Code42 Incydr in 2027: What Mimecast’s Insider Risk Tool Does With AI Data

Incydr, the insider risk product Code42 built and Mimecast now owns, is one of the most recognizable names in data exfiltration detection. Security teams like it for a simple reason: you install it, and within days you can see files leaving the company without writing a single DLP policy. In 2026 Mimecast pushed Incydr hard into AI, adding paste content capture, destination blocking, and an Agent Risk Center for AI tools and MCP connections. The question for 2027 is not whether Incydr sees AI activity. It is how it decides what to stop. If you are comparing the whole category, our guide to the best data loss prevention tools ranks the field. This post goes deep on Incydr.

The short answer

Incydr is a detection-first insider risk tool. It records file movement, uploads, and pastes across endpoints, browsers, and cloud apps, scores them for risk, and helps you investigate and respond. Since January 2026 it can capture what was pasted to untrusted destinations so investigators can review it. Its preventative controls block by destination, source, browser, or app against your trusted activity list, not by the meaning of the content.

dope.security takes a different approach. Dopamine DLP extracts the text of AI prompts and file uploads on the device before they leave, classifies them by meaning with an LLM, and can block the sensitive ones in real time, even when the destination is an approved enterprise AI tool.

That is a testable claim. Paste a customer list into your approved corporate ChatGPT workspace on a managed laptop, then check what each tool did: record it, or stop it.

What is Incydr?

Incydr started at Code42, the Minneapolis company best known for years as the maker of CrashPlan backup. Code42 moved toward insider risk management, and Incydr grew out of that shift. Mimecast, privately owned by Permira since 2022, announced its acquisition of Code42 in July 2024. Mimecast now positions Incydr inside its human risk management platform, and in 2026 started describing it as runtime data security for both people and AI agents.

What changed in Incydr in 2026

• January: Paste content detection (paste events include the pasted text for untrusted destinations) and a Block sources preventative control.
• March: Block destinations, so admins can stop uploads to specific sites such as unsanctioned AI tools. Firefox extension reached general availability.
• March (RSAC): Mimecast previewed the Agent Risk Center and its runtime data security push.
• July to September: Agent Risk Center went from limited beta to early access on all Incydr plans, adding MCP configuration visibility.
• September: Safari extension on macOS entered early access.
• October: The AI-based Investigation Agent, which predicts whether an alert is a true positive, false positive, or benign, became generally available, with AI credits sold separately.

How Incydr works

Incydr collects events from several places and scores them with a risk engine Mimecast calls PRISM, which Mimecast says weighs more than 250 risk indicators.

• Endpoint agent. The insider risk agent runs on Windows, Mac, and Linux and watches file activity, removable media, and command-line transfers like SFTP and cURL.
• Browser extension. Adds web context for uploads and pastes in Chrome, Edge, Firefox, Prisma Access Browser, and Island, with Safari in early access. Web blocking requires it.
• Cloud connectors. Microsoft 365 OneDrive and SharePoint, Google Drive, Box, and email, among others.
• Agent Risk Center. Builds an inventory of AI apps, AI browser destinations, and MCP configurations, ties each to a person, and lets admins approve, monitor, or block each AI tool.
• Response. Watchlists for departing employees and contractors, Incydr Flows for automation with HR and identity tools, and Instructor training lessons sent after risky activity.

If you are weighing where DLP should enforce in the first place, our breakdown of endpoint DLP vs network DLP covers the trade-offs.

What Incydr does well

• Visibility without policy writing. You see exfiltration patterns before you tune anything.
• Insider risk context. Watchlists for departing employees, new hires, and contractors focus attention where it belongs. Our post on insider risk management for data in motion covers why that context matters.
• Investigation depth. Forensic search, paste content capture, in-console file previews, and now an AI Investigation Agent shorten triage.
• A response loop, not just alerts. Flows and Instructor turn a detection into a ticket, a manager notification, or a training nudge.
• The human behind the agent. Agent Risk Center ties AI tools and MCP connections back to the person who set them up, which fits how insider risk teams already think.

If your program is about departing employees, file movement, and investigations, Incydr is a credible choice.

Where Incydr gets complicated for AI heading into 2027

Blocking decisions follow destinations, not meaning

Mimecast’s preventative controls documentation lists what Incydr can block: uploads and pastes to untrusted destinations, uploads to specific destinations, files from specific sources, specific browsers and apps, private browsing, USB mounting, and external cloud sharing. Every one of those decisions keys on where data is going or coming from. None of them evaluates what the pasted text or uploaded file actually says before deciding.

Approved AI tools are a blind spot for prevention

Mimecast documents that pasting to destinations on your trusted activity list is always allowed. Once your enterprise ChatGPT, Claude, or Copilot is trusted, which it has to be for people to use it, a pasted block of source code or patient data goes through. Incydr can log it for investigation. It does not stop it.

Paste coverage stops at the browser

Mimecast also documents that paste activity is monitored only in web browsers, because the endpoint is treated as trusted. Pastes into desktop AI clients are not monitored or restricted by the paste controls. Desktop apps, IDEs, and CLIs are where browser-bound controls run out, as we explain in detecting shadow AI in desktop apps, IDEs, and CLIs.

Platform and alerting details to plan for

• Web upload and paste blocking requires the browser extension, which only deploys to managed browsers.
• Destination and source blocking work on Windows and macOS.
• Blocked events do not generate alerts by default; you enable that per rule.
• Agent Risk Center is in early access, so confirm which AI controls are production-ready for your plan.

Incydr vs dope.security: the head-to-head

Both products want to stop sensitive data from walking out the door. They answer different questions.

• What drives a block. Incydr blocks by destination, source, browser, or app against a trust list. Dopamine DLP blocks on the meaning of the content, classified by an LLM with zero data retention.
• Approved AI tools. Incydr always allows pastes to trusted destinations. Dopamine DLP still inspects prompts and uploads to approved enterprise AI accounts, so sensitive content can be stopped even when the account is legitimate.
• When content is analyzed. Incydr captures paste content for investigation after it reaches an untrusted destination. Dopamine DLP extracts text on the device and classifies it before submission.
• Corporate vs personal AI accounts. dope.security Cloud Application Control allows the approved enterprise tenant and blocks personal ChatGPT, Claude, Google, and Microsoft 365 logins. For Claude, it covers both the web app and the desktop app.
• AI visibility. Incydr’s Agent Risk Center inventories AI tools and MCP connections per person. dope.security AI Analytics shows AI apps in use, users, transactions, and personal versus enterprise accounts, with blocking from the same screen, and the Dopamine agent answers plain-language questions about it.
• Policy effort. Incydr gives visibility with no policies required, then asks you to tune risk indicators and trust lists. Dopamine DLP needs no rule configuration and runs in Block, Monitor, or Off mode.
• Web security. Incydr is an insider risk product, not a secure web gateway. dope.security is a Fly-Direct secure web gateway first, with SSL inspection and URL filtering on the device, an agent under 100 MB of RAM, and one console for SWG, CASB Neural, and Dopamine DLP.
• Investigations. Incydr’s watchlists, Flows, forensic search, and Instructor are built for insider risk programs. That is its home turf.

Dopamine DLP is protected by US Patent 12,464,023. Read how it works in meet Dopamine DLP.

Replace Incydr, or run dope.security alongside it?

For many teams this is not either-or. Incydr is strong at insider risk investigations. Prevention at the moment a prompt leaves the laptop is where the gap sits.

• Keep the insider risk program. If your team relies on Incydr watchlists and Flows for departing employees, keep them.
• Put content-aware AI enforcement on the endpoint. Deploy dope.security on Mac and Windows, turn on Cloud Application Control for your AI tenants, and run Dopamine DLP in Monitor mode first to see what sensitive data is flowing into AI tools before you block.
• Test the personal account split. Our walkthroughs on blocking personal ChatGPT and blocking personal Claude accounts show the exact steps.
• Compare the incumbents. Our reviews of Forcepoint DLP, Proofpoint DLP, and Trellix DLP show how other tools handle the same AI problem.

Deployment is the part teams worry about, and it goes fastest. A Fortune 100 company scaled dope.security from 900 to more than 18,000 devices in weeks, deployed silently through Intune.

The bottom line on Incydr

Incydr is excellent at showing you that data moved, who moved it, and now what they pasted, so you can investigate and respond. Its prevention still keys on where data goes, and approved AI tools are trusted by design. If you want every AI prompt and upload read, classified, and stopped on the laptop when it is sensitive, with personal AI accounts blocked and corporate ones working, that is what dope.security was built to do. Explore Dopamine DLP and the Fly-Direct Secure Web Gateway, or book a 20-minute demo and we will run the pasted customer list test live.

Frequently asked questions

Who owns Code42 Incydr?

Mimecast owns Incydr. Mimecast announced its acquisition of Code42 in July 2024, and Mimecast itself has been privately owned by Permira since 2022. Mimecast positions Incydr within its human risk management and data protection platform.

Is Incydr a DLP tool?

Incydr is best described as an insider risk and data exfiltration detection and response product. It detects file movement across endpoints, browsers, cloud storage, and email, and adds preventative controls that block by destination, source, or app. That is different from classic content-aware DLP, which decides based on what the data contains.

Can Incydr see what employees paste into ChatGPT?

Yes, in the browser. Since January 2026, Incydr paste events include the pasted content for untrusted destinations, and admins can preview plain text pastes in the console. Paste activity in desktop apps is not monitored, and pastes to trusted destinations are always allowed.

What is Incydr Agent Risk Center?

Agent Risk Center is an Incydr feature, in early access since September 2026 on all plans, that inventories AI apps, AI browser destinations, and MCP configurations in your environment, ties them to the people using them, and lets admins approve, monitor, or block each AI tool.

Can I run dope.security alongside Incydr?

Yes. Many teams keep Incydr for insider risk investigations and add dope.security on the endpoint for web security and AI governance: Cloud Application Control for corporate AI tenants, Dopamine DLP for prompts and uploads, and CASB Neural for overshared files in OneDrive and Google Drive, all in one console.