Smart-decision DLP

Smart DLP overlays your existing tooling with classification, policy, correlation, and risk scoring. Decide once, enforce in multiple places.

Book a demo
Policy BrainCorrelation engineClassification

Separate the decision from the enforcement

Allow-or-block decisions need cross-system context: data semantics, user identity, destination risk, cross-event history. That context is fragmented across enforcement points. Smart DLP centralizes the decision as an overlay; enforcement stays with your existing infrastructure.

L3

Intelligence

Policy Brain, correlation, risk scoring, and DataBrain classification. The core of this product.

  • Policy Brain: context-aware thresholds, deny-first precedence, hot-reload rules
  • Correlation: multi-dimensional behavioral and propagation signals injecting real-time risk scores into decisions
  • Classification: DataBrain integrates as a sealed API service; plaintext does not leave your network
L2

Orchestration

Connectors ingest vendor events into a unified model; reliable replay and long-term audit retention.

  • Event normalization: one unified model, absorbing vendor differences
  • Reliability: event replay and long-term audit retention
  • Connected today, 6 vendors: Purview / Zscaler / Proofpoint / OneDrive / WeCom Session Archive / Alibaba Mail
L1

Execution

Your existing DLP and security infrastructure: email, network, and endpoint gateways.

  • Zero replacement: keep your email, network, and endpoint gateways
  • Decision mapping: overlay verdicts translate into local block / allow actions
  • Sidecar deployment: no policy migration; the overlay deploys independently

Alerts arrive pre-analyzed

Context-aware policy decisions

Destination risk and user sensitivity dynamically modulate decision thresholds, while behavioral and propagation factors tighten decisions further. Deny comes first; uncovered types are not silently allowed.

  • Templates: GDPR, PCI-DSS, insider baseline, PIPL outbound baseline (14 sensitive-data types)
  • Hot-reload, versioned rules with one-click rollback; manual risk flags take effect instantly
  • Full decision × signal traceability: why it was allowed or blocked, record by record

See behavior, not just events

Three behavioral signals (exfil volume, off-hours, privilege anomalies) statistically fuse into one per-user behavioral risk score, injected into real-time decisions; the blast radius of any sensitive value is pinpointed in seconds.

  • UEBA baselines with built-in poisoning protection: anomalous behavior does not contaminate the baseline
  • Second-level blast-radius lookup: any value → related events / users / channels / destinations
  • Behavioral risk feeds back: high-risk users automatically face tighter thresholds

LLM pre-analysis + a memory loop

An LLM pre-analyzes alerts, advisory only, not enforcement. Analyst-confirmed false positives become decision memories carried into future triage, with one-click rule-change suggestions.

  • Isolated guardrails: LLM output stops at the advisory layer and cannot touch enforcement
  • Confirmed FPs do not come up again: similar cases automatically carry the prior verdict
  • Triage queue sorted by real risk, with one-click FP marking

A workbench for security operations teams

Overview

A full decision view: live decision feed, routing distribution, risk trends.

Decision Timeline

Real-time decision stream filterable by triage state; analysis arrives before you do.

Rule Editor

Visual rule editing with versioning, coverage analysis, and conflict detection.

Coverage Matrix

A data-type × channel coverage matrix; blind spots at a glance.

Event Forensics

Full chain per event: decision, correlated signals, triage verdict, and rule suggestions.

User Risk

Per-user behavioral profile and risk score, with manual flags.

One-command delivery, even in isolated environments

Signed packages

Signed installation packages; one command to install, upgrade, or roll back, with automatic health gates.

Full-stack orchestration

Containerized full-stack orchestration: bring up the complete system, monitoring and alerting included, in one command.

Tamper-evident audit

An append-only decision ledger with full decision × signal × data-identity traceability.

Tell us where your DLP hurts

Share your false-positive and blind-spot pain; we will talk about how the overlay lands.

Book a demo