Data Security
DLP tools that name the secret before it leaves (2026)
A 2026 shortlist of classifiers and gates. Public docs, not an exfil cookbook.
Expertise: Data Security · Level: Intermediate · 12 min read
A DSPM map is not a block.
DSPM finds the store. DLP tries to stop the paste. Overlap declared. This page is classifiers and gates on channels you already own. I will not write an exfil recipe.
Six classifiers. One open NER. Two cloud buttons. One SaaS desk. Two enterprise agents. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Microsoft Presidio | Open NER you can run on text you already hold | MIT |
| Google Sensitive Data Protection | Inspection jobs on GCP stores you already pay for | Google Cloud terms |
| Microsoft Purview DLP | DLP on the Microsoft estate you already bought | Microsoft terms |
| Nightfall | SaaS DLP on SaaS and code you already use | Commercial |
| Forcepoint DLP | Known enterprise channel DLP | Commercial |
| Symantec DLP | Broadcom enterprise DLP you may already own | Commercial |
Microsoft Presidio
Best for open NER you can run on text you already hold
Presidio detects and can anonymize PII in text you pass it. You host the pipeline. It is not a network tap.
Key features
- PII recognizers
- Anonymizers
- MIT
- You bring the text
Why we like it
This is the hidden gem. A function in your app beats a five-year DLP RFP while you wait.
Limits
You tune recognizers. Not email gateway magic. English-heavy defaults.
Google Sensitive Data Protection
Best for inspection jobs on GCP stores you already pay for
Formerly Cloud DLP. InfoTypes on storage and streams in a project you own. Price is metered.
Key features
- InfoTypes they document
- Storage and stream jobs
- Same GCP project
- De-identify transforms
Why we like it
If the data already lives in GCP, start with the button.
Limits
GCP gravity. Cost. A job is not a laptop agent.
Microsoft Purview DLP
Best for dLP on the Microsoft estate you already bought
Purview DLP covers Exchange, SharePoint, devices they license. Overlap with DSPM-ish Purview catalog is declared.
Key features
- M365 locations
- Endpoint DLP SKUs
- Policy alerts
- Same tenant
Why we like it
Honesty. A lot of pastes happen in Outlook. Do not buy a second agent first.
Limits
SKU maze. Non-Microsoft channels need another row.
Nightfall
Best for saaS DLP on SaaS and code you already use
Nightfall scans Slack, GitHub, and other SaaS they list. Developer-shaped findings.
Key features
- SaaS connectors
- Code scanning they sell
- Tickets
- Commercial
Why we like it
When the leak is a Slack paste, an estate DLP agent never saw it.
Limits
Commercial. Connector list is the product. We did not run a tenant.
Forcepoint DLP
Best for known enterprise channel DLP
Forcepoint sells network, endpoint, and cloud DLP. Long enterprise memory.
Key features
- Channel coverage they sell
- Enterprise policy
- Agents
- Commercial
Why we like it
Known shelf so the open classifier has a procurement neighbor.
Limits
Commercial. Agent tax. Public pages are not a lab.
Symantec DLP
Best for broadcom enterprise DLP you may already own
Symantec DLP under Broadcom is the other known enterprise agent. If it is already on the laptop, start by tuning it.
Key features
- Endpoint and network they sell
- Policy engine
- Enterprise desk
- Commercial
Why we like it
Do not stack a third agent on a fleet that already has one.
Limits
Commercial. Legacy console stories. We did not run it.
What the internet thinks about DLP tools
DLP threads treat false friends as the reason the gate gets turned off. We keep that line. A silent block nobody can appeal is a shadow IT factory.
Prove Presidio still publishes
Confirm Presidio still publishes. Run it on a fixture string you own. Do not scan a stranger’s mailbox.
git ls-remote --heads https://github.com/microsoft/presidio.gitFAQs
Does DLP replace DSPM?
No. DSPM maps stores. DLP tries to stop a leave. Link both.
Is Presidio enough?
For in-app text, often. For email and endpoints, you still need a channel product.
Will you publish an exfil test?
No.
Is this a scored bake-off?
No.
