--- title: "7 of 18 DLP tools watch email, laptop and cloud; none documents a PAN detector" summary: "Channel by channel: what the 18 DLP and insider-risk products in TechBag's guide cover, what the two with a list price cost in rupees, and what none documents, September 2026." url: https://www.thetechbag.com/blog/dont-be-data-dribbler-unpack-data-loss format: Analysis desk: "Data & privacy" published: 2025-12-24 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["DLP","data loss prevention","insider risk","Microsoft Purview","Forcepoint","Safetica","PAN","Aadhaar","DPDP","CERT-In"] cover: https://www.thetechbag.com/blog/covers/dont-be-data-dribbler-unpack-data-loss.png --- # 7 of 18 DLP tools watch email, laptop and cloud; none documents a PAN detector *Channel by channel: what the 18 DLP and insider-risk products in TechBag's guide cover, what the two with a list price cost in rupees, and what none documents, September 2026.* Analysis · Data & privacy · By TechBag · Published 2025-12-24 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/dont-be-data-dribbler-unpack-data-loss The short version - The 2024 version of this post said DLP watches three exits: email, the laptop and the cloud. Of the 18 DLP and insider-risk products we track, only 7 document all three.[1] - Six of the 18 are modules of platforms a buyer may already pay for, and only 2 print a price: Forcepoint DLP from about US$52 a user a year, Safetica from US$72 to US$144.[1] - None of the 18 documents a PAN, Aadhaar or GSTIN detector. Microsoft Purview, which many Indian firms already license, publishes a built-in India PAN definition.[2] Data loss prevention inspects content at an exit and applies a rule: this file holds a card number, so it may not leave. Our 2024 post described the idea well enough and stopped there. The question a buyer actually has is narrower. Which product covers the exits my data really leaves by, do I already own one, what does it cost in rupees, and will it recognise an Indian identity number when it sees one? We counted the answers across the 18 products in our DLP guide as it stood on 30 September 2026. ## Seven of eighteen watch all three exits the 2024 post promised The guide records, for each product, the channels its vendor documents: endpoint, email, web, cloud applications, removable media, print and AI prompts. Endpoint is the most common at 14 of 18. Email follows at 13, cloud at 11. Only 7 products document all three of the exits our 2024 post described.[1] TechBag countThe seven that cover endpoint, email and cloud Forcepoint DLP, Varonis DLP, Safetica Platform, Cyera Omni DLP, Seclore AI-DLP, Proofpoint DLP & Insider Risk and Mimecast Incydr. Counted from the guide’s channel field for each of its 18 products; a channel counts only where the vendor’s documentation names it. **Figure: Endpoint is the most-covered exit; only 2 of 18 products watch what staff paste into AI tools** *DLP and insider-risk products documenting each channel, of 18 in TechBag's guide, September 2026* Endpoint (the laptop) 14 products Email 13 products Cloud applications 11 products Web uploads 7 products USB and removable media 7 products Print 6 products AI prompts 2 products | | Value (products) | | --- | --- | | Endpoint (the laptop) | 14 | | Email | 13 | | Cloud applications | 11 | | Web uploads | 7 | | USB and removable media | 7 | | Print | 6 | | AI prompts | 2 | Source: TechBag DLP & insider-risk guide, vendor-doc-verified 24 August 2026, TechBag count · as of 30 September 2026 The gaps follow the architecture. Inline platforms such as Zscaler and Netskope see web, cloud and email traffic that passes through them, and nothing on the device: no USB, no print. Endpoint-first products such as Trellix DLP Endpoint and Seqrite DLP are strong on the USB stick and blind to the cloud copy. The AI-prompt channel, the newest way data leaves, is documented by just two: Cyera Omni DLP and Seclore AI-DLP. A buyer who writes “DLP” in a requirement without naming the exits will get a working product watching the wrong door. The 2024 post also missed a second question: not what left, but who is behaving differently. Content rules catch a file with a card number in it. They do not catch the employee who copies a little more each week in the month before resigning. Only 5 of the 18 products have what the guide rates as a full behavioural insider-risk engine; 4 have none, and 9 rely on rules and keywords rather than machine-learning classification, which means someone maintains the patterns by hand.[1] If the incident that started your project was a leaver, shortlist from the five, not from the channel chart. ## Six of eighteen are modules you may already own Twelve of the 18 are products you can buy on their own. The other six are modules of platforms carded in other categories: Zscaler and Netskope in SASE, CrowdStrike on the endpoint, Proofpoint and Mimecast in email, and Coro’s small-business platform. In each case the data control sits inside a subscription the buyer may already hold.[1] The cheapest finding in any DLP project is that it was already paid for. Two other constraints cut the list faster than any feature comparison. Fourteen of the 18 need their own endpoint agent, which has to coexist with the EDR, device-management and SASE agents already on the laptop; only four need none. And nine can run on your own infrastructure, which matters to the Indian estates whose classified content and incident evidence cannot sit in a vendor’s cloud.[1] **Figure: Check four entitlements before buying a standalone DLP product** *The order in which TechBag checks for an already-licensed data-loss control, most likely first, September 2026* 1. 01Microsoft 365E5 adds automatic classification, endpoint DLP and insider-risk management. E3 carries manual and basic labelling only. 2. 02Your SASE contractData protection is a base module at Zscaler and Netskope, not an add-on in most plans. 3. 03Your email securityProofpoint and Mimecast sell DLP and insider risk beside the filter. If email is the main exit, it is one line away. 4. 04Your endpoint agentCrowdStrike sells Falcon Data Protection on the agent you already run. Narrower, but no second agent. Source: TechBag DLP & insider-risk guide, cost section · as of 30 September 2026 Our view Our view: an estate already on Microsoft 365 E5 should prove Purview inadequate before it buys anything on our list. The standalone products earn their price where Purview is weak: USB and print control on mixed fleets, behavioural insider risk, protect-and-send rights management, or an on-premises deployment. That is a real list, but it is a specific one. ## Two of eighteen print a price, and the licence is the small number Sixteen of the 18 are quote-only or sold inside a platform. The two that publish are Forcepoint DLP, from about US$52 a user a year at entry and rising for the full channel stack, and Safetica, at US$72 to US$144 a user a year across its tiers.[1] At our guide’s conversion of ₹83 to the dollar, that is about ₹4,316 a user a year for Forcepoint and ₹5,976 to ₹11,952 for Safetica. **Figure: The only published DLP prices run from about ₹4,300 to ₹12,000 a user a year** *Published list price, ₹ per user per year before 18% GST, converted from USD at ₹83, September 2026* Forcepoint DLP (entry) ₹4,316 Safetica (lowest tier) ₹5,976 Safetica (highest tier) ₹11,952 | | Value (₹) | | --- | --- | | Forcepoint DLP (entry) | 4,316 | | Safetica (lowest tier) | 5,976 | | Safetica (highest tier) | 11,952 | Source: TechBag DLP & insider-risk guide (vendor list prices), vendor-doc-verified 24 August 2026 · as of 30 September 2026 · 16 of 18 products are quote-only or priced inside a platform For a 200-person company that is roughly ₹8.6 lakh a year for Forcepoint at entry and ₹12 lakh to ₹23.9 lakh for Safetica, before GST. Neither figure is the real budget. The guide’s assessment is that classification and policy tuning commonly cost more than the licence in the first year. Someone has to decide what “confidential” means in your organisation, write it down, and cut the false positives until blocking is safe to switch on. Our view Our view: the common failure is not choosing the wrong vendor. It is turning on blocking in week two, stopping the finance team’s invoices, and reverting to monitor-only for good. Run monitor first, tune against real traffic, then block one narrow policy at a time. ## None of the eighteen documents an Indian ID detector A DLP classifier is only as useful as the patterns it knows. US products ship detectors for social security numbers and US card formats. We looked for documented PAN, Aadhaar or GSTIN detection across all 18 products and found it for none.[1] That does not prove they cannot be configured to find them, since most allow custom patterns, but it means the work and the testing fall to you. **Figure: Four of eighteen are built in India; none documents Indian identity-number detection** *DLP and insider-risk products in TechBag's guide, by India attribute, of 18, September 2026* Document PAN, Aadhaar or GSTIN classification 18 18 products Built in India: Data Resolve (2), Seqrite, Seclore 4 14 18 products Document an India data region: Zscaler, Netskope 16 18 products Document India residency at all 6 12 18 products | | Yes | No | | --- | --- | --- | | Document PAN, Aadhaar or GSTIN classification | 0 | 18 | | Built in India: Data Resolve (2), Seqrite, Seclore | 4 | 14 | | Document an India data region: Zscaler, Netskope | 2 | 16 | | Document India residency at all | 6 | 12 | Source: TechBag DLP & insider-risk guide, vendor-doc-verified 24 August 2026, TechBag count · as of 30 September 2026 Being built in India does not change the classifier result: Data Resolve, Seqrite and Seclore do not document Indian data-type detection either. The product that does is outside our 18. Microsoft Purview publishes a built-in sensitive-information type for the India Permanent Account Number, matched on the ten-character format plus nearby keywords.[2] For an estate on Microsoft 365, that is one more reason to test what is already licensed before buying. For everyone else, make PAN and Aadhaar detection a proof-of-concept test on your own records, not a datasheet question. If you are buying this in India **Cost.** Forcepoint and Safetica price in USD; budget a reseller’s INR quote plus 18% GST. Data Resolve, Seqrite and Seclore quote per user or per endpoint in rupees, on-premises or cloud.[1] Ask every vendor for the price of the tuning effort as well as the licence: it is the line most quotes leave out. **Regulation.** The Digital Personal Data Protection Act, 2023 sets a penalty of up to ₹250 crore for failing to take reasonable security safeguards against a personal-data breach, and up to ₹200 crore for failing to notify one.[3] The DPDP Rules were notified on 13 November 2025; those substantive duties apply from 13 May 2027.[4] CERT-In’s Directions of 28 April 2022 already require incidents, data leaks included, to be reported within six hours.[5] Banks answer as well to RBI’s Cybersecurity, Technology Risk and Resilience Framework Directions of 31 July 2026.[6] A DLP console that cannot recognise a PAN or an Aadhaar number does little for any of these obligations, which is why the Indian-ID test belongs in the proof of concept. How we did this Figures as of 30 September 2026 All product counts come from TechBag’s DLP & insider-risk guide as committed on 30 September 2026: 18 products by SKU across 14 vendors, each vendor-doc-verified on 24 August 2026. A channel, a deployment option or an India attribute is counted only where the vendor documents it; “not documented” is not the same as “not supported”. Prices are the vendors’ list prices as recorded in the guide; rupee figures use the guide’s conversion of ₹83 to the dollar and exclude GST. The 200-user totals are our arithmetic. Microsoft Purview is not one of the 18 and is cited from Microsoft’s own definition page. Excluded: data security posture management and encryption products, which have their own guides. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [TechBag, DLP & insider-risk guide (version of 30 September 2026)](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk) — vendor-doc-verified 24 August 2026 2. [Microsoft Learn, India permanent account number (PAN) entity definition (Microsoft Purview)](https://learn.microsoft.com/en-us/purview/sit-defn-india-permanent-account-number) — page updated 15 June 2026 3. [Digital Personal Data Protection Act, 2023, Schedule (penalties)](https://www.meity.gov.in/data-protection-framework) — 11 August 2023 4. [DPDP Rules 2025, commencement timeline](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025 5. [CERT-In, Directions under section 70B(6) of the IT Act](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 6. [RBI, Cybersecurity, Technology Risk and Resilience Framework Directions, 2026, via practitioner summary](https://taxguru.in/rbi/rbi-issues-commercial-banks-cybersecurity-technology-risk-resilience-framework-directions-2026.html) — 31 July 2026 RBI PDF not fetched. Related on TechBag: the [DLP & insider-risk guide](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk) filters all 18 products by channel, deployment and India attributes; the [DSPM guide](https://www.thetechbag.com/browse/data-security-privacy/dspm) covers finding the data before you guard its exits. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [DLP & insider-risk guide](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk) — all 18 products filtered by channel, deployment and India attributes - [DSPM & data discovery guide](https://www.thetechbag.com/browse/data-security-privacy/dspm) — finding the data before guarding its exits - [Safetica Platform](https://www.thetechbag.com/safetica/safetica-platform) — one of the two DLP products with a published per-user price