Every other control protects a place. This one protects the data after it has left all of them.

Sixteen terms, one line each. The depth lives in each route’s guide.

These are adjacent controls at different points in the data’s life, not tiers. A product that classifies perfectly may block nothing. A product that blocks at the endpoint may never see the cloud copy. Each route’s guide resolves only the four terms its buyer actually confuses.

• DLP (Data Loss Prevention) — inspects content in motion or at an exit point and enforces a policy on it
• Insider risk — behavioural: scores what a person is doing over time, not what one file contains
• UEBA (User and Entity Behaviour Analytics) — the analytics engine underneath — baselines normal, flags deviation, names no policy
• Endpoint DLP (Data Loss Prevention) — an agent on the device: USB, print, screenshot, clipboard, local file operations
• Network DLP (Data Loss Prevention) — inspects traffic in flight — blind to anything encrypted it cannot terminate
• Cloud DLP (Data Loss Prevention) — reads SaaS applications through APIs; sees sanctioned tenants, rarely unsanctioned ones
• DSPM (Data Security Posture Management) — finds data at rest across stores, classifies it and maps who can reach it
• Data discovery — the scan itself — what exists and where, before anything is judged about it
• Classification — deciding what a file is: regex and keyword, machine learning, or fingerprinting
• Cataloguing — an inventory for governance and analytics use, not a security control
• Access-path analysis — who can actually reach this data through every group, role and share — effective, not nominal
• DDR (Data Detection and Response) — data detection and response: alerting on access to data at rest, not on a configuration
• Encryption at rest — the disk or the store is encrypted; anyone with a valid session reads plaintext
• Encryption in transit — TLS between two points; protects the wire, not the file at either end
• EDRM / IRM (Enterprise Digital Rights Management / Information Rights Management) — the protection travels inside the file — policy enforced wherever the file goes
• Revocation — withdrawing access to a file already delivered — the whole point of rights management

What holds whichever route you take

What it costs, roughly

Three meters live in this category, and a fourth number under all of them: the project. Which meter you are quoted tells you which route you are in — order of magnitude here, the tier- and term-matched USD + INR number is each guide’s job.

• VaronisThe access-path specialist: DSPM, DDR, DLP, Data Access Governance, MDDR and Athena AI — the deepest answer to “who can actually reach this” across file shares, Microsoft 365 and cloud storesDLPDSPM
• ForcepointDLP (from about $52 per user / yr), Risk-Adaptive Protection, DSPM, DDR, Data Classification and CASB — the broadest single-vendor span of the three routes on this pageDLPDSPMEncryption
• TrellixDLP Endpoint, DLP Network, DLP Discover, Data Encryption, Database Security and AI Data Security — these TechBag pages are the data-security line, not the endpoint oneDLPEncryption
• SecloreIndia-built (Mumbai): ARMOR EDRM — protection that travels inside the file with post-distribution revocation — plus Data Classification, DSPM and AI-DLPEncryptionDSPMDLP
• CyeraAI-native DSPM, Data Access Governance, Omni DLP and AI Security — agentless cloud-first discovery and classificationDSPMDLP
• SecuritiData Command Center: discovery, DSPM, governance, privacy automation and Gencore AI — the privacy-operations depth here; acquired by Veeam (about $1.725B, closed December 2025) and continuing under its own brandDSPM
• SafeticaPublished per-user list (about $72–144 per user / yr): the Platform and an on-premises edition — DLP and insider risk sized for the mid-marketDLP
• Data ResolveIndia-built: inDefend DLP, user behaviour analytics, employee productivity and MobSec — INR pricing and on-premises as a first-class optionDLP
• SeqriteIndia-built (Quick Heal): DLP, Data Privacy for DPDP work and full-disk Encryption — quoted in INR, on-premises capableDLPDSPMEncryption
• ProofpointDLP & Insider Risk — people-centric, strongest where the exit is email and the signal is behaviouralDLP
• MimecastIncydr — insider risk built on file-movement telemetry rather than content rulesDLP
• ZscalerData Protection inline in the Zero Trust Exchange — a module of the SASE platform, not a standalone purchaseDLP
• NetskopeData Protection and SkopeAI — CASB and DLP in the platform's DNA; eight Indian data centres with a Mumbai management planeDLP
• CrowdStrikeFalcon Data Protection — data controls on the endpoint agent you already run, not a full DLP suiteDLP
• CoroCloud & Data Governance inside the Coro modular platform — SMB-shaped, bought as a moduleDLP
• WizDSPM on the Wiz security graph — cloud-native, and strongest when the estate is already WizDSPM
• RubrikDSPM over data the backup platform already holds — discovery without a second scan of productionDSPM
• MicrosoftPurview is the dominant “already own” answer, not a carded product here: E3 carries manual and basic labelling, E5 adds automatic classification, endpoint DLP and insider risk management; standalone SKUs sit betweenDLPDSPM

Five vendors span all three routes; every product on the guides is mapped by SKU, not by vendor. SailPoint, Saviynt, Ping Identity, Delinea and JumpCloud are named in the guides where relevant but have no TechBag intel pages yet, so they are not ranked. Microsoft appears in the index and in every “already own” section, but its identity SKUs are not carded on the guides.