Vendor Coverage Inventory for Unclassified Data Across Enterprise DLP Architectures

A vendor coverage inventory for unclassified data must measure where protection stops. Enterprise architectures were built around recognizable data at known enforcement points. Protecting intellectual property that lacks labels or predictable patterns requires a different test of coverage, one that follows content, identities, and behavior through the workflows where that information is used.

Why DLP architectures were designed around classified data, and what that assumption costs

Enterprise DLP rests on a specific design premise. Sensitive information has a recognizable shape, resides in known places, and travels through monitored boundaries. Pattern matching, classifiers, and sensitivity labels make that information identifiable so policies can control it. The architecture therefore begins with recognition, rather than with the full range of information that has value to the enterprise.

This design serves structured, regulated data well. Credit card numbers, Social Security numbers, passport numbers, and HIPAA-covered fields have predictable forms that rules can recognize. Source code, product roadmaps, customer strategies, proprietary models, and competitive research do not share that regularity. Their sensitivity comes from their business meaning, and much of that information never enters a labeling workflow. A vendor coverage inventory is therefore an inventory of where the founding assumption holds and where it breaks.

How unclassified data moves through the enterprise today, and why enforcement points no longer align with those paths

The browser has become a primary enterprise workspace. Employees use SaaS applications, cloud collaboration platforms, and GenAI tools as they move through browser sessions. LayerX's enterprise AI and SaaS data security report draws on browser telemetry from large enterprises and finds that AI tools now rival traditional SaaS categories such as file-sharing and business apps. Sensitive information moves through these workspaces in day-to-day work and may pass outside the boundaries that older controls were built around.

Copy/paste changes the unit of movement from a file to its contents. Employees can place information directly into prompts, chats, and SaaS tools without creating a file-transfer event. The LayerX report finds that copy/paste is the dominant movement channel into GenAI tools and that the vast majority of pasted data comes from unmanaged accounts. Even enterprise-heavy applications are accessed through personal or non-federated accounts outside corporate identity governance.

AI agents introduce a further departure from file-based workflows. They get context from internal knowledge bases, query embedding stores, and send information to external tools. Internally built AI tooling also operates in Linux environments, where endpoint DLP coverage is commonly incomplete. Taken together, these paths cross the boundaries between applications, devices, and identities without following one managed route. This movement map is what a coverage inventory must measure against, although most inventories were not designed around these paths.

Where each major DLP coverage layer stops when unclassified data is the subject

Network and proxy-based inline DLP inspects decrypted traffic passing through its inspection point. Zscaler DLP illustrates the operational benefit of one policy engine across web and SaaS traffic reaching the Zero Trust Exchange. Its boundary is the traffic it receives and can read. Zscaler's SSL/TLS Inspection Leading Practices Guide identifies certificate-pinned applications, including many Microsoft 365 apps, Cisco WebEx, and the Dropbox app, as traffic it cannot inspect. Split-tunneled destinations and activity that never crosses the network also sit outside that inspection path.

For unclassified IP, those exclusions can encompass collaboration and file-sharing activity. The bypass list defines actual inspection coverage more precisely than the presence of an inline deployment. AI coverage also requires a separate licensing check. Prompt-level DLP is a separate licensed capability rather than part of baseline inline DLP, so a deployment record alone does not establish that AI prompts are inspected.

Endpoint DLP moves inspection closer to device activity. CrowdStrike Falcon Data Protection monitors activity including USB transfers, cloud sync uploads, screen captures, and clipboard use, with behavioral analytics that reduce false positives relative to purely rule-based approaches. Its boundary is agent presence on the device. Contractors' machines, customer devices, partner endpoints, and personal laptops fall outside that protection when the agent is absent. Unclassified IP shared with people beyond the managed device estate therefore reaches an important limit of this layer.

Platform-native controls provide protection within the workloads they support. Their scope, however, does not establish enforcement across an entire hybrid or multi-cloud estate. A policy operating within one platform cannot be assumed to protect transfers into another platform or an unmanaged destination. Label-triggered protection creates a second dependency within the supported environment. Even where enforcement is available, that protection does not activate for IP that has never received the relevant label.

Cloud and SaaS API scanning checks data that is already in sanctioned tenants. It is useful for discovering sensitive content at rest and identifying exposure in cloud storage. Its timing is the defining constraint here. Out-of-band inspection occurs after movement, so discovery does not establish that the transfer could have been prevented. Unclassified content must still be recognized, and discovering it in the wrong location does not close the path that placed it there.

Browser-based and GenAI DLP addresses a different inspection point. It can check browser sessions, copy/paste flows, file-less transfers, and prompt content before it is submitted. Whether enforcement applies to a flow still depends on the account context, especially when employees use personal accounts in the same browser session. Browser coverage therefore needs to be checked for its own limits, since it cannot be assumed to see every flow. Even deployment of every major layer leaves systematic white space between their scopes.

Why the white space between coverage layers is where unclassified IP concentrates

Those gaps cluster around the workflows in which valuable information is created and exchanged. Collaboration tools hold ideas as they take shape, contractor and partner devices let people work together, and personal accounts offer paths outside corporate identity governance. A proxy exclusion, an absent endpoint agent, and an unsupported destination are adjacent blind spots. Adding their deployment footprints together overstates protection when none inspects the transfer between them.

The label dependency reinforces this concentration of risk. Information that is created informally, kept in collaboration tools, or produced before a labeling program starts may never get a classification. Label-triggered controls then miss the same information that crosses weakly governed workflow boundaries. AI agents compound both conditions when they assemble unlabeled internal context and send it externally without a file event.

The LayerX report finds that nearly half of file uploads to AI and file-sharing tools contain PII or PCI data, with a substantial share passing through non-corporate accounts. This demonstrates the importance of account-level paths within nominally familiar applications. Without a current data-flow map, a team cannot reliably prove that a high-risk workflow is protected. An inventory that ignores this topology can look complete while omitting the territory with the greatest business value.

Real exfiltration patterns that exploited these coverage gaps — and what they have in common

Apple in 2022 accused Rivos of poaching a significant number of employees, some of whom allegedly exfiltrated gigabytes of proprietary SoC design data, illustrating why IP protection needs the context surrounding employee activity alongside a recognizable content pattern.

In 2025, UNC6395 exploited the Salesloft/Drift integration with Salesforce to siphon corporate CRM data, including AWS keys, Snowflake tokens, and business records, from multiple organizations through a trusted SaaS connector outside inline DLP inspection.

Along with the transfer itself, the context that matters includes activity across a user timeline, unusual recipients, and changes in volume before departure. Content sensitivity does not by itself establish whether the surrounding behavior is expected. Nor does approval of an integration establish that every use of it is safe.

Time further limits reliance on delayed discovery. Unit 42's 2025 Incident Response Report found a median time to exfiltration of two days, with some cases seeing data stolen within the first hour. Scheduled or post-hoc inspection can therefore identify exposure after the opportunity to prevent movement has passed. The common inventory requirement is to establish whether controls understand behavior at the trusted boundary and can intervene while the transfer is still preventable.

What a vendor coverage inventory actually needs to measure to close the gaps it finds

For inline DLP, the inventory should examine SSL bypass destinations and whether they contain workflows handling sensitive information. For endpoint DLP, it should measure the percentage of endpoints touching that information that are managed and have the agent installed. Having licenses does not answer either of those questions. The unit of assessment must be the actual data path, including its exclusions.

Classification coverage needs an equally direct test. The inventory should check whether labels reach information with real business value or mostly the structured, regulated data that built-in classifiers recognize. It should also test whether copy/paste and prompt submissions receive inspection, including through unmanaged accounts. For SaaS stores, it should distinguish discovery at rest from real-time prevention at the point of movement. A GenAI policy or an API connection does not demonstrate either capability by itself.

Agentic workflows require assessment as privileged data paths. The inventory should include ingestion controls, prompt and output protection, and reviewable decisions for agents that retrieve internal context and pass it externally. It should also establish whether the platform distinguishes human from non-human identity behavior. Extending a human-user coverage entry to agents without examining these paths leaves their movement model untested.

Pattern-based detection remains reliable for structured data and should be retained, while the additional test is whether controls connect actions to file origin, recipients, user-specific volume, and departure patterns. A static content match cannot supply those relationships on its own. The inventory should establish whether that context exists in the platform rather than infer it from the number of enabled rules.

The final test is whether the security team can produce a current data-flow map for every high-risk workflow. Monitoring should follow changes involving new vendors, AI tools, and integrations in real time. Visibility is a prerequisite for reliable enforcement here. An inventory that answers these questions separates incomplete deployment from a deeper architectural need for a different kind of protection.

What an architecture capable of protecting unclassified data actually requires

To protect unclassified IP, the architecture must understand content without relying on labels. The architecture must assess information in relation to business value, strategic assets, its destination, and the account receiving it. Semantic understanding belongs at this decision point because a predictable format cannot establish whether a roadmap or proprietary model should leave the enterprise. Pattern matching retains its role for structured information. It is not a substitute for understanding less regular content.

Behavioral context must also be a first-class detection signal. Each action needs to be linked to departure indicators, volume anomalies, unusual recipients, and the access patterns around it. This context changes the interpretation of an otherwise ordinary transfer.

Browser controls belong where copy/paste, prompt submissions, and file-less transfers occur, while protection decisions need to account for destination, account ownership, and context rather than depend solely on managed devices or corporate logins. Real-time intervention must complement discovery after arrival. AI-native protection also requires treating agent workflows as privileged integrations, with ingestion controls, output inspection, and auditable decision trails.

Investigation efficiency is part of the architectural requirement. Alerts should arrive with the user timeline, data context, behavioral pattern, and surrounding activity already assembled. Without that context, analysts may be unable to act quickly even when detection is accurate. A proof of concept on real data should go beyond counting rules or alerts to test false positives and whether analysts can act on the resulting queue. The inventory earns its value when its findings become enforceable decisions on the paths where unclassified IP actually moves.