# Every DLP deployment starts by discovering that nobody agrees what “sensitive” means here. The policy work is the project; the licence is the small number.

*DLP & Insider Risk — a TechBag decision guide. Last reviewed 2026-10-03.*

> A DLP product inspects content at an exit point and enforces a rule on it. That requires a rule — and writing one means the organisation has decided, in writing, which documents matter and what may happen to them. Most have not, which is why the first six months are policy work rather than product work.

**The checkable fact:** The test before you shortlist: ask three people in the business to define a confidential document. If the answers differ, the tuning effort is the project and the licence is a rounding error against it.

- Canonical: https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk
- Category: [Data Security & Privacy](https://www.thetechbag.com/browse/data-security-privacy)
- Products compared: 21

## What dlp & insider risk actually is

Data loss prevention inspects content — in a file, an email, an upload or a clipboard — and decides whether the action may proceed. Insider risk asks a different question: not what this file contains, but whether this person’s behaviour has changed. Most estates need both, and most buy one while describing the other.

The twenty-one products below split by where they inspect and what they can act on. Fourteen are standalone products. Seven are modules of platforms carded in other categories — Zscaler and Netskope in SASE, CrowdStrike in endpoint, Proofpoint and Mimecast in email, Coro in the SMB platform, Menlo in secure browsing. Those seven are frequently already licensed.

**The most common mis-purchase.** Whether the thing you are buying is a **product or a module**. Seven of these twenty-one ship inside a subscription you may already hold, and estates routinely buy a standalone DLP while paying for an unused data-protection module in their SASE contract. Check the entitlement first; it is the cheapest finding on this page.

## Four terms, resolved

These are adjacent controls at different points in the data’s life, not tiers. A product that classifies perfectly may block nothing; a product that blocks at the endpoint may never see the cloud copy.

### DLP vs insider risk

Is the question what left, or who is behaving differently?

### Insider risk vs UEBA

Are you buying the product, or the technique inside it?

### Endpoint vs network DLP

Where does your data actually leave from?

### Cloud DLP vs the rest

Sanctioned applications, or all of them?

None of these four is a better product than the others. They watch different exits, and an estate that buys one and describes another gets a working product answering a question nobody asked.

## The decision variables

Six variables move the shortlist. Everything else is preference.

**Channel coverage.** Endpoint, email, web, cloud, USB, print, screenshot — and AI prompt, the newest and least covered. Ask for the list, not the category.

**Classification approach.** Regex and keyword needs manual upkeep. Machine learning needs training and tuning. Fingerprinting works only on documents you already have. Each has a different first-year effort.

**Block, monitor or coach.** Blocking demands a false-positive rate low enough that the business tolerates it. Coaching changes behaviour without stopping work, and is why several mid-market products lead with it.

**Behavioural depth.** Rule-based DLP and behavioural insider risk answer different questions. Confirm which engine is actually present rather than which words are in the datasheet.

**Agent coexistence.** Another endpoint agent alongside your EDR, UEM and SASE agents is a real operational cost and a real conflict risk. Two products here need no agent at all.

**Product or module.** Seven of twenty-one are modules. If you run the platform, the control may already be licensed.

## The 21 products

Every product carries one stated limitation. Prices are USD with an indicative INR conversion, tier- and term-matched where the vendor publishes one.

### Forcepoint DLP — Forcepoint

- **Who it's for:** Estates that want one DLP policy enforced everywhere rather than four products with four consoles — and the broadest single-vendor channel coverage on this page.
- **The honest limitation:** Breadth costs tuning: the classifier library is large and the first months are spent cutting false positives before blocking mode is credible. An India data region is not documented — confirm before assuming residency for classified content.
- **Price:** Quote — per user / year, quote-only — Forcepoint publishes no DLP list price, and online figures are third-party estimates; one policy engine across endpoint, network, email, web and cloud with a large pre-built classifier library
- **Details:** https://www.thetechbag.com/forcepoint/forcepoint-dlp

### Forcepoint Risk-Adaptive Protection — Forcepoint

- **Who it's for:** Organisations whose false-positive problem is really a policy-granularity problem — the same action is fine from one person and not from another, and a single rule cannot express that.
- **The honest limitation:** An add-on, not a standalone purchase: it needs Forcepoint DLP underneath. Behavioural scoring also needs a baseline period before it is useful, so value arrives months after signature.
- **Price:** Quote (add-on) — quoted as an add-on to Forcepoint DLP; behavioural risk scoring that raises or relaxes enforcement per user as their risk changes, rather than one static policy for everyone
- **Details:** https://www.thetechbag.com/forcepoint/forcepoint-risk-adaptive-protection

### Varonis DLP — Varonis

- **Who it's for:** Estates that already run Varonis for discovery and want enforcement driven by what the platform found, rather than a second product with a second definition of sensitive.
- **The honest limitation:** The case is much weaker without the Varonis platform underneath — it is the enforcement arm of a discovery investment, not a first DLP purchase. Quote-only.
- **Price:** Quote — quoted per user or per data store within the Varonis platform; DLP that acts on the same classification and access-path map the DSPM half already built
- **Details:** https://www.thetechbag.com/varonis/varonis-dlp

### Trellix DLP Endpoint — Trellix

- **Who it's for:** Estates whose exfiltration path is physical and local — removable media, printing, the laptop that leaves the network — and who already run Trellix ePO for management.
- **The honest limitation:** Endpoint-scoped: it does not see the cloud copy or the webmail upload unless the network and discovery products are bought alongside. Rule-based classification needs manual maintenance as data changes.
- **Price:** Quote — quoted per endpoint, perpetual or subscription; device-level control of USB, print, clipboard, screenshot and local file operations, managed from the Trellix ePO console
- **Details:** https://www.thetechbag.com/trellix/trellix-dlp-endpoint

### Trellix DLP Network — Trellix

- **Who it's for:** Estates that need inspection without deploying another agent, particularly where unmanaged devices sit on the corporate network.
- **The honest limitation:** Blind to anything encrypted it cannot terminate, which today is most traffic — and entirely blind once the laptop leaves the network. Network DLP alone routinely misses the USB stick.
- **Price:** Quote — quoted per appliance or throughput; inspects traffic in flight for policy violations at the network boundary, with no endpoint agent required
- **Details:** https://www.thetechbag.com/trellix/trellix-dlp-network

### Safetica Platform — Safetica

- **Who it's for:** Mid-market estates that want published pricing and a working deployment in weeks rather than an enterprise programme — and the user-coaching model, which changes behaviour without blocking work.
- **The honest limitation:** Less depth than the enterprise suites on classification sophistication and very large estates; documented deployments are mid-market. India data residency is not documented.
- **Price:** $72–144 (≈ ₹5,976) — per user / year published list across Discovery, Protection and Enterprise (about ₹5,976–₹11,952); DLP with insider-risk analytics and user coaching, sized and priced for the mid-market
- **Details:** https://www.thetechbag.com/safetica/safetica-platform

### Safetica On-Prem — Safetica

- **Who it's for:** Regulated and localisation-sensitive estates that cannot send classified content or incident evidence to a vendor cloud.
- **The honest limitation:** You own the server, the database and the upgrade cycle; the cloud edition gets features first. Narrower channel coverage than the SaaS platform.
- **Price:** Quote — quoted per user, self-hosted; the same DLP and insider-risk engine kept entirely inside your own infrastructure
- **Details:** https://www.thetechbag.com/safetica/safetica-on-prem

### Data Resolve inDefend DLP — Data Resolve

- **Who it's for:** Indian estates that want the vendor, the support engineer and the data in the same country, with an on-premises option and a price in rupees.
- **The honest limitation:** Narrower cloud-application coverage than the global suites, and documented deployments are Indian mid-market rather than global enterprise. Indian data-type classification is not documented — prove it against your own records.
- **Price:** Quote (INR) — quoted per user in INR, on-premises or cloud; endpoint-centric DLP with user-activity monitoring, built and supported from India
- **Details:** https://www.thetechbag.com/dataresolve/dataresolve-dlp

### Data Resolve UBA — Data Resolve

- **Who it's for:** Estates whose question is who is behaving differently rather than which file contained a card number — the resignation-shaped pattern that content rules never see.
- **The honest limitation:** Analytics, not enforcement: it produces signal and names no policy. Without a DLP alongside it you can see the behaviour and cannot stop the file.
- **Price:** Quote (INR) — quoted per user in INR; user behaviour analytics over endpoint activity — baselines normal and flags deviation rather than matching file content to a rule
- **Details:** https://www.thetechbag.com/dataresolve/dataresolve-uba

### Seqrite DLP — Seqrite

- **Who it's for:** Indian estates already running Seqrite endpoint protection that want data controls on the agent they have deployed rather than a second one.
- **The honest limitation:** A module on an endpoint suite rather than a full DLP platform: no network or cloud inspection, and no behavioural analytics. Right answer when the requirement is device control; wrong one when it is cloud egress.
- **Price:** Quote (INR) — quoted per endpoint in INR, frequently bundled with Seqrite endpoint protection; device control, application control and content rules on the same agent
- **Details:** https://www.thetechbag.com/seqrite/seqrite-dlp

### Cyera Omni DLP — Cyera

- **Who it's for:** Cloud-first estates that want enforcement to inherit a classification they trust, and one of the few products here documenting AI-prompt as a channel.
- **The honest limitation:** Newer than the incumbent suites, and the strongest case assumes the Cyera platform underneath. Quote-only, and India residency is not documented.
- **Price:** Quote — quoted within the Cyera platform; DLP driven by the AI-native classification the DSPM half produces, including controls on data pasted into AI assistants
- **Details:** https://www.thetechbag.com/cyera/cyera-omni-dlp

### Seclore AI-DLP — Seclore

- **Who it's for:** Estates where files legitimately have to go outside and blocking is not an acceptable answer — the DLP decision becomes protect-and-send rather than allow-or-deny.
- **The honest limitation:** The distinctive capability assumes you also adopt Seclore's rights management; as a pure DLP it is narrower than Forcepoint or Trellix. Indian data-type classification is not documented despite the India-built positioning.
- **Price:** Quote (INR) — quoted per user in INR from the Mumbai-built vendor; DLP that hands off to Seclore's rights management rather than only blocking — the file leaves protected instead of not leaving
- **Details:** https://www.thetechbag.com/seclore/seclore-ai-dlp

### Proofpoint DLP & Insider Risk — Proofpoint

- **Who it's for:** Estates already running Proofpoint for email security whose data-loss path is overwhelmingly outbound mail — the control sits where the traffic already is.
- **The honest limitation:** A module of a platform, not a standalone purchase: buying it without Proofpoint email security is unusual and priced accordingly. Weaker on USB, print and local device control than the endpoint-first suites.
- **Price:** Quote (in the suite) — quoted inside the Proofpoint suite, commonly alongside email security; people-centric DLP with insider-risk telemetry, strongest where the exit is email
- **Details:** https://www.thetechbag.com/proofpoint/proofpoint-dlp-insider

### Mimecast Incydr — Mimecast

- **Who it's for:** Estates whose real question is departing-employee data theft, where the file's journey matters more than its contents and rule-writing has already failed.
- **The honest limitation:** Telemetry-first by design: it is deliberately not a rule-based blocking DLP, so estates that need to stop the transfer in the moment will find it monitors rather than prevents.
- **Price:** Quote (in the suite) — quoted within Mimecast; insider risk built on file-movement telemetry — what moved, where it went and who moved it — rather than content-matching rules
- **Details:** https://www.thetechbag.com/mimecast/mimecast-incydr

### Zscaler Data Protection — Zscaler

- **Who it's for:** Estates already routing traffic through Zscaler — the inspection point exists, so data controls are a licence change rather than a deployment.
- **The honest limitation:** Inline coverage only: it sees what traverses the platform and nothing local — USB, print and offline file operations are outside its view entirely. Check whether your subscription already includes it before buying anything on this page.
- **Price:** In the platform — a module inside the Zero Trust Exchange subscription, not a separate purchase; inline inspection of web and cloud traffic that already passes the platform, plus CASB and SaaS posture
- **Details:** https://www.thetechbag.com/zscaler/zscaler-data-protection

### Netskope Data Protection — Netskope

- **Who it's for:** Estates whose data problem is SaaS sprawl — including unsanctioned applications — and who want the inspection and the residency documented in the same platform.
- **The honest limitation:** Like every inline platform it is blind to local device activity. The strongest case assumes Netskope is already the SASE choice; bought alone it is an expensive DLP.
- **Price:** In the platform — a module of the Netskope platform where CASB and DLP are core rather than bolted on; eight Indian data centres with a Mumbai management plane supporting DPDP-aligned residency
- **Details:** https://www.thetechbag.com/netskope/netskope-data-protection

### CrowdStrike Falcon Data Protection — CrowdStrike

- **Who it's for:** Falcon estates that want basic data controls without adding an agent — the single most common source of endpoint conflict on this page.
- **The honest limitation:** Narrower than a dedicated DLP suite: no email or deep cloud inspection, and classification is rule-based. It is the pragmatic answer for estates that will not tolerate another agent, not the complete one.
- **Price:** In the platform — a Falcon module licensed per endpoint on the agent you already run; data controls with no second agent to deploy or reconcile
- **Details:** https://www.thetechbag.com/crowdstrike/crowdstrike-falcon-data-protection

### Coro Cloud & Data Governance — Coro

- **Who it's for:** Small estates with no security team that want a data control switched on rather than a project scoped — the honest floor of this category.
- **The honest limitation:** Deliberately simple: shallow classification, no behavioural analytics and no local device control. It is a starting position, not a compliance answer for a regulated estate.
- **Price:** In the platform — a module of the Coro modular platform, priced per user alongside the other modules an SMB turns on; cloud application and email data governance with deliberately few settings
- **Details:** https://www.thetechbag.com/coro/coro-cloud-data-governance

### Symantec DLP (Broadcom) — Broadcom

- **Who it's for:** Large regulated estates that want one mature DLP policy across endpoints, network egress, email and cloud apps.
- **The honest limitation:** Quote-only and heavy to run on premises; Indian data identifiers and an Indian cloud region are not documented — test with your own data.
- **Price:** Quote — quoted through partners; detection on endpoints, file shares, databases, web, email and cloud apps, run as DLP Core in your own data centre or as DLP Cloud, with exact-data and document fingerprinting
- **Details:** https://www.thetechbag.com/broadcom/broadcom-symantec-dlp

### Menlo AI Adaptive DLP — Menlo Security

- **Who it's for:** Menlo customers who want sensitive fields redacted in files and AI prompts rather than whole transfers blocked.
- **The honest limitation:** Bought on top of the Menlo platform, with no endpoint agent, so USB and print are out of reach; Indian identifiers and log residency are not documented.
- **Price:** Add-on — an add-on to Menlo’s platform, quoted per user; it masks sensitive values inside files and pages instead of blocking the whole file (formerly Votiro’s data-detection product)
- **Details:** https://www.thetechbag.com/menlo-security/menlo-security-ai-adaptive-dlp

### Fortra DLP — Fortra

- **Who it's for:** Estates with Linux engineering or R&D desks that other agents skip, and lean security teams that want the option of Fortra's analysts tuning policy and triaging alerts as a managed service.
- **The honest limitation:** Quote-only with no stated meter, and IDC's 2025 DLP MarketScape placed Fortra as a Major Player rather than a Leader. Email is not documented as its own channel, the SaaS hosting region is not published, and the cloud channel depends on the SSE line Fortra bought from Lookout in May 2025.
- **Price:** Quote — quoted by Fortra with no published meter; endpoint agent for Windows, macOS and Linux, a network DLP appliance, data discovery and AWS-hosted analytics, sold as SaaS, as a managed service run by Fortra's own analysts, or on-premises
- **Details:** https://www.thetechbag.com/fortra/fortra-dlp

## Why each constraint rules out what it does

The full narrowing logic, as prose. Nothing here is hidden behind an interaction.

**removable media and print.** Rules out Forcepoint Risk-Adaptive Protection, Varonis DLP, Trellix DLP Network, Data Resolve UBA, Cyera Omni DLP, Seclore AI-DLP, Proofpoint DLP & Insider Risk, Mimecast Incydr, Zscaler Data Protection, Netskope Data Protection, Coro Cloud & Data Governance, Symantec DLP (Broadcom) and Menlo AI Adaptive DLP — no local device control: USB and print are outside what it sees. That leaves Forcepoint DLP, Trellix DLP Endpoint, Safetica Platform, Safetica On-Prem, Data Resolve inDefend DLP, Seqrite DLP, CrowdStrike Falcon Data Protection and Fortra DLP.

**cloud applications.** Rules out Trellix DLP Endpoint, Trellix DLP Network, Safetica On-Prem, Data Resolve inDefend DLP, Data Resolve UBA, Seqrite DLP and CrowdStrike Falcon Data Protection — no cloud application inspection. That leaves Forcepoint DLP, Forcepoint Risk-Adaptive Protection, Varonis DLP, Safetica Platform, Cyera Omni DLP, Seclore AI-DLP, Proofpoint DLP & Insider Risk, Mimecast Incydr, Zscaler Data Protection, Netskope Data Protection, Coro Cloud & Data Governance, Symantec DLP (Broadcom), Menlo AI Adaptive DLP and Fortra DLP.

**outbound email.** Rules out Forcepoint Risk-Adaptive Protection, Trellix DLP Endpoint, Data Resolve UBA, Seqrite DLP, CrowdStrike Falcon Data Protection and Fortra DLP — email is not an inspected channel. That leaves Forcepoint DLP, Varonis DLP, Trellix DLP Network, Safetica Platform, Safetica On-Prem, Data Resolve inDefend DLP, Cyera Omni DLP, Seclore AI-DLP, Proofpoint DLP & Insider Risk, Mimecast Incydr, Zscaler Data Protection, Netskope Data Protection, Coro Cloud & Data Governance, Symantec DLP (Broadcom) and Menlo AI Adaptive DLP.

**AI assistants.** Rules out Forcepoint DLP, Forcepoint Risk-Adaptive Protection, Varonis DLP, Trellix DLP Endpoint, Trellix DLP Network, Safetica Platform, Safetica On-Prem, Data Resolve inDefend DLP, Data Resolve UBA, Seqrite DLP, Proofpoint DLP & Insider Risk, Mimecast Incydr, Zscaler Data Protection, Netskope Data Protection, CrowdStrike Falcon Data Protection, Coro Cloud & Data Governance and Symantec DLP (Broadcom) — AI-prompt exfiltration is not documented as a covered channel. That leaves Cyera Omni DLP, Seclore AI-DLP, Menlo AI Adaptive DLP and Fortra DLP.

**no new agent.** Rules out Forcepoint DLP, Forcepoint Risk-Adaptive Protection, Varonis DLP, Trellix DLP Endpoint, Safetica Platform, Safetica On-Prem, Data Resolve inDefend DLP, Data Resolve UBA, Seqrite DLP, Cyera Omni DLP, Seclore AI-DLP, Proofpoint DLP & Insider Risk, Mimecast Incydr, CrowdStrike Falcon Data Protection, Symantec DLP (Broadcom) and Fortra DLP — requires its own agent alongside your endpoint, UEM and SASE agents. That leaves Trellix DLP Network, Zscaler Data Protection, Netskope Data Protection, Coro Cloud & Data Governance and Menlo AI Adaptive DLP.

**on-premises.** Rules out Varonis DLP, Safetica Platform, Cyera Omni DLP, Proofpoint DLP & Insider Risk, Mimecast Incydr, Zscaler Data Protection, Netskope Data Protection, CrowdStrike Falcon Data Protection, Coro Cloud & Data Governance and Menlo AI Adaptive DLP — SaaS only. That leaves Forcepoint DLP, Forcepoint Risk-Adaptive Protection, Trellix DLP Endpoint, Trellix DLP Network, Safetica On-Prem, Data Resolve inDefend DLP, Data Resolve UBA, Seqrite DLP, Seclore AI-DLP, Symantec DLP (Broadcom) and Fortra DLP.

**a standalone product.** Rules out Proofpoint DLP & Insider Risk, Mimecast Incydr, Zscaler Data Protection, Netskope Data Protection, CrowdStrike Falcon Data Protection, Coro Cloud & Data Governance and Menlo AI Adaptive DLP — a module of a platform, priced and sold inside that subscription. That leaves Forcepoint DLP, Forcepoint Risk-Adaptive Protection, Varonis DLP, Trellix DLP Endpoint, Trellix DLP Network, Safetica Platform, Safetica On-Prem, Data Resolve inDefend DLP, Data Resolve UBA, Seqrite DLP, Cyera Omni DLP, Seclore AI-DLP, Symantec DLP (Broadcom) and Fortra DLP.

**behavioural insider risk.** Rules out Forcepoint DLP, Safetica Platform, Safetica On-Prem, Data Resolve inDefend DLP, Cyera Omni DLP, Seclore AI-DLP, Zscaler Data Protection, Netskope Data Protection, CrowdStrike Falcon Data Protection, Symantec DLP (Broadcom) and Fortra DLP — some behavioural signal, but not a insider-risk engine; Trellix DLP Endpoint, Trellix DLP Network, Seqrite DLP, Coro Cloud & Data Governance and Menlo AI Adaptive DLP — content rules only, no behavioural analytics. That leaves Forcepoint Risk-Adaptive Protection, Varonis DLP, Data Resolve UBA, Proofpoint DLP & Insider Risk and Mimecast Incydr.

**machine-learning classification.** Rules out Trellix DLP Endpoint, Trellix DLP Network, Safetica Platform, Safetica On-Prem, Data Resolve inDefend DLP, Data Resolve UBA, Seqrite DLP, CrowdStrike Falcon Data Protection and Coro Cloud & Data Governance — rule and keyword based, which needs manual upkeep as data changes; Mimecast Incydr and Symantec DLP (Broadcom) — fingerprints known documents rather than classifying new ones. That leaves Forcepoint DLP, Forcepoint Risk-Adaptive Protection, Varonis DLP, Cyera Omni DLP, Seclore AI-DLP, Proofpoint DLP & Insider Risk, Zscaler Data Protection, Netskope Data Protection, Menlo AI Adaptive DLP and Fortra DLP.

**user coaching.** Rules out Forcepoint DLP, Varonis DLP, Trellix DLP Endpoint, Trellix DLP Network, Safetica On-Prem, Data Resolve inDefend DLP, Data Resolve UBA, Seqrite DLP, Cyera Omni DLP, Proofpoint DLP & Insider Risk, Mimecast Incydr, Zscaler Data Protection, Netskope Data Protection, CrowdStrike Falcon Data Protection, Coro Cloud & Data Governance, Symantec DLP (Broadcom), Menlo AI Adaptive DLP and Fortra DLP — blocks or monitors; no in-the-moment user coaching documented. That leaves Forcepoint Risk-Adaptive Protection, Safetica Platform and Seclore AI-DLP.

**India residency.** Rules nothing out on published terms. It flags Forcepoint DLP — India residency for classified content is not documented, Forcepoint Risk-Adaptive Protection — India residency for classified content is not documented, Varonis DLP — India residency for classified content is not documented, Trellix DLP Endpoint — India residency for classified content is not documented, Trellix DLP Network — India residency for classified content is not documented, Safetica Platform — India residency for classified content is not documented, Safetica On-Prem — India residency for classified content is not documented, Cyera Omni DLP — India residency for classified content is not documented, Proofpoint DLP & Insider Risk — India residency for classified content is not documented, Mimecast Incydr — India residency for classified content is not documented, Zscaler Data Protection — Data region documented, Netskope Data Protection — Data region documented, CrowdStrike Falcon Data Protection — India residency for classified content is not documented, Coro Cloud & Data Governance — India residency for classified content is not documented, Symantec DLP (Broadcom) — India residency for classified content is not documented, Menlo AI Adaptive DLP — India residency for classified content is not documented and Fortra DLP — India residency for classified content is not documented — marked, not removed.

**Indian data types.** Rules nothing out on published terms. It flags Forcepoint DLP — Indian data-type classification is not documented by the vendor, Forcepoint Risk-Adaptive Protection — Indian data-type classification is not documented by the vendor, Varonis DLP — Indian data-type classification is not documented by the vendor, Trellix DLP Endpoint — Indian data-type classification is not documented by the vendor, Trellix DLP Network — Indian data-type classification is not documented by the vendor, Safetica Platform — Indian data-type classification is not documented by the vendor, Safetica On-Prem — Indian data-type classification is not documented by the vendor, Data Resolve inDefend DLP — Indian data-type classification is not documented by the vendor, Data Resolve UBA — Indian data-type classification is not documented by the vendor, Seqrite DLP — Indian data-type classification is not documented by the vendor, Cyera Omni DLP — Indian data-type classification is not documented by the vendor, Seclore AI-DLP — Indian data-type classification is not documented by the vendor, Proofpoint DLP & Insider Risk — Indian data-type classification is not documented by the vendor, Mimecast Incydr — Indian data-type classification is not documented by the vendor, Zscaler Data Protection — Indian data-type classification is not documented by the vendor, Netskope Data Protection — Indian data-type classification is not documented by the vendor, CrowdStrike Falcon Data Protection — Indian data-type classification is not documented by the vendor, Coro Cloud & Data Governance — Indian data-type classification is not documented by the vendor, Symantec DLP (Broadcom) — Indian data-type classification is not documented by the vendor, Menlo AI Adaptive DLP — Indian data-type classification is not documented by the vendor and Fortra DLP — Indian data-type classification is not documented by the vendor — marked, not removed.

**Seven of these twenty-one are modules, not products.** Zscaler, Netskope, CrowdStrike, Coro, Proofpoint, Mimecast and Menlo sell data protection inside a platform subscription. If you already run the platform, check your entitlement before buying anything on this page — the control may already be paid for.

**Indian data types are undocumented everywhere.** No vendor on this page documents PAN, Aadhaar or GSTIN classification support. That is marked per product and never used to eliminate one. Prove it in a proof of concept with your own records; a classifier tuned for US social security numbers finds nothing useful in an Indian estate.

**The licence is the small number.** Classification and policy tuning commonly exceed the licence in year one. Someone has to decide what sensitive means in your organisation, document it, and cut the false positives until blocking is credible. No vendor does that for you.

**Blocking mode is a decision, not a setting.** The common failure is enabling block too early, stopping legitimate business, and reverting to monitor permanently. Estates that succeed run monitor first, tune against real traffic, then block one narrow high-confidence policy at a time.

## Eight situations, and what each one buys

If one of these is your sentence, the shortlist is short.

### A departing employee copied files to a personal drive

**Shortlist:** Mimecast Incydr, Forcepoint Risk-Adaptive Protection, Varonis DLP, Data Resolve UBA

**Why:** This is a behavioural question, not a content one — the pattern precedes the transfer by weeks and no content rule describes it.

**Trade-off:** Incydr monitors rather than blocks by design; if you need the transfer stopped in the moment, pair it with an enforcing DLP.

### Someone pasted customer data into a public AI assistant

**Shortlist:** Cyera Omni DLP, Seclore AI-DLP

**Why:** AI prompt is the newest exfiltration channel and only these two document it as covered.

**Trade-off:** Both are newer than the incumbent suites and both are strongest with their own platform underneath.

### The exfiltration path is USB sticks and printing

**Shortlist:** Trellix DLP Endpoint, Seqrite DLP, Data Resolve inDefend, Safetica Platform

**Why:** Local device control needs an agent on the device; no inline platform sees any of this.

**Trade-off:** The endpoint-first products are correspondingly thinner on cloud application coverage.

### We already route everything through Zscaler or Netskope

**Shortlist:** Zscaler Data Protection, Netskope Data Protection

**Why:** The inspection point already exists — this is a licence change rather than a deployment.

**Trade-off:** Neither sees local device activity. If USB and print matter, you still need an endpoint product.

### We will not deploy another endpoint agent

**Shortlist:** CrowdStrike Falcon Data Protection, Zscaler Data Protection, Netskope Data Protection, Trellix DLP Network

**Why:** Either the control rides an agent you already run, or it needs no agent at all.

**Trade-off:** All four are narrower than a dedicated endpoint DLP suite; this is the pragmatic answer, not the complete one.

### Classified content cannot leave our infrastructure

**Shortlist:** Safetica On-Prem, Data Resolve inDefend, Seqrite DLP, Trellix DLP Network, Forcepoint DLP

**Why:** All five deploy on-premises, and three are India-built with INR pricing and local support.

**Trade-off:** You own the server, the database and the upgrade cycle; cloud editions get features first.

### We want published pricing and a deployment in weeks

**Shortlist:** Safetica Platform

**Why:** It is the only product on this page with a published per-user list you can budget against before a sales conversation.

**Trade-off:** Safetica is mid-market in depth; Forcepoint publishes no DLP list price, so it is quote-only like the rest.

### No security team, and something has to be switched on

**Shortlist:** Coro Cloud & Data Governance

**Why:** Deliberately few settings, priced per user inside a modular platform an SMB can run without specialists.

**Trade-off:** Shallow classification, no behavioural analytics, no local device control. A starting position, not a compliance answer.

## At scale

DLP scales by users and by the number of exits you have to watch, not by data volume.

### 1 users — Under 200 users

- Coro or a platform module is usually enough
- One channel — normally email or USB — carries most of the risk
- Nobody will tune a complex policy set

**The test:** Ask which single exit accounts for most of your exposure, and cover that.

### 2 users — 200–2,000 users

- Safetica's published pricing fits here
- Monitor first, then one narrow blocking policy
- The incident queue needs a named owner

**The test:** Name the person who reviews alerts before you sign.

### 3 users — 2,000–10,000 users

- Multi-channel coverage becomes the requirement
- Behavioural insider risk starts earning its licence
- Agent coexistence with EDR and UEM is a real constraint

**The test:** Test agent conflict in a pilot ring, not in production.

### 4 users — 10,000+ users

- One policy engine across all channels avoids four consoles
- Risk-adaptive enforcement replaces one static rule set
- Tuning is a standing role, not a project

**The test:** Budget the tuning role permanently — it does not end at go-live.

Documented deployment scale is stated per product where the vendor publishes it, and marked as mid-market where the evidence is mid-market.

## Getting out

DLP policy is the asset, and almost none of it is portable.

**Policy rules** — Every vendor expresses them differently; there is no interchange format *(Rebuilt from scratch)*

**Classification labels** — Microsoft Information Protection labels are the nearest thing to a standard and are read by several products here *(Partly portable)*

**Incident history** — Exports to CSV or via API almost everywhere; the evidentiary value depends on your retention obligation *(Portable)*

**The tuning effort** — The months spent cutting false positives do not transfer — the new engine classifies differently *(Not portable)*

The practical consequence: switching DLP means re-running the tuning project. That is the real switching cost, and it is why the first choice deserves a proof of concept with your own documents.

## What it costs

Per user or per endpoint, in USD and INR where the vendor publishes a list.

### Do you already own one?

Four checks, in the order most likely to return a yes.

- **Microsoft Purview — The dominant already-own answer in this category.** E3 carries manual and basic labelling. **E5 adds automatic classification, endpoint DLP and insider risk management** — which is the tier most comparisons on this page are really against. Standalone Purview SKUs sit between the two.

- **Your SASE or SSE subscription — DLP is a base module at Zscaler and Netskope.** Not an add-on in most plans. Check the entitlement before buying a standalone product for the same job.

- **Your email security platform — Proofpoint and Mimecast both sell DLP beside the filter.** If email is your dominant exit, the control may be one line item away in a contract you already hold.

- **Your endpoint platform — CrowdStrike sells Falcon Data Protection on the agent you run.** Narrower than a suite, but it adds no agent — which is the constraint that usually decides this row.

None of these is automatically right. Each is a real option that a shortlist built from vendor comparisons will miss entirely.

### What the rest actually cost

Two vendors publish a list. The rest quote, and the India-built options quote in rupees.

### What isn't in the licence price

- **Classification and policy tuning.** The largest hidden line. Commonly exceeds the licence in year one and does not end at go-live.

- **The incident review queue.** Alerts need a named reviewer. Without one the console fills and the deployment quietly becomes shelfware.

- **Proof of concept on Indian data types.** No vendor documents PAN, Aadhaar or GSTIN support. Budget the time to prove it against your own records.

- **Agent coexistence testing.** Where the product needs its own agent, conflicts with EDR and UEM are found in a pilot ring or in production.

## What goes wrong

Six ways this purchase goes wrong. Each is recoverable if caught before signature.

- **Blocking mode enabled too early.** Legitimate business stops, the policy reverts to monitor within days, and it is never re-enabled. Monitor first, tune, then block one narrow policy.

- **Classification rules that flag every invoice.** A rule matching any nine-digit number flags the entire finance function. Precision is tuning work, and it is the work that decides whether anyone trusts the console.

- **Agent conflicts with the existing EDR.** Two agents hooking the same file operations degrade the endpoint or break each other. Test in a pilot ring; two products here need no agent at all.

- **Cloud DLP that only sees sanctioned applications.** The personal drive a user signs into is invisible unless traffic also passes an inline proxy. Ask for the connected-application list.

- **No owner for the incident queue.** Alerts accumulate unreviewed and the deployment becomes shelfware with a renewal attached. Name the reviewer before signing.

- **AI prompt exfiltration uncovered.** Most policies do not cover it at all. Two products on this page document it as a channel; if that is your exposure, it is a shortlist of two.

## Questions this guide answers

### What is the difference between DLP and insider risk management?

DLP inspects content and enforces a policy on it — this file contains a card number, so it may not leave. Insider risk scores a person's behaviour over time: unusual volume, unusual hours, movement to personal storage in the weeks before a resignation. Rule-based DLP misses the behavioural pattern entirely, and behavioural tooling frequently cannot name the specific file that went. Most estates need both, and most buy one while describing the other in the requirement.

### Do I already own DLP?

Very possibly. Microsoft Purview inside Microsoft 365 E5 includes automatic classification, endpoint DLP and insider risk management; E3 carries only manual and basic labelling. Zscaler and Netskope include data protection as a base module of their SASE platforms. Proofpoint and Mimecast sell DLP beside email security, and CrowdStrike sells Falcon Data Protection on the Falcon agent. Six of the nineteen products on this page are modules of platforms you may already pay for — check the entitlement before buying anything standalone.

### How much does DLP cost in India?

Safetica publishes about $72–144 per user per year across its tiers; Forcepoint DLP has no published list price and is quote-only. Seclore, Data Resolve and Seqrite are India-built and quote per user or per endpoint in INR, on-premises or cloud. Varonis and Trellix are quote-only too. The licence is rarely the largest number: classification and policy tuning commonly exceed it in year one.

### Do DLP products classify Indian data types like PAN and Aadhaar?

No vendor on this page documents PAN, Aadhaar or GSTIN classification support. We mark that as unknown per product rather than assuming it either way, and we never use it to eliminate a product. It should be proven in a proof of concept against your own records — a classifier tuned for US social security numbers finds nothing useful in an Indian estate, and this is the single most common reason a deployment produces an empty console.

### Can DLP stop data being pasted into ChatGPT?

Only if AI prompt is a documented channel, and most products do not cover it. Cyera Omni DLP and Seclore AI-DLP document it on this page. Inline platforms like Zscaler and Netskope can see traffic to AI services where it passes the platform, but coverage of the prompt content itself varies — ask specifically rather than accepting 'we cover web traffic' as an answer.

---

*Vendor-neutral. Nothing gated. Figures marked [TechBag to confirm] are team-owned and deliberately not guessed.*
*TechBag — India-based software reseller and advisory. https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk*