Notifications
Clear all
Topic starter
20/08/2026 5:58 pm
TL;DR: Cyberhaven and Proofpoint solve different halves of the modern DLP problem: endpoint lineage versus email-first cross-channel coverage, while both still leave SaaS data at rest and AI-agent traffic unevenly protected, according to Strac. The real governance issue is that detection-led models do not fully address inline remediation across browser prompts, MCP traffic, and data-native workflows.
NHIMG editorial — based on content published by Strac: Cyberhaven vs Proofpoint: DLP and insider risk compared
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
Questions worth separating out
Q: What breaks when DLP is the only control on email risk?
A: DLP can reduce outbound leakage, but it does not inventory what sensitive data already lives in mailboxes.
Q: Why do AI-agent workflows complicate data protection and access governance?
A: AI agents can move sensitive content through prompts, retrieval steps, and tool calls faster than traditional review cycles can react.
Q: How can security teams tell whether DLP is actually reducing risk?
A: Look for better prioritisation of high-value data, fewer noisy alerts, and clearer visibility into which identities can reach sensitive content.
Practitioner guidance
- Define the primary exposure surface Map whether your dominant risk is email, endpoint copy, SaaS storage, browser GenAI, or AI-agent traffic before choosing a DLP operating model.
- Separate investigation from remediation Use lineage and detection for forensic context, but require inline redaction, masking, tokenisation, or revoke actions for high-value data paths.
- Extend policy to AI workflows Add explicit controls for browser prompts, MCP tool calls, and AI-assisted copy-paste paths so sensitive data is not handled as generic web content.
What's in the full article
Strac's full article covers the operational detail this post intentionally leaves for the source:
- Channel-by-channel remediation workflows for email, SaaS, endpoint, browser, and AI-agent data paths
- Implementation details for redaction, masking, tokenisation, block, warn, delete, revoke access, quarantine, and label actions
- Product-specific coverage claims across Slack, Gmail, Google Drive, Microsoft 365, Salesforce, and MCP connectors
- Deployment and compliance details for teams evaluating how the platform fits existing data controls
👉 Read Strac's comparison of Cyberhaven vs Proofpoint for DLP and insider risk →
Cyberhaven vs Proofpoint: what data security teams should rethink?
Explore further
20/08/2026 6:37 pm
Channel-first DLP is no longer enough for modern data exposure. Email and endpoint remain important, but they are no longer the only places where sensitive data moves. SaaS collaboration, browser AI use, and AI-agent tool calls create exposure paths that bypass legacy inspection assumptions. For IAM and data-security teams, the practical conclusion is that DLP strategy now has to follow workflow location as well as content type.
A question worth separating out:
Q: Should organisations keep separate controls for email, endpoint, SaaS, and AI use?
A: Separate tools can be justified operationally, but separate policies create blind spots if each channel is governed differently. The better question is whether all four surfaces share one policy model for classification, exception handling, and remediation. If they do not, attackers and careless users will route around the weakest path.
👉 Read our full editorial: Cyberhaven vs Proofpoint: what DLP teams miss in SaaS and AI
