the analysis of user behavior and content; however, I have not fully implemented Proofpoint Enterprise DLP in my organization.

I feel Proofpoint Enterprise DLP is quite advanced, but there are a few areas for improvement. Since I am in IAM, stronger IAM integration could help us or more transparency in AI decisions and AI-driven risk scoring would be beneficial. Better workflow automation so that we have to do less manual chasing would be good. A smoother onboarding or learning curve would be something that would be helpful.

I have no complaints about how Proofpoint Enterprise DLP can be improved.

In terms of improvements, I find there are some blind spots in Proofpoint Enterprise DLP; you can obviously add more channels for detection, and logging can be much improved, specifying exactly what action took place or what alert was generated. There is a bit of ambiguity in that area. Apart from that, I am quite happy with the solution. From a user experience standpoint, the UI in Proofpoint Enterprise DLP can be a bit better. Integration-wise, it would be great if the API or document API could work better with other integrations, as that is a place where we have found it a bit lacking.

Overall, Proofpoint Enterprise DLP is a strong platform, but there are areas for improvement to enhance usability and effectiveness. One challenge is policy complexity and lifecycle management. As DLP programs mature, policies become layered and interdependent, leading to frustrations such as rule overlap that causes multiple triggers on a single message. Limited visibility into policy hierarchy impacts, difficulty modeling how new rules interact with existing ones, and change management requiring careful validation can all be challenging. An improvement opportunity would be advanced policy simulation tools for conflict detection between rules and clear rule precedence visualization, which would help understand the source of issues. The administrator user experience can feel dense from an admin perspective, especially when managing multiple layered policies, handling rule precedence, troubleshooting overlapping triggers, and onboarding new administration. As DLP programs mature, policy environments become complex quickly. Improvement opportunities would include visual policy mapping, impact previews, easier bulk policy editing, simpler policy cloning with conflict detection, and smarter recommendations during policy creation that would be very beneficial. Regarding data discovery and risk posture visibility, improvements are needed. While email layer protection is robust, organizations need better visibility across their repositories. There is an opportunity for built-in sensitive data discovery scanning and risk exposure mapping to identify which business units handle more sensitive data. A data movement visualization dashboard could also be beneficial, transitioning from reactive DLP blocking to proactive data exposure intelligence, which would significantly increase maturity.

From a DLP product improvement point of view, I think if Proofpoint Enterprise DLP can provide a deep-dive investigation or user activity listed on the alert sections with details about what activity was performed by the users at the time of the alert, what checks were performed, whether any rule was created, any SharePoint was accessed, any confidential SharePoint was accessed, or any established connection was performed, this information would be helpful. If that information was also tagged or shown on the ticket, it would be easier to understand more details or investigation approaches and investigation concepts. If that feature can be possible from the vendor side, it will help us for the investigation and as an improvement.

Proofpoint Enterprise Data Loss Prevention (DLP) should probably add something more into their case management process. There are certain things that Proofpoint lacks regarding case management. When incidents come in, it classifies a specific subcategory of what that incident is and creates a ticket for the SOC team. If they could provide more details on the type of incident filing in case management, that would be helpful. This is a hard ask because it requires some form of backend automation workflow. Many tools are starting to adopt their own automation workflows, which is pretty cool. Occasional mishaps arise related to users' devices affected by Proofpoint or when Proofpoint isn't logging specific device actions. The insider risk tool has been utilized effectively, which monitors employee actions every ten seconds, but there have been mishaps. Additionally, there are moments when specific servers require updates due to mismatched deployment updates, though this is not considered difficult because endpoint engineering counterparts assist, especially during Proofpoint calls.