Chris Tyler, Business Technology Strategist, Blue Turtle
Employees now work across Microsoft 365, messaging platforms, cloud applications, SaaS environments and generative AI tools, often moving between them throughout the day. Most of this activity is legitimate and necessary, yet every new application creates another route for sensitive information to leave the organisation.
This is where traditional data loss prevention (DLP) approaches are starting to show their age. Many were designed around a more contained technology environment, where businesses could identify sensitive information, classify it, build policies around it and control a relatively predictable set of channels. That model becomes much harder to manage when data is constantly being created, copied, uploaded, shared and transformed across applications that security teams may not even know employees are using.
We aren’t living in a world where deciding if an application should be allowed or blocked is enough anymore. Security teams need to understand what information is being handled, who is using it, where it came from, where it is going and what level of risk that activity presents.
The limits of traditional DLP
One of the biggest challenges with legacy DLP has always been the amount of work required before organisations begin seeing meaningful value. Traditional implementations can depend heavily on data discovery, classification and policy development, followed by ongoing tuning as the business changes.
That creates practical problems for security teams that are already under pressure. Policies can become complex, false positives create unnecessary noise, and employees can become frustrated when legitimate activity is repeatedly interrupted.
The business impact matters just as much as the technical one. If employees genuinely need WhatsApp, a SaaS application or another collaboration tool to communicate with customers and colleagues, blocking the entire application may create more problems than it solves. The real concern is whether confidential business information is being sent through that channel inappropriately.
FortiDLP approaches the problem by examining data and user activity in real time. It combines content inspection, behavioural analysis and context to help organisations understand how sensitive information is being used. It also supports a broader range of responses than a simple allow-or-block decision, giving security teams more control over how they deal with different levels of risk.
AI makes the data question more urgent
Generative AI has added another layer of risk, with employees often using new tools before the business has set clear rules around what data can be shared with them.
Employees see obvious value in tools that can summarise documents, analyse information, draft content or help solve problems. The risk arises when confidential information, customer records, financial data, intellectual property or source code is copied into a tool without the employee fully understanding where that data may go.
Organisations therefore need visibility into which AI and SaaS tools are used and what information moves into them. Simply prohibiting AI is unlikely to be practical for many businesses, particularly as these tools become part of mainstream productivity platforms.
FortiDLP provides visibility into activity across endpoints, cloud drives, SaaS applications and GenAI tools. Its capabilities include monitoring Shadow AI usage, identifying sensitive data movement and applying controls when risky behaviour occurs. Data Origin and Data Lineage can also help security teams understand where information originated and how it has subsequently been moved or manipulated.
This context becomes important when security teams are investigating an incident. Knowing that a file left the organisation is useful, but understanding where it came from, who accessed it and what happened to it beforehand provides a much clearer picture of the risk.
Experience matters as much as technology
Technology is only one part of a successful DLP strategy. Implementation can determine whether an organisation gets useful visibility quickly or spends months building a program that struggles to gain momentum.
That was one of the opportunities our team at Blue Turtle identified when we began working with what is now FortiDLP. A clear gap existed in the African market for a DLP approach that could deliver visibility faster without placing excessive demands on already constrained security teams – and we could meet it.
We therefore invested in building a dedicated capability around the technology. We use the platform internally, which allows our team to work with it continuously, test functionality and build practical experience before deploying it into customer environments. We have also developed skills across pre-sales, proof of concept, implementation and post-sales support.
Our recent recognition by Fortinet for our performance in Security Operations reflects the work we have put into building that capability and the volume of FortiDLP work we have delivered with customers. For us, the award is also validation that the specialization and delivery model we have built around DLP is working in the market.
Turning the POC into part of the implementation
The proof-of-concept process is central to how we work. For us, a POC isn’t simply about proving the technology works. It gives us the opportunity to understand the customer’s environment and do much of the groundwork needed if the project moves into production.
During the POC, we examine data flows, identify risks, understand which applications employees use, and begin shaping policies around the customer’s actual environment. We retain that work, so if the customer decides to proceed, we don’t start from scratch.
This has helped us shorten implementation timelines considerably. In one large financial services environment, an initial production phase covering approximately 8,500 agents was completed in around two and a half weeks. We moved at that speed because much of the preparation had already been done during the POC and because of the experience we have built across previous deployments.
That matters because the longer it takes to put the right controls in place, the longer the business remains exposed to risks it already knows about.
DLP must follow the data
Data is now moving through environments that were never part of the traditional corporate perimeter, and AI will accelerate that movement further. Security teams need visibility that follows the information across those environments and controls that respond to the context of each interaction.
That is the change modern DLP needs to address.
Discover how visibility, context and real-time controls can strengthen your approach to data protection.