Meet Dopamine DLP, Endpoint Data Loss Prevention Powered by AI
WORKING as a PM on 2½ DLP products drilled into my head how horrifying and painful they have always been. The only companies that could really operationalize them were JPMC, USAA, etc, with scores of incident response analysts. Even if you had a medium-sized team, DLP was a checkbox full of operational false positive noise underneath the hood.
The issue has always been simple: all teams use official corp applications like Google Workspace or Microsoft 365, but the overall Internet has a ton of file storage, collaboration, etc. sites that are unofficial/unsanctioned. Think WeTransfer, Dropbox, ChatGPT, or even a personal Gmail & Hotmail... Once you upload corporate data there, it’s gone forever, and you would never know.
Now, you could block these web categories or enable cloud app controls, but that still doesn’t solve the compliance requirement, or such high restrictions are probably just unacceptable from a business perspective. In other words, data exfiltration, intentional or unintentional, is just too easy to do on work laptops!
We can keep the bad stuff out, but how do we keep the good stuff in?
That’s exactly why we integrated OpenAI into our on-device Secure Web Gateway to give you Endpoint Data Loss Prevention that can comprehend and classify all data uploaded from a dope-installed device using large language models.
So, we’re introducing Dopamine DLP: Real-time, generative AI classifications instrumented through the dope proxy (SWG) to block data exfiltration with incredible precision.
In other words, it’s a night-and-day difference from the 1990s regex/pattern match protection.
So, explain to me why again?
Honestly, we found that most companies could not implement practical DLP. Old-school “legacy” tech trained everyone to accept two bad choices:
- Pattern-match DLP: Boisterously noisy to the tune of thousands of false positives a day, because you’re looking for a marker such as a 16-digit number and assuming it’s a credit card. Very ineffective & imprecise
- Stopover Proxies: Very slow, especially with backhauling Internet in this day and age, and due to the scale of the proxy servers required, difficult to add support for modern tech like HTTP2 or IPv6 or AI DLP
Therefore, it’s no surprise that the stopover proxy (SSE/SASE/SWG) market continues to use these noisy pattern matches and has never tried to fix the problem: regex-based DLP **does not work** because it produces a haystack of false positives, while the customer is left to somehow find the needle.
The dope approach keeps traffic flying direct (completely on-device proxy), and uses generative AI (LLMs) to classify sensitive content and block the upload.
“But, kunala, you hate the word AI in cyber, why are you using it?”
Yeah, but if you’re using LLMs to actually fix a problem, sounds fantabulous to me.
How does it work?
On the endpoint, Dopamine DLP watches for file uploads or AI prompts, because that’s where leaks happen. It then extracts the text from the document/pdf/prompt etc. and shoots it off to our cloud (zero data retention, HIPAA/BAA LLMs) for processing and returns a response rule within a second or two.
It has three modes:
So, exactly what happens when a file upload happens?
- Detect: The endpoint proxy sees an upload to the Internet (auto-excludes sanctioned SaaS)
- Extract: It pulls the text content from files being uploaded
- Classify: The endpoint sends the extracted text to the dope.cloud Dopamine DLP API, which returns ‘Sensitive’ or ‘Not Sensitive’
- Enforce: Based on your DLP policy, Off / Monitor / Block, the upload proceeds and is logged, and/or stopped
- Record: Each action creates a DLP violation with the Dopamine DLP explanation that you can investigate
Under the hood, Dopamine DLP uses OpenAI’s zero data retention APIs, which give us full access to the best of the best large language models (cuts false positives and surfaces what matters with extreme precision), while being AI data compliant—we do not train on your data & we never retain any of it, ever.
Remember, there is no manual rule configuration or regex pattern matching required! Just one click and you’re done.
Organically built the dope way
DLP controls live inside your existing console, no new dashboard or UI. It’s configurable for your own unique situation:
- Per-Policy Based DLP: Block/Monitor/Off modes for DLP
- Exceptions: Override specific users + groups for certain roles
- Bypass List: Add domains/URLs that should skip DLP. We maintain dope-managed bypasses too for technically incompatible destinations (a big source of noise in the past)
As with all dope features, it can be quickly scaled across tens of thousands of users without creating a huge bottleneck for IT/Security.
Okay, what about IT Sanctioned Apps? e.g. Onedrive?
There are two generally accepted forms of DLP:
- Data In Motion: our AI Endpoint DLP covers this—blocking an upload ‘in motion’ to a website
- Data at Rest: our CASB Neural covers this—scanning a SaaS app for sensitive data exposures, such as finding a completely public link to an internal PHI or PCI doc
To ensure you’re not checking files for no reason, we automatically exempt Cloud App Controlled tenants from DLP Inspection because they’re already known to be owned by you. You can always add specific web domains, too.
For everything else, you’ve got CASB Neural which is, of course, all in the same console.
(Finally) Actually Useful DLP Violations
Every time Dopamine DLP monitors or blocks, you’ll see a helpful record in the Console:
Just a highlight that our Dopamine AI summary is very unique to dope.security—I’ve never seen any other DLP solution do this today.
Yes, you can forward to a SIEM and spot classification trends too.
We’ve now reached our cruising altitude, welcome to the beautiful, fly direct dope.security skies
At dope, we’re all familiar with DLP. Some of us were PMs, some engineers, others QA... Our experience sharpened the thinking that every problem needs to be very, very well defined, to get a very decisive, pragmatic, precise solution:
- Dopamine is built into the console, one-click activation.
- Zero policy tuning required (because of AI)
- Dope’s Fly Direct architecture has fewer moving parts, so less things break!
A reminder: everyone needs DLP!!! But, only DOPE can turn:
“We really should look into DLP one day”
=>
“We use DOPAMINE for DLP”
Book a demo and instantly see the AI difference for yourself(merci for the love OpenAI GPT).
And, as always, be bold, be passionate, be dope! – kunala
