Research conducted in collaboration with Jazz finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the organization
SEATTLE--(BUSINESS WIRE)--#ArtificialIntelligence--Data loss prevention (DLP) tools are often functioning as after-the-fact forensic systems rather than prevention controls, according to DLP in the AI Era, a new survey from the Cloud Security Alliance (CSA), the world's leading not-for-profit organization committed to AI, cloud, and Zero Trust cybersecurity education. The study, conducted in collaboration with Jazz, found that 73% of organizations said they experienced at least one confirmed data loss incident in the past 24 months. Among the respondents, only 16% said DLP blocked their most significant incident before data left the organization.
“Enterprise DLP has moved beyond the question of whether it should be deployed to whether it’s doing what it is intended to do. Enforcement is being softened, analyst capacity is consumed by noise, and new data-exit channels created through GenAI are exposing gaps legacy DLP was never meant to handle,” said Hillary Baron, AVP/Research, Cloud Security Alliance. “In the AI era, where employees and applications can move sensitive data through more channels than ever, organizations can’t afford to discover gaps after the fact.”
Among the report’s findings:
- Perceived visibility exceeds demonstrated capability. While close to half (48%) of security teams ranked GenAI as their top exfiltration risk, less than a third (29%) are able to produce a routine 30-day report showing sensitive data sent to GenAI tools.
- Modern risks lack modern enforcement. Paradoxically, the highest-ranked risks are among the least strictly enforced, and the lowest-ranked are among the most strictly enforced. Both GenAI (48%) and cloud storage uploads (41%) were cited as top exfiltration risks, but only 22% of organizations strictly block on GenAI and 19% on cloud storage uploads. Conversely, removable media, which ranked last (10%) as an exfiltration risk, is strictly blocked by 31% of respondents, the highest strict-block of any channel measured.
- DLP alert overload fuels fatigue. Fifty-four percent of teams are triaging DLP alerts where the majority turn out to be false positives, and 90% report at least one measurable impact from alert fatigue in the past year, including 21% who report voluntary staff departures directly attributable to DLP alert burden.
- Business friction determines enforcement posture. Seventy-one percent of respondents reported that their security teams received pushback on DLP enforcement during the past two years. Among those teams, 66% reduced enforcement for specific teams/use cases; 8% reduced enforcement broadly across the organization; and 3% reduced or paused the program entirely. Across the full respondent base, 54% softened enforcement in some form.
“Security teams know GenAI is creating new ways for sensitive data to leave the business, but many still cannot see the full impact,” said Ido Livneh, Co-Founder & CEO, Jazz. “Across the customer environments we observe, the average organization uses nearly 170 AI tools and fewer than 10 are sanctioned. Teams need to understand how data is actually moving so they can focus on real risk without blocking legitimate work.”
The survey was conducted online by CSA in June and July 2026 and received 433 responses from IT and security professionals. Respondents represented organizations ranging from fewer than 1,000 to more than 50,000 employees and were primarily located in the United States and Canada. Jazz funded the research and co-developed the questionnaire with CSA research analysts, while CSA independently performed the data analysis and interpretation.
Download DLP in the AI Era.
About Jazz
Jazz is the DLP platform built to understand your business. Its agentic investigator, Melody, delivers pre-investigated findings with the business context already attached with no rules, no regex, and no browser extension required. A single lightweight agent runs at under 1% CPU and covers GenAI use, shadow IT, desktop applications, and personal cloud accounts. Jazz is a Gartner Cool Vendor and the winner of the 2026 CrowdStrike, AWS and NVIDIA Cybersecurity Startup Accelerator, selected out of nearly 1,000 startups. Learn more at jazz.security.
About Cloud Security Alliance
The Cloud Security Alliance (CSA) is the world’s leading not-for-profit organization committed to awareness, practical implementation, and credentialing of forward-looking cybersecurity topics, including AI, cloud, and Zero Trust. In an era where digital transformation drives business success, CSA stands as the global authority ensuring organizations can operate securely while harnessing cutting-edge technology. Through the 501(c)3 CSAI Foundation, volunteer-driven research, globally-accepted standards, and award-winning vendor-neutral education programs that unite varied associations, governments, chapters, and corporate members, CSA bridges the gap between innovation and pragmatic security execution. Visit CSA’s website to learn more.
Contacts
Media Contacts
Kristina Rundquist
ZAG Communications for the CSA
kristina@zagcommunications.com
Leah Kleinberg
Marketbridge for Jazz Security
lkleinberg@marketbridge.com
