Traditional data loss prevention was built to inspect files and messages crossing known channels, and generative AI moves data through prompts, pastes, API calls and agent tool calls that many of those inspection points never see. The question for most security teams is not whether to buy a new product but where the existing DLP stops working and what fills the gap. This guide is a gap analysis: for each way data reaches an AI system, what a typical DLP deployment already catches, where it goes blind, and when to extend it versus add a GenAI-specific control such as an AI gateway or prompt inspection service. It is written for data security and security architecture teams who already run DLP. The policy and rollout side of AI data protection (tool tiers, copilot labels, prompt log retention) is covered in the Generative AI Data Loss Prevention Guide; this page goes underneath it, to inspection points and detection methods.
Key takeaways
- Short answer: extend DLP for people, add GenAI controls for applications and agents. Endpoint, browser and network DLP can cover staff typing, pasting and uploading into AI websites; they rarely see server-side API calls, retrieval inside copilots or agent tool calls.
- Pattern detection still works for structured data. Card numbers, national IDs, secrets and exact customer records are found the same way in a prompt as in an email; exact data match keeps false positives low.
- Unstructured meaning is the real gap. A summary of a board paper, a paraphrased contract or a code snippet stripped of identifiers carries no pattern; only classifiers trained on the content type or semantic inspection catch it.
- The response is a new channel. Traditional DLP inspects what leaves; GenAI systems also generate sensitive output from data the user never typed, so output inspection belongs in scope.
- Agent egress is an identity problem as much as a content problem. An agent sending data with a valid token to an allowed host passes most content rules; scoped tools and destination allowlists do more than inspection.
What each option means here
Traditional DLP is the policy engine you already run: sensitive information types built from patterns, checksums and keywords, exact data match against source tables, document fingerprints, trainable classifiers and sensitivity labels, enforced at endpoints, email, web proxies, cloud apps and file shares. Its unit of inspection is a file, a message or an upload, and its decision is block, warn, encrypt or audit. See the Data Loss Prevention (DLP) Guide.
GenAI DLP is the set of controls placed on AI traffic itself: prompt and response inspection at an AI gateway or SDK, redaction or tokenisation before the model sees data, browser controls tuned to AI sites, copilot data exclusion, and egress and tool policies for agents. Its unit of inspection is a conversational turn or a tool call, often streamed, often generated by software rather than a person.
The two overlap heavily: a good GenAI DLP layer reuses the same classifiers and labels. What differs is where it sits and what it can see.
Gap analysis by channel
| Channel | What existing DLP usually catches | Where it goes blind | Control that closes the gap |
|---|---|---|---|
| Typed prompt in a browser | Browser extension or endpoint agent can inspect text entered on listed sites | Unmanaged browsers and devices; sites missing from the AI category list | Managed browser policy, URL categories kept current, block personal sessions |
| Paste into an AI site | Clipboard or paste rules where the browser exposes the event | Paste events not intercepted before the page sends them | Enterprise browser paste controls with delay until scanned |
| File upload to an AI site | Upload rules on managed endpoints and proxies, labels honoured | Files above scan size limits, images without OCR, encrypted archives | OCR on, size limits known, block unscannable uploads to AI categories |
| Desktop AI app | Network DLP if TLS inspection covers the destination | Certificate pinning, inspection bypass lists, home networks | Endpoint agent controls, app allowlisting, SSE client |
| Internal app calling a model API | Usually nothing: server-to-server traffic to a sanctioned provider | All prompt content assembled by code, including retrieved records | AI gateway with prompt and response inspection, redaction in the SDK |
| Copilot retrieval | Labels and permissions on source content | Overshared content the user can open; summaries that cross label boundaries | Permission clean-up, label exclusion from AI processing, output inspection |
| Model response | Rarely inspected | Sensitive output built from retrieved or memorised data | Response inspection and redaction at the gateway |
| Agent tool call (email, HTTP, file write, MCP) | Email DLP on outbound mail if the agent uses the mail system | Direct API calls, image URLs carrying data, MCP servers, webhooks | Tool scoping, destination allowlists, egress proxy, approval for external sends |
Most organisations find their DLP covers the first three rows on managed devices and almost none of the last four. That pattern decides the approach: extend for people, add for software.
Detection methods: pattern versus semantic
Prompts are short, conversational and often paraphrased. That changes which detection methods earn their place.
| Method | How it works | Strength in prompts | Weakness in prompts |
|---|---|---|---|
| Pattern with checksum and keywords | Regular expression plus validation and supporting terms nearby | Card numbers, national IDs, IBANs, API keys | Short prompts lack the supporting keywords that raise confidence |
| Exact data match | Hashed values from a source table, primary element plus corroborating fields in proximity | Real customer and employee records, very low false positives | Only finds values in the table; paraphrase defeats it |
| Document fingerprinting | Matches content derived from a template or known document | Forms and standard contracts pasted whole | Excerpts and summaries fall below match thresholds |
| Trainable classifier | Learns a content category from positive and negative examples | Source code, CVs, legal or financial text without identifiers | Needs good seed sets; does not work on encrypted items |
| Sensitivity label | Reads metadata applied to the file or item | Labelled uploads and copilot source content | Typed and pasted text carries no label |
| Semantic or LLM-based inspection | A model judges whether text discusses a protected topic or contains confidential meaning | Paraphrased strategy, unreleased product details, intent | Latency, cost, non-deterministic results, and the inspector itself receives the data |
Two vendor examples show how the established methods are documented; platforms are listed alphabetically and order is not a ranking. Google Chrome Enterprise data protection rules can trigger on file uploaded, file downloaded, content pasted, content printed and URL visited, with block, allow with warning and audit only actions; they scan up to 10 MB of text in a file, need OCR enabled for images and PDFs, and use "Delay file upload" and "Delay text entry" connector settings so blocking happens before the content is sent. Microsoft Purview exact data match stores only salted hashes of a source table of up to 100 million rows and matches a primary element with supporting elements in proximity, and its trainable classifiers learn a category from example sets and work only on items that are not encrypted. Availability: Chrome data protection rules require the Chrome Enterprise Premium add-on; Purview features depend on the Microsoft 365 licence described in Microsoft's documentation.
Practical rule: use exact data match and checksummed patterns as the blocking layer, because they are precise; use trainable classifiers and semantic inspection to warn and coach, because they are not. Treat any semantic inspector that calls an external model as another AI processor of the same data.
False positives and why they matter more for prompts
- Short context: a nine-digit number in a two-line prompt has no surrounding evidence, so pattern rules either fire on everything or are tuned so loose they miss real data. Exact data match solves this for known records.
- Developer traffic: code and logs are full of strings that look like keys, hashes and identifiers. Use provider-specific secret patterns with entropy checks, not generic "high entropy string" rules.
- Interactive cost: a blocked email is a nuisance; a blocked prompt every few minutes drives users to personal devices. Warn with a reason and a sanctioned alternative before blocking.
- Streaming responses: response inspection on streamed output either buffers (adding latency) or inspects chunks (missing data split across them). Decide per use case and document it.
Inspection points: threat model and failure modes
Endpoint agent. Sees clipboard, file and browser events on managed devices. Fails on unmanaged devices, on browsers without the extension and on desktop apps it does not hook. See the Endpoint DLP Guide.
Browser. An enterprise or managed browser sees what the user types, pastes and uploads per site and per profile, and can separate work and personal accounts on the same AI domain. Fails when users switch browser or device. See the Enterprise Browser and Browser Security Guide.
Network or SSE. Sees any client's traffic where TLS inspection applies, including desktop apps. Fails on pinned certificates, bypass lists and new AI domains not yet categorised; without inspection it sees only destinations, not content. See the TLS Inspection Guide and, for the CASB and SSE trade-off, AI Gateway vs CASB/SSE for Controlling Shadow AI.
AI gateway or SDK. Sits on the API path of applications and agents, sees the fully assembled prompt including retrieved records, and can inspect and redact the response. Fails when teams call providers directly with their own keys, so pair it with egress rules that force model traffic through the gateway. See the AI Gateway and LLM Gateway Guide.
Redact, tokenise or block
Blocking is the traditional DLP default. For AI use, transformation often keeps the task useful while removing the data. OWASP lists tokenisation and pattern-based redaction before processing among its LLM02:2025 Sensitive Information Disclosure mitigations, and NIST AI 600-1 suggested action MP-4.1-009 is to "Leverage approaches to detect the presence of PII or sensitive data in generated output". De-identification services document the options; Google Cloud Sensitive Data Protection, for example, offers replacement, redaction, character masking, cryptographic hashing to a surrogate value and date shifting.
| Action | Use when | Trade-off |
|---|---|---|
| Block | Secrets, exact-match customer records to public tools | Stops the task; invites workarounds |
| Redact or replace with a type tag | The model needs the structure, not the value | Answer may refer to "[EMAIL]" rather than the person |
| Consistent surrogate (hash or token) | The model must track the same entity across a conversation | Needs key management; re-identification must be controlled |
| Warn and log | Classifier or semantic matches with lower confidence | Relies on user judgement; review overrides |
| Audit only | Baseline before enforcement | No protection during the audit period |
Agent egress: where content rules run out
When an agent can send email, call HTTP endpoints, write files or call MCP tools, leakage becomes exfiltration performed by a trusted identity, usually T1567 Exfiltration Over Web Service. In ForcedLeak, a hidden prompt in a web form led a CRM agent to place records in an image URL, and the data left through a content security policy allowlist entry for a domain that had expired and been re-registered. No content rule on outbound files would have seen it; the fixes were destination controls and a trusted URL list.
- Scope tools first: a summarising agent needs read tools only. OWASP LLM06 Excessive Agency is the reference for removing unnecessary functions and permissions.
- Allowlist destinations: outbound fetch, send and render tools reach only named domains and recipients, and the list is reviewed for expired domains.
- Force traffic through a proxy: the MCP security best practices advise egress proxies and network policies that restrict a client's outbound access.
- Use scoped tokens: the same document requires that MCP servers "MUST NOT accept any tokens that were not explicitly issued for the MCP server", which keeps a stolen token from turning a server into an exfiltration proxy.
- Inspect content as a second layer: run the same exact data match and secret rules on tool call arguments at the gateway, and require approval for external sends above a record threshold.
See the Agent Egress Control and Network Isolation Guide and the MCP Security Guide.
Extend or add: decision checklist
| Question | If yes | If no |
|---|---|---|
| Is most AI use by staff in browsers on managed devices? | Extend endpoint and browser DLP to AI site categories | Add SSE or enterprise browser coverage first |
| Do you already run exact data match or labels with good coverage? | Reuse them in AI rules as the blocking layer | Build classification before buying a GenAI DLP layer |
| Do internal apps or agents call model APIs? | Add an AI gateway with prompt and response inspection | Defer the gateway; monitor for direct API keys |
| Is the sensitive data mostly unstructured meaning (strategy, research, code)? | Add trainable or semantic classifiers in warn mode | Patterns and exact match may be enough |
| Do agents have send, fetch or write tools? | Add tool scoping, egress allowlists and approval steps | Keep agents read-only and revisit when tools are added |
| Can the existing DLP inspect API traffic you control? | Route model calls through it and test latency | Use the gateway or SDK redaction instead |
Small organisations: extend the DLP in the productivity suite and browser to AI sites, give staff one sanctioned AI service and keep agents read-only. Large or regulated organisations: extend endpoint, browser and SSE DLP for people, put an AI gateway in front of every internal model call, reuse one classification scheme across both, and treat agent identities as privileged non-human identities.
Worked scenario: a support team adopts an AI assistant and an agent
A support function has endpoint DLP with exact data match on the customer table and email DLP. It rolls out a sanctioned AI chat service and then a ticket-triage agent that reads tickets, queries the CRM and drafts replies.
- Chat service: extend endpoint and browser rules to the AI site category. Exact data match blocks full customer records pasted into consumer tools and warns for the sanctioned tool. Gap found: some staff use a desktop AI app the browser rules miss; fixed by the SSE client and an app allowlist.
- Triage agent: no existing DLP sees its server-side calls. Route its model traffic through an AI gateway that redacts card and national ID numbers in prompts and inspects responses for customer identifiers from other tickets.
- Agent egress: the draft-reply tool can only save drafts; sending stays with a human. Web fetch is limited to the knowledge base domain. Image rendering of external URLs in the agent interface is off.
- Measure: after four weeks in audit mode, compare matches per 1,000 prompts in chat and in the agent, tune, then enforce.
The existing exact data match did most of the detection work in both channels; the new spend went on placement (gateway, SSE client) and on egress design.
Implementing in phases
- Map channels: list every path from the gap analysis table that exists in your estate, with its current inspection point or "none".
- Reuse classification: confirm exact data match, secret patterns and labels work on short text samples; build a prompt test set from real (sanitised) cases.
- Extend for people in audit mode: AI site categories on endpoint, browser and SSE rules for at least two business cycles.
- Add the gateway for software: route internal model calls through it with prompt and response inspection in log-only mode, and block direct provider egress from application networks.
- Constrain agents: tool scoping, destination allowlists and approval steps before any agent gets a send or write tool.
- Enforce in rings: warn, then block for secrets and exact-match records, pilot group first.
- Roll back safely: version every rule and keep a one-step return to audit mode for each ring.
Detection and measurement
Send AI-related DLP events, gateway inspection results and agent tool call logs to the SIEM with user or agent identity, destination and data type. Treat a confirmed secret or regulated record in a third-party prompt as an incident.
- Channel coverage: share of channels in the gap table with an active inspection point, trending to 100%.
- Gateway coverage: share of internal model API calls passing through the gateway, measured against provider billing or egress logs.
- Precision: share of blocking events confirmed as true positives on review, kept high before widening enforcement.
- Sensitive prompt rate: matches per 1,000 prompts by data type and tool tier, trending down after coaching.
- Agent external sends: number of agents with unrestricted send or fetch tools, target zero.
Framework mapping
| Control | OWASP LLM 2025 | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|---|
| Prompt, paste and upload inspection | LLM02 | AC-4, SC-7(10) | PR.DS-02, PR.DS-10 |
| Classification and labels reused for AI | LLM02 | AC-16 | PR.DS-01 |
| Redaction and de-identification | LLM02 | SI-19 | PR.DS-10 |
| Response inspection | LLM02, LLM05 | SI-4 | DE.CM-09 |
| Agent tool scope and egress | LLM01, LLM06 | AC-6, SC-7 | PR.AA-05, DE.CM-01 |
| Event logging | LLM02 | AU-2 | PR.PS-04 |
In ATT&CK terms the outcomes being prevented are T1567 Exfiltration Over Web Service, including T1567.002 Exfiltration to Cloud Storage, and T1048 Exfiltration Over Alternative Protocol for agents with raw network tools.
Common failure patterns
- Assuming the proxy sees everything: desktop AI apps, pinned certificates and server-side API calls bypass web DLP entirely.
- Blocking without a sanctioned path: after the Samsung ChatGPT source code leak, written warnings had not stopped engineers pasting code; technical limits and an approved alternative have to come together.
- Semantic rules set to block: non-deterministic classifiers enforcing hard blocks generate disputes and override fatigue.
- No response inspection: controls watch what goes in while the model returns data retrieved from overshared sources.
- Content rules on agents, no destination rules: data leaves through an allowed domain or a rendered image URL that no content rule examines.
- Two classification schemes: the gateway uses its own built-in detectors while endpoint DLP uses the organisation's, so the same data is treated differently by channel.
Practitioner checklist
- Map every AI data channel to an inspection point, and record the ones with none.
- Test existing exact data match, secret and label rules against a prompt-sized test set.
- Extend endpoint, browser and SSE DLP to AI site categories in audit mode, then coach, then block.
- Confirm scan size limits, OCR and paste delay settings so blocking happens before content is sent.
- Route all internal model API calls through an AI gateway and block direct provider egress.
- Inspect and redact responses as well as prompts for internal AI applications.
- Use exact match and checksummed patterns to block; use classifiers and semantic inspection to warn.
- Give agents scoped tools, destination allowlists and approval for external sends.
- Keep one classification scheme across DLP, gateway and copilot controls.
Standards and references
- OWASP: Top 10 for LLM Applications 2025 (LLM02 Sensitive Information Disclosure, LLM06 Excessive Agency)
- NIST: AI 600-1 Artificial Intelligence Risk Management Framework, Generative AI Profile
- Model Context Protocol: Security Best Practices
- Google: Chrome Enterprise data protection rules
- Google Cloud: De-identifying sensitive data
- Microsoft Learn: Learn about exact data match based sensitive information types
- Microsoft Learn: Learn about trainable classifiers
Related NHI Mgmt Group resources: Generative AI Data Loss Prevention Guide, DSPM vs DLP, AI Usage Monitoring Guide, Data Loss Prevention Policy Template.