- In a CSA survey of 433 practitioners, 73% reported a confirmed data loss; 16% said DLP blocked their biggest one first, but the base for that 16% is unclear.
- GenAI ranks as the top leak risk (48%), yet 22% strictly block it and 29% report on it routinely. The survey does not link softened enforcement to the 16%.
- Leaders should ask which channels their DLP blocks and which it only logs, and who approved each exception.
A DLP tool that records is not the same as one that blocks
Data loss prevention (DLP) software is meant to stop sensitive data leaving a company. The Cloud Security Alliance (CSA) now says many deployments behave differently. Its survey, DLP in the AI Era, describes DLP tools as often working as "after-the-fact forensic systems" rather than prevention controls.
That is CSA's reading of its own results. The useful question for leaders follows from it. It is not whether DLP is installed. It is which channels the tool blocks and which it only logs.
What the 16% figure does and does not tell you
CSA asked about losses over the past 24 months. The answer was stark: 73% of organizations had faced at least one confirmed data loss incident in that window.
The number that drew attention is smaller. Only 16% said DLP caught their most significant incident before the data got out.
The base for that 16% is not clear. CSA's release says "among the respondents." Dark Reading's summary says it is among respondents who experienced data loss. Under the second reading, the 16% applies only to those who lost data. Do not read it as 16% of all 433 respondents.
The biggest worry gets the least strict response
The survey asked which channels teams see as the top exfiltration risk, meaning the routes data takes out of a company. Generative AI (GenAI) ranked first for 48%. Uploads to cloud storage were named by 41%.
Enforcement runs the other way. Just 22% of organizations strictly block GenAI use, and 19% strictly block cloud storage uploads. Removable media, such as USB drives, ranked last as a risk at 10%. Yet 31% strictly block it, the highest strict-block rate of any channel measured.
CSA's Hillary Baron said new GenAI exit routes are exposing gaps that legacy DLP "was never meant to handle."
Seeing GenAI use is not the same as proving it
Visibility is a second difference between belief and evidence. Fewer than a third of teams, 29%, can produce a routine 30-day report on sensitive data sent to GenAI tools. Nearly half rank GenAI as their top risk. A board asking what sensitive data went to GenAI tools would, in most surveyed firms, not get a routine report.
Ido Livneh, CEO of survey partner Jazz, pointed to the scale of unapproved use. In the customer environments Jazz observes, he said, the average organization uses nearly 170 AI tools. Fewer than ten are sanctioned. That figure comes from Jazz's own customers, not from the survey.
Softened rules may explain part of the picture
Pushback is common. Seventy-one percent of respondents said their security teams met resistance on DLP enforcement in the past two years. Of those teams, 66% narrowed enforcement for particular teams or uses. Eight percent loosened it across the whole organization. Three percent cut back or suspended the program. Across all respondents, 54% softened enforcement in some form.
One possible reason for a low block rate is that exceptions turn blocking rules into logging rules. That is a hypothesis, not a finding. The survey does not connect the 54% to the 16%. Missed detections or channels nobody monitors would fit the same numbers.
Alert volume is a further strain. Fifty-four percent of teams triage DLP alerts that are mostly false positives. Ninety percent reported at least one measurable effect from alert fatigue in the past year. Twenty-one percent reported voluntary staff departures that they attribute directly to the alert burden. For the analyst reviewing yet another wrong alert, the cost is real.
How the survey was run
CSA fielded an online questionnaire in June and July 2026. It drew 433 responses from IT and security professionals, mostly in the United States and Canada. Their organizations ranged from under 1,000 to over 50,000 employees.
Jazz paid for the work and helped write the questions with CSA analysts. Answers are self-reported. Treat the results as a signal from one group of practitioners, not a measure of every company.
Questions to put to your security team
Ask which channels your DLP blocks and which it only logs. Request the list by channel, including GenAI tools and cloud storage.
Ask whether the team can produce a 30-day report of sensitive data sent to GenAI tools. If not, that is the first item to close.
Ask who approved each exception to enforcement, and when it expires. A softened rule needs an owner and an end date.
Ask how many alerts are false positives and how much analyst time they take. Reducing noise helps both the data and the people.
Owning a DLP tool shows that money was spent. Knowing what it blocks shows whether it works.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Cloud Security Alliance.
