AI Data Loss Prevention: A Buyer's Guide to What It Covers

This is one of five categories that all get described as monitoring AI usage. They answer different questions, and buying the wrong one is expensive in a specific way: the dashboard looks complete, so nobody goes looking for the gap.

This category answers a single question. Did confidential data leave the organisation through an AI tool?

Who asks it, and when

Security and compliance, usually after one of three things: a customer's security questionnaire asks how AI usage is controlled, a regulator or auditor raises it, or somebody in the company pastes something into a chat window that they should not have and it becomes a story.

The concern is data, not code. Whether the AI produced good output is not this category's problem, and neither is what the output became afterwards.

What the tools actually do

• Classify sensitive information — customer records, source code, credentials, regulated data — so a policy has something to act on.
• Discover which AI applications people reach, and from where.
• Apply policy at the moment of transmission: allow, block, redact, or warn the user before it leaves.
• Retain evidence of policy decisions for audit, retention and legal-hold purposes.

The main products here are Microsoft Purview, Netskope One AI Security and Zscaler AI Security. Their vantage points differ — Purview from inside the Microsoft 365 estate, the other two from the network — but the question is the same and so is the shape of the answer.

How to evaluate one

Four questions separate a real evaluation from a demo. Ask them in this order, because the first one decides whether the rest matter.

• Which specific applications does it see on the machines we actually use? Not 'AI apps' as a category — name Cursor, Claude Code and the Copilot extension, and ask for confirmation per platform. Desktop clients on pinned or non-browser paths are where coverage quietly ends.
• What does it do when it cannot inspect? Fail open and the control is advisory; fail closed and you have a support queue. Both are defensible; not knowing which one you bought is not.
• How much does it retain, and for how long? You are buying a system that reads prompts. Its retention is now part of your own answer to the questionnaire that started this.
• Are we already licensed for it? If you are a Microsoft shop, evaluate Purview before anything else. Buying a second product for a job you already own is the most common expensive mistake in this space.

What it will not cover

A DLP decision is made in milliseconds and then the traffic is gone. Nothing in that design keeps the conversation as an engineering artefact, and there are good reasons not to.

So four questions remain unanswered after a successful deployment, and each belongs to a different category: whether unapproved tools are in use at all beyond what the network sees, whether the AI feature you ship behaves correctly, whether that feature is attackable, and what the AI actually built for you.

That last one is worth spelling out, because it is the one most often assumed to be included. Knowing that a prompt was sent is not the same as being able to reconstruct which prompt produced which lines of your codebase. The artefacts for that live in per-tool files on developer laptops, governed by each tool's own retention default — thirty days, in the case of Claude Code and Gemini CLI — and no network control reaches them.

The sequencing question

Start from the consequence you are trying to avoid rather than the capability you want to acquire. If the worst outcome you can picture is customer data leaving through a chat window, this is your category and you should start here. If the worst outcome is an incident nobody can explain because the conversation that produced the code was deleted, that is a different category and this one will not get you there.

Most organisations eventually need more than one. The mistake is not buying two things — it is buying one and believing it was five.