Search for AI DLP and you get nine vendor pages and one Microsoft doc. Every vendor page reaches the same conclusion: buy inspection. That is not wrong, but it is third in the order of operations, and the two steps ahead of it are cheaper and faster. What works, in sequence: control which accounts your people can use, write a data rule concrete enough to apply under pressure, then inspect — audit mode first, redaction over blocking. Then train for the material no classifier reaches, which is most of what you are protecting.
The paste that generates no event
Traditional data-loss prevention hooks onto three things: a file moving, an email sending, a network upload starting. An employee pasting a client contract into a chat box does none of them. No file, no attachment, and an encrypted session to a legitimate domain that looks like the rest of their browsing. The control you already pay for was built for a perimeter this activity does not cross.
That is the technical case for a separate category, and it holds. Netskope’s Cloud and Threat Report 2026, on telemetry from October 2024 to October 2025, puts the average organization at 223 generative-AI-linked data policy violations per month and roughly 2,100 in the top quartile, with uploads of regulated personal, financial, or health data the largest category at 54%. Cyberhaven Labs’ 2026 AI Adoption and Risk Report, built on data movements at 222 companies, found 39.7% of AI interactions involve sensitive data and that the average employee enters sensitive data into an AI tool about once every three days.
None of that is an attack. It is staff doing their jobs with the tools you bought them — a different exposure from the one your phishing-simulation vendor sells against, as our comparison of AI risk training and security-awareness training sets out, and it needs different controls.
What your Microsoft license actually covers
If you run Microsoft 365 you may believe this is handled. Read the documentation first.
Purview’s DLP controls for the Microsoft 365 Copilot location are real and specific. Microsoft’s own page, updated 5 October 2026, describes four: block sensitive information types in external web search, block them in prompts (in preview), stop Copilot processing labeled files and emails, and exclude external email from grounding (also in preview). Two sentences there, and one on the endpoint settings page, reshape the picture.
Prompt inspection reads typed text only. Microsoft states it plainly: DLP cannot scan the contents of files uploaded directly into prompts, so no evaluation of that file for sensitive data occurs, and DLP checks only the text typed into the prompt itself. The most common way a person moves a confidential document into an assistant — dragging it in — sits outside the control.
The service-domain list governs uploads, not pastes. The endpoint settings page says that setting applies only to files uploaded using Microsoft Edge, or Chrome and Firefox with the Purview extension installed, and separately that it covers file uploads, with actions like pasting into a browser not following the Service Domain list. Paste inspection is a different control with its own configuration, limited to the same three browsers, and the restricted-upload action is Windows-only.
Said back as a buyer: a correctly configured deployment covers typed prompts in Microsoft’s own assistant, plus pastes and uploads in three browsers on Windows endpoints you onboarded. It does not cover a file dropped into a Copilot prompt, a paste in Safari, a desktop app, a phone, or a personal account. A useful subset, and not what “we have AI DLP” sounds like in a board meeting. Every inspection vendor has equivalent boundaries; Microsoft is the one that publishes them.
Where enforcement can sit
There are five places to put a control, each missing something different.
| Enforcement point | What it sees | What it misses |
|---|---|---|
| Browser extension or managed browser | Pasted text before encryption; can redact inline | Only that browser; the extension can be removed |
| Endpoint agent | Desktop apps, clipboard, file uploads | OS gaps, personal devices, phones; deployment effort |
| Network proxy, CASB or gateway | Broad, agentless; best for discovering shadow usage | Needs TLS inspection; blind off-network |
| API gateway or model proxy | Deterministic control over your own applications | Nothing done in a third-party tool |
| Native platform controls | Deep context, label-aware, already licensed | Bound to that vendor’s surfaces and license tier |
No single point covers a 50–500-person company, and a company that size should not buy all five. Pick the one matching where the work happens — a managed browser for a browser-first team, an endpoint agent where desktop apps and IDEs matter — and close the rest with account control.
Step one is not a product
Before any inspection, decide which accounts your people may use and make that the only option: one administered tenant per approved assistant, personal logins blocked at the identity layer, accounts provisioned on day one so the sanctioned path is the easy one.
This is the highest-yield control available, it is mostly configuration work, and it is the one most companies have skipped. Cyberhaven’s 2026 personal-account shares are the evidence — 32.3% of ChatGPT use, 24.9% of Gemini, 58.2% of Claude, 60.9% of Perplexity. Netskope puts 47% of generative AI users on personal, unmanaged accounts. Inspection deployed before account control inspects the half of the traffic you were least worried about. It also changes what you own: a consumer login gives you no data-handling terms, no retention control, no audit log, and no way to answer an auditor’s question about what left. An administered account gives you all four.
Step two is the rule — not a policy document, but a rule short enough to recall with a document open and a deadline running. Closer to “client-identifying material and anything under NDA goes only into the approved account; if you are unsure, ask in this channel and expect an answer within the hour” than to a nine-page acceptable-use appendix. The gap between a written AI use policy and the behavior it assumes is the central failure here, and closing it is the subject of our safe AI use playbook. A fast approval path is part of the rule: one with no route to “yes” is a rule people route around.
Audit for sixty days before you block anything
Run inspection in monitor mode for 30 to 60 days before enforcing. Two reasons, and the second gets skipped.
The first is tuning. You do not know which categories move until you watch. Start with the teams holding the most exposure — engineering, finance, legal, support — and let the data say whether your problem is credentials, customer records, or client documents.
The second is that a hard block relocates the work rather than stopping it. Blocked at the desk, a person finishes the task on a phone, where you have no logging, no terms, and no evidence. IBM’s Cost of a Data Breach 2026 found unapproved AI tools featured in 43% of security incidents, more than double the prior year.
So prefer the graded ladder. Audit to baseline. Warn with an override and a one-line justification, which preserves the task and produces the best coaching data you will get. Redact or pseudonymize, so the prompt still works with a token in place of the account number. Reserve hard blocking for the narrow set where the answer is genuinely never: credentials, payment-card data, and whatever your regulator names.
That report belongs in the budget conversation for another reason. The global average breach cost reached a record $4.99 million, roughly one in five breached organizations had an incident involving their own AI model or application, and 92% of that group lacked role-based access and multifactor authentication on those systems. Close to seven in ten had no governance policy for managing AI or spotting unapproved use. The expensive failures are governance failures, not detection failures — which is why AI governance training for leaders and board directors belongs in the same AI enablement budget as the tooling.
The residual no classifier catches
Detection is excellent at patterned data. A card number validates against a checksum. A Social Security number has a shape. An API key has measurable entropy. A customer record can be exact-matched against your database. For those categories inspection is close to deterministic, and you should turn it on.
Now list what actually keeps you up. A client’s unsigned contract pasted in for a plain-language summary. Next quarter’s unreleased numbers. An acquisition model. A support transcript thick with free-text detail no field name marks as regulated. None of these match a pattern or carry a label unless someone applied one, and each is ordinary material of the working day, which is why it moves so easily.
This is the residual, and where the loss you would actually report sits. A trained classifier guesses at it and is wrong in both directions — noisy enough to be ignored, permissive enough to miss the one that matters. Whether a particular document belongs in a particular window is a judgment call, made by a person, in seconds, with a deadline running.
Which makes it an AI enablement problem, and a narrow one. People do not need a lecture on data classification. They need to have made the call before, on their own documents, with someone in the room who can say “that one, no — and here is the version of it that is fine.” What that curriculum has to contain is in our guide to AI security and risk-awareness training for employees.
Coverage by the surfaces your team actually uses
Build this for your own organization before signing anything. It ends the “are we covered” conversation.
| Surface | Typical coverage | The honest answer |
|---|---|---|
| Managed browser, managed device | Paste, upload, prompt inspection | Covered, if the extension is deployed and the browser is supported |
| Unmanaged browser, managed device | Partial | A second browser without the extension is a gap |
| Desktop assistant app | Endpoint agent only | Browser controls do not reach it |
| Phone, personal or corporate | Rarely covered | Assume no inspection; use account control |
| Coding assistant in an IDE | Endpoint agent, sometimes | Credentials and source code move here; check explicitly |
| Assistant embedded in a SaaS tool you pay for | Vendor’s own controls | Often nobody’s job; audit the list quarterly |
| Personal account, any device | None | Make it unavailable and unnecessary |
Two rows settle most procurement arguments: phones and personal accounts are not an inspection problem but a judgment and account-control one.
What this costs
Native platform controls arrive with a license tier you may already hold or are being asked to upgrade into, so the honest number is the delta on your renewal, not a line item. Dedicated inspection products — browser-layer, endpoint, or gateway — sell per seat per month and almost never publish a rate; expect a quote that scales with seat count rather than with risk. Budget implementation either way: policy authoring, device onboarding, and a tuning period are weeks of someone’s attention.
On the training side, self-paced courses run roughly $29–99 per learner and facilitated workshops sit in a $2,000–15,000 market range per engagement, with the math broken down in our guide to what AI security awareness training costs.
Account control costs configuration time and a written rule costs an afternoon. Both reduce more exposure per dollar than anything with a sales cycle.
Where to start
This week: inventory the AI tools and accounts actually in use, from an expense-report search plus a direct, amnesty-framed question to each team lead. Expect more than you provisioned.
Next: stand up administered accounts for the assistants you intend to sanction, block personal logins at the identity layer, and publish the one-paragraph rule with a named channel and an hour’s response commitment. Then, and only then, scope inspection against the coverage table above, run it in audit mode for a month, and tune before enforcing.
The pattern underneath this is the one we keep returning to in the case that buying licenses is not the same as building capability: tooling sets the boundary, people make the call inside it, and only one of the two gets budgeted by default.
For a second opinion on your coverage table before spending anything, book a free AI-readiness call. We run hands-on LLM fluency sessions against a team’s own documents and daily work, and we will say plainly when a configuration change and a one-page rule would do more than a new agent on every laptop.
Frequently asked questions
What is AI DLP for chatbots?
Data-loss prevention built to inspect prompts, pasted text, file uploads, and sometimes model responses before they reach a generative AI tool. It is a separate category because a paste into a chat box creates no file, email, or conventional upload event, so file- and network-based DLP does not see it.
Does Microsoft Purview already cover this?
Partly, and the boundaries are documented. Purview can block sensitive information types in Copilot prompts and in external web search, and stop Copilot processing labeled files and emails. Microsoft also states that prompt inspection checks typed text only and cannot scan files uploaded into a prompt, and that the endpoint service-domain list governs uploads rather than pastes, in Edge or Chrome and Firefox with the Purview extension.
Should we block AI tools instead of inspecting them?
No. Blocking moves the activity to personal devices and accounts, where there is no logging, no data-handling agreement, and no way to know what left — unapproved tools featured in 43% of security incidents in IBM’s 2026 breach report. Sanction a small set of administered accounts and make them the easy path.
What should we do first if we have no security team?
Account control: one administered tenant per approved assistant, personal logins blocked at the identity layer. It is configuration work rather than a purchase, and the largest single reduction in exposure available. Most organizations have not done it — personal-account share runs from a quarter to around 60% by tool.
How long should inspection run in audit mode?
Thirty to sixty days, starting with the teams holding the most exposure. You cannot tune categories you have not observed, and enforcing on day one produces false positives and workarounds.
Will AI DLP satisfy a SOC 2 or HIPAA requirement?
It contributes but does not settle it. An auditor will ask which tools are sanctioned, who approved them, what the data rule is, how it is enforced, and how staff were trained, with records for each. A prompt containing protected health information sent to a vendor with no business associate agreement is a disclosure regardless of what your inspection tool logged.
What does detection reliably catch, and what does it miss?
It reliably catches patterned data: payment-card numbers, government identifiers, API keys, and records exact-matched against your own database. It misses unpatterned confidential material — an unsigned contract, unreleased financials, an acquisition model, a free-text support transcript — which is where most reportable loss sits.
How do we know whether any of it worked?
Measure three things before and 30 days after: the count of distinct AI tools and accounts in use, the share of assistant traffic on administered accounts, and whether team leads describe the same data rule when asked separately. Violation counts alone move with detection tuning as much as with behavior.
Key takeaways
- Order matters more than product choice: account control, then a short written rule with a fast approval path, then inspection.
- Microsoft documents two limits worth reading before a renewal. Prompt inspection covers typed text only, not files uploaded into a prompt, and the endpoint service-domain list governs uploads rather than pastes, in three supported browsers.
- No single enforcement point covers a 50–500-person company. Pick the one matching where the work happens; close the rest with account control, not more agents.
- Audit for 30 to 60 days, then prefer warn-with-override and redaction over hard blocking, which relocates the work to devices you cannot see.
- Detection handles patterned data well and unpatterned confidential material poorly. That residual is the expensive category, and judgment practiced on real documents covers it.
Dirk Jan van Veen, PhD
