DLP in the AI Era

10% of security teams rank removable media as an exfiltration risk, the lowest-ranked channel.

73% of organizations experience at least one confirmed data loss incident in the past 24 months.

Among organizations experiencing data loss, only 16% say DLP blocked their most significant incident before data left the organization.

48% of security teams rank GenAI as their top exfiltration risk.

Among organizations whose security teams received pushback on DLP enforcement, 3% reduced or paused the DLP program entirely.

54% of organizations softened DLP enforcement in some form across the full respondent base.

The average organization uses nearly 170 AI tools and sanctions fewer than 10 of them.

29% of security teams can produce a routine 30-day report showing sensitive data sent to GenAI tools.

41% of security teams cite cloud storage uploads as a top exfiltration risk.

22% of organizations strictly block data exfiltration via GenAI tools.

90% of security teams report at least one measurable impact from DLP alert fatigue in the past year.

21% of security teams report voluntary staff departures directly attributable to DLP alert burden.

71% of organizations report that their security teams received pushback on DLP enforcement during the past two years.

Among organizations whose security teams received pushback on DLP enforcement, 66% reduced enforcement for specific teams or use cases.

Among organizations whose security teams received pushback on DLP enforcement, 8% reduced enforcement broadly across the organization.

31% of organizations strictly block removable media.

54% of security teams triage DLP alerts where the majority turn out to be false positives.

19% of organizations strictly block cloud storage uploads.