Cyberhaven vs Proofpoint: what DLP teams miss in SaaS and AI

At a glance

What this is: This comparison says Cyberhaven and Proofpoint address different DLP use cases, but both leave important gaps in SaaS, GenAI, and MCP traffic coverage.

Why it matters: IAM, PAM, NHI, and data security teams need to understand where detection-based DLP stops so they can govern sensitive data exposure across browsers, SaaS, and AI workflows, not just email and endpoints.

Context

Cyberhaven and Proofpoint are often discussed as competing data loss prevention options, but they are solving different control problems. One is strongest where data lineage on the endpoint matters, while the other is strongest where email and channel-wide DLP governance dominate. The real gap is not coverage in one channel or another, but consistent remediation across the surfaces where sensitive data now moves, including SaaS, browsers, and AI tools.

For identity and access teams, this is a governance issue as much as a content-security issue. Browser prompts, SaaS data at rest, and AI-agent traffic all create new exposure paths that do not map cleanly to legacy email-centric controls, and remediation has to happen where the data is used, not only where it is observed.

Key questions

Q: What breaks when DLP is still built around endpoints and email gateways?

A: It misses the way data now moves through SaaS, cloud, and AI workflows that do not pass through a small set of inspection points. Modern DLP has to understand the data itself, its context, and the identities that can reach it. Without that, enforcement becomes reactive and incomplete.

Q: Why do browser GenAI prompts create a governance problem for data security teams?

A: Browser prompts turn a user action into a data transfer event, which means sensitive content can leave the governed context before a traditional DLP rule sees it. That creates a governance problem because the decision is no longer just about filtering traffic. It is about who can submit which data into which model or assistant, and under what policy.

Q: What are the signs that a DLP programme is too detection-led?

A: The clearest sign is when teams can prove where data went, but cannot stop it from leaving in the first place. Other indicators include heavy dependence on alerts, weak inline redaction, and inconsistent enforcement across SaaS, browser, and AI workflows. If remediation depends on after-the-fact investigation, the programme is already behind the exposure.

Q: Should security teams prioritise remediation or lineage when building data controls?

A: They should prioritise remediation where exposure is active and lineage where investigation matters most. Lineage supports forensics and insider-risk analysis, but it does not remove the sensitive content from the path. If the business risk is real-time leakage across SaaS or AI tools, inline action has to come first.

Technical breakdown

Endpoint lineage versus channel-based DLP

Data lineage platforms track how a file or record changes, where it moves, and which process or user touched it. Channel-based DLP, by contrast, inspects traffic at control points such as email, cloud sync, or endpoint policy enforcement. The first model is better for investigation because it reconstructs movement after the fact. The second is better for broad policy coverage, but it often loses context once data leaves the channel being monitored. In practice, these are complementary architectures, not interchangeable ones, and neither automatically solves remediation across SaaS or AI surfaces.

Practical implication: Choose controls based on whether your programme needs investigation depth, policy breadth, or both, and do not assume one architecture covers the other.

Why SaaS data at rest breaks legacy DLP assumptions

SaaS data at rest is content stored inside collaboration platforms, ticketing tools, document stores, and CRM systems rather than flowing through a single monitored channel. Traditional DLP was built around transit points such as email gateways and endpoint agents, so it often sees less of the risk once the data is already resident in a SaaS application. That matters because exfiltration is no longer the only problem. Overexposed records, over-shared folders, and stale access can all create persistent exposure without generating a classic DLP event.

Practical implication: Extend controls beyond transport inspection and treat SaaS residency, sharing state, and access scope as first-class governance objects.

Browser GenAI prompts and MCP traffic create new policy surfaces

Browser-based AI usage and MCP-based agent activity introduce a new class of data transfer. A prompt may contain regulated data, and an AI agent may pass that data into tools or connectors outside the original application boundary. That means the control point is no longer just network egress or email inspection. It is the moment the data is submitted, transformed, or delegated into a tool chain. For identity teams, this creates an adjacent governance problem: who or what is allowed to submit sensitive data on behalf of the user or system, and under what policy.

Practical implication: Add submission-time controls, connector governance, and scoped identity policy for AI tools and agents, not only retrospective inspection.

Threat narrative

Attacker objective: The objective is to move sensitive business, customer, or regulated data beyond the point where existing DLP controls can reliably prevent or remove it.

1. Entry occurs when sensitive data is created or accessed in SaaS, email, endpoint, or browser-based AI workflows that legacy controls do not fully cover.
2. Credentialed users or agents move that data into channels or connectors where inspection is partial, making policy enforcement inconsistent across surfaces.
3. Exposure escalates when SaaS at rest, browser prompts, or AI-agent tool calls retain or forward the content instead of remediating it inline.
4. Impact is persistent data exposure, weaker insider-risk containment, and remediation that happens after the data has already crossed the control boundary.

Breaches seen in the wild

• Cyberhaven Chrome extension breach 2024: A phished OAuth consent gave attackers Chrome Web Store publishing rights and a malicious Cyberhaven extension update reached about 400,000 users.
• Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Detection-led DLP leaves a governance gap when remediation is not inline. The article’s core distinction is not product preference, but control model. Investigation tools can explain where data went, yet modern exposure increasingly requires the data itself to be redacted, masked, or blocked before it leaves the governed context. For practitioners, the decisive question is whether the control can act at the moment of use.

SaaS data at rest is the blind spot that channel-first programmes still underweight. Email and endpoint remain important, but many real-world exposure events now originate in collaboration suites, document stores, and service workflows where the data persists outside classic inspection paths. That means governance needs to shift from traffic-centric assumptions to residency, sharing, and access-state controls. Practitioners should treat SaaS exposure as a standing governance problem, not a rare alert condition.

Browser-based GenAI and AI-agent traffic create a new class of delegated data movement. The article usefully separates human channel security from AI submission and tool-use security. Once a prompt or agent call can carry sensitive content into downstream tools, the control problem starts to resemble NHI governance: scoped identity, least privilege, and policy at issuance time. Security teams should plan for AI submissions as governed data transfers, not informal user activity.

Data-lineage visibility and remediation are not substitutes for each other. Lineage helps teams investigate and explain movement, while remediation removes exposure from the path. The market implication is that data security is moving toward operational control, not just forensic clarity. Practitioners should expect procurement and architecture reviews to ask whether a control merely detects leakage or actually constrains it.

From our research library:

• The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
• Read next: Agentic AI Security Guide

What this signals

Inline remediation is becoming the dividing line between visible exposure and controlled exposure. A programme that can only observe leakage will struggle as data moves through SaaS, browser AI, and agent connectors. The control objective is shifting from finding sensitive content after the fact to stopping or altering the transfer before it leaves the trusted context.

SaaS residency and AI submission are now part of the same governance surface. Once data lives inside collaboration platforms and can be forwarded into prompts or tool calls, the boundary between data security and identity governance narrows. Practitioners should expect policy decisions to extend to who or what is authorised to move data, not just who may view it.

For practitioners

• Map DLP coverage by data state, not just by channel Inventory where sensitive data exists at rest, in motion, and in submission flows across SaaS, endpoint, browser, and AI tools. Identify which paths are only observed versus actually remediated.
• Treat AI prompts and agent tool calls as governed data transfers Define policy for browser-based GenAI use and MCP connectors so submission of regulated or confidential content is controlled before the model or agent receives it.
• Separate investigation capability from remediation capability Document which controls give lineage and forensics, and which can redact, mask, delete, or block content inline. Use that split to find where your current stack only detects after exposure.
• Review SaaS residency and sharing controls for persistent exposure Check whether over-shared files, stale access, and permissive collaboration settings create exposure that never traverses a classic DLP checkpoint.

Key takeaways

• Cyberhaven and Proofpoint are solving different DLP problems, but both still leave important exposure paths that now matter most in SaaS and AI workflows.
• The article’s deeper point is that investigation depth and channel breadth do not replace inline remediation when data can be submitted into browser prompts or agent tool calls.
• Security teams should assess whether their DLP stack controls the data at the moment of use, because that is where modern exposure is increasingly decided.

Key terms

• Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
• Inline remediation: Inline remediation is the practice of presenting security guidance directly in the developer environment where code is written. It reduces context-switching and can speed up fixes, but it only improves governance when the guidance is accurate, explainable, and consistently adopted by engineering teams.
• SaaS Data At Rest: SaaS data at rest is information stored inside cloud applications such as collaboration tools, document stores, ticketing platforms, and CRM systems. It is a persistent exposure surface because access, sharing, and retention settings can leave data visible long after the original transaction ends.
• Agent Tool Call: A tool call is an execution request from an AI agent to read, write, run, or query something outside the model. In governance terms, each call is a permissioned action and should be treated like a privileged transaction, not a harmless prompt response.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and agentic AI identity for practitioners responsible for modern access and control design. It helps security and identity teams connect governance decisions to the systems now moving data across SaaS and AI workflows.