Notifications
Clear all
Topic starter
10/06/2026 11:30 pm
TL;DR: Data loss prevention is a governance problem, not just a filtering problem, and it points readers toward visibility, classification, and policy enforcement across endpoints, cloud, and collaboration tools, according to Netwrix’s 2026 DLP roundup. The limiting factor is still identity-aware control, because DLP cannot reliably contain data movement it cannot attribute or scope.
NHIMG editorial — based on content published by Netwrix: Best DLP solutions for enterprise data protection in 2026
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How should security teams evaluate whether DLP is keeping up with modern data flows?
A: Start by checking whether DLP coverage matches the places data actually moves, including endpoints, cloud apps, collaboration tools, and shared secrets.
Q: Why do DLP programmes fail when identity governance is weak?
A: Because DLP can only control data movement after access already exists.
Q: When should organisations pair DLP with DSPM instead of using DLP alone?
A: They should pair them when they cannot reliably identify where sensitive data lives or how broadly it is exposed.
Practitioner guidance
- Map DLP coverage to actual identity paths Inventory where sensitive data is created, who can access it, and which service accounts, integrations, and collaboration tools can move it.
- Use DSPM to tune DLP before enforcement expands Classify sensitive stores first, then apply DLP rules to the highest-risk repositories, sharing channels, and workloads.
- Review service account and API key access to sensitive content Check which non-human identities can read, copy, or forward regulated data, source code, and secrets.
What's in the full article
Netwrix's full blog post covers the operational detail this post intentionally leaves for the source:
- Vendor-by-vendor capability comparisons for endpoint, cloud, and SaaS DLP
- Implementation details on policy tuning, classification, and incident handling
- Product-specific coverage notes for collaboration platforms and data channels
- Deployment considerations for teams moving from visibility to enforcement
👉 Read Netwrix's best DLP solutions roundup for enterprise data protection →
Best DLP solutions in 2026: are your controls keeping up?
Explore further
12/06/2026 5:36 am
DLP is only as effective as the identity model behind it. A content inspection engine cannot compensate for standing access, unmanaged service accounts, or users who can move data across sanctioned and unsanctioned channels with the same credentials. That is why DLP failures so often trace back to governance gaps rather than policy syntax. Practitioners should treat DLP as the containment layer for identity decisions that have already been made.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: What should teams do when service accounts can move sensitive data?
A: Treat those accounts as governed data movers, not background infrastructure. Review what they can read, copy, share, and export, then remove standing access to data that they do not need continuously. If a service account can reach outbound channels and sensitive repositories with the same credential, the organisation has a governance problem, not just a DLP problem.
👉 Read our full editorial: Best DLP solutions still depend on identity and data control
