Best DLP solutions still depend on identity and data control

At a glance

What this is: This is a Netwrix roundup of enterprise DLP solutions that finds data protection still depends on visibility, classification, and policy enforcement across modern work environments.

Why it matters: It matters because IAM, NHI, and data security teams need DLP to align with identity, access, and lifecycle controls rather than treating leakage as a standalone content problem.

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts.
• 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.

👉 Read Netwrix's best DLP solutions roundup for enterprise data protection

Context

DLP only works when organisations can see what data exists, who or what can touch it, and where it moves next. In practice, that means DLP sits beside identity governance, DSPM, and access policy rather than replacing them. Netwrix’s roundup reflects a wider market reality: organisations are still trying to secure information in environments where files, messages, secrets, and AI-assisted workflows blur together.

For IAM practitioners, the gap is not the absence of controls but the mismatch between data-centric tools and identity-centric operating models. DLP can block or flag exfiltration, but it cannot by itself resolve standing access, unmanaged service accounts, or overbroad third-party entitlements. That is why DLP programmes increasingly need to be read as part of a wider governance stack, not as an isolated control family.

Key questions

Q: How should security teams evaluate whether DLP is keeping up with modern data flows?

A: Start by checking whether DLP coverage matches the places data actually moves, including endpoints, cloud apps, collaboration tools, and shared secrets. If alerts rise but leak paths remain unchanged, the tool is seeing symptoms rather than controlling exposure. The strongest signal is reduced high-risk movement across the identities and channels that matter most.

Q: Why do DLP programmes fail when identity governance is weak?

A: Because DLP can only control data movement after access already exists. If users, service accounts, or integrations have broad permissions, they can copy or transmit sensitive content through channels that look legitimate to the DLP engine. Weak lifecycle governance turns DLP into a last-line alerting layer instead of a real containment control.

Q: When should organisations pair DLP with DSPM instead of using DLP alone?

A: They should pair them when they cannot reliably identify where sensitive data lives or how broadly it is exposed. DSPM provides the inventory and sensitivity context that DLP needs to enforce policies accurately. Without it, teams often over-block harmless content or under-protect the most important stores.

Q: What should teams do when service accounts can move sensitive data?

A: Treat those accounts as governed data movers, not background infrastructure. Review what they can read, copy, share, and export, then remove standing access to data that they do not need continuously. If a service account can reach outbound channels and sensitive repositories with the same credential, the organisation has a governance problem, not just a DLP problem.

Technical breakdown

How DLP policy enforcement works across endpoints, cloud, and collaboration tools

DLP engines inspect content in motion, at rest, or in use, then compare it against rules based on patterns, labels, context, or user activity. Endpoint agents watch local file handling, cloud integrations inspect uploads and sharing, and collaboration controls look for risky forwarding or external sharing. The limitation is that the same content can behave differently depending on the identity handling it, the device used, and whether the destination is sanctioned. Without those identity and data context signals, DLP becomes noisy or easy to bypass.

Practical implication: align DLP rules with identity, device, and sharing context so policy decisions reflect real access paths, not just file contents.

Why DLP and DSPM need each other in modern data governance

DSPM finds and classifies sensitive data at rest, while DLP tries to stop that data from leaving controlled boundaries. The two disciplines are complementary because DLP can only protect what it can recognise, and DSPM is often what gives organisations a usable inventory of sensitive stores, shadow repositories, and exposed locations. When organisations deploy one without the other, they either block too little because they cannot see the data, or block too much because they cannot distinguish critical assets from ordinary content.

Practical implication: use DSPM to establish data inventory and sensitivity context before tuning DLP enforcement thresholds.

Why identity security determines whether DLP can contain leakage

Identity is the control plane that tells you who or what should be allowed to move data. If human users, service accounts, or AI agents already have broad access, DLP only sees the last mile of a longer governance failure. This is especially true when secrets, tokens, or API credentials are embedded in code or shared through collaboration tools, because the leakage event may look like a data problem while the root cause is an access and lifecycle problem. DLP is therefore a detection and containment layer, not a substitute for least privilege.

Practical implication: pair DLP with access reviews, entitlement cleanup, and secret governance so the same data is not overexposed in the first place.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Reviewdog GitHub Action supply chain attack — reviewdog/action-setup GitHub Action supply chain attack exposed secrets.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

DLP is only as effective as the identity model behind it. A content inspection engine cannot compensate for standing access, unmanaged service accounts, or users who can move data across sanctioned and unsanctioned channels with the same credentials. That is why DLP failures so often trace back to governance gaps rather than policy syntax. Practitioners should treat DLP as the containment layer for identity decisions that have already been made.

Ephemeral data movement creates policy drift: modern collaboration and AI-assisted workflows move sensitive material faster than manual review cycles can respond. A file can be classified, copied, shared, summarised, and re-shared in minutes, which means policy must rely on durable controls rather than after-the-fact investigation. The implication is that organisations must stop assuming DLP alerts map neatly to a human review queue.

Shadow access is the real DLP blind spot. If service accounts, API keys, or third-party integrations can read and transmit the same data that human users can, the organisation has multiplied leak paths beyond the scope of content rules alone. This is where identity governance and DLP intersect most sharply. Practitioners should look for the access paths that never enter the DLP console at all.

Data protection programmes increasingly fail at the boundary between human IAM and non-human identity. Files, secrets, and messages are often controlled by separate teams, yet attackers and accidental leaks move across all three domains. A unified governance model is more valuable than another isolated content filter. Practitioners should map DLP outcomes back to who or what actually had the right to move the data.

From our research:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
• That visibility gap matters because the Ultimate Guide to NHIs - Why NHI Security Matters Now ties unmanaged machine identity growth directly to broader exposure.

What this signals

Ephemeral leakage is becoming the default governance problem: as data moves across SaaS, endpoints, and AI-assisted workflows, teams will need controls that bind content policy to identity and access context. DLP cannot do that alone, so the next programme maturity step is tighter linkage with DSPM and access governance.

The practical signal is that service accounts and integrations will increasingly need to be visible in the same governance view as human users. When only 5.7% of organisations have full visibility into their service accounts, per the Ultimate Guide to NHIs, DLP tuning without identity inventory is guesswork rather than control.

Programmes that connect policy enforcement to identity review will be better positioned to handle shadow access and AI-assisted content movement. The direction of travel is toward unified governance, where DLP is one part of a broader decision system rather than a standalone prevention layer.

For practitioners

• Map DLP coverage to actual identity paths Inventory where sensitive data is created, who can access it, and which service accounts, integrations, and collaboration tools can move it. Then test whether DLP policies cover each of those paths, not just endpoints and email.
• Use DSPM to tune DLP before enforcement expands Classify sensitive stores first, then apply DLP rules to the highest-risk repositories, sharing channels, and workloads. That reduces false positives and helps teams focus controls on data that would actually matter if exposed.
• Review service account and API key access to sensitive content Check which non-human identities can read, copy, or forward regulated data, source code, and secrets. Remove standing access where the same credential can reach both data stores and outbound channels.
• Measure DLP against leak paths, not only alerts Track where leaks originate, whether they involve sanctioned tools, and which identities were involved. Use that evidence to decide whether the problem is policy tuning, access scope, or lifecycle governance.

Key takeaways

• DLP reduces leakage risk, but it does not fix overbroad access or unmanaged identity paths.
• The strongest DLP programmes combine content inspection with DSPM, access governance, and service account oversight.
• Teams should measure DLP by the leak paths it closes, not only by the alerts it generates.

Key terms

• Data Loss Prevention: Data loss prevention is a control set that detects, blocks, or flags sensitive information moving in risky ways. It works across endpoints, cloud services, email, and collaboration tools, but it is only as strong as the organisation’s classification, identity context, and policy design.
• Data Security Posture Management: Data security posture management discovers where sensitive data lives and how it is exposed across systems. It gives security teams the inventory and sensitivity context needed to tune prevention controls, especially when data is spread across cloud storage, SaaS platforms, and unmanaged repositories.
• Shadow Access: Shadow access is access to sensitive data that exists outside the organisation’s intended governance model. It often comes from unmanaged service accounts, overbroad integrations, or forgotten third-party entitlements, and it creates leak paths that DLP tools may not see clearly.
• Service Account Visibility: Service account visibility is the ability to identify, monitor, and govern non-human accounts that can access data and systems. It matters because these accounts often operate outside human review cycles, yet they may carry the same or greater ability to move sensitive information.

Deepen your knowledge

DLP governance in the context of identity and data movement is covered in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are aligning data protection with service account and AI-assisted access, it is a relevant next step.

This post draws on content published by Netwrix: Best DLP solutions for enterprise data protection in 2026. Read the original.