Data Loss Prevention (DLP) Software

Microsoft 365 + Azure-anchored DLP with deepest M365 integration via E5 bundle.

Microsoft Purview was launched April 2022 as the rebrand and unification of Microsoft Compliance, Microsoft Information Protection, and Microsoft Defender for Cloud Apps DLP modules. The platform serves Microsoft 365 + Azure-anchored enterprises with deepest M365 integration: native DLP for Exchange Online, SharePoint Online, OneDrive, Teams, and Endpoint Windows + Mac. Wins on M365 integration depth, E5 bundle economics (no additional cost for E5 customers), and broad enterprise reach. Loses on non-Microsoft data estate coverage (Salesforce, AWS, GCP need add-on connectors) and complex policy authoring versus modern UX peers.

Enterprise legacy DLP with broad workload coverage, Francisco Partners-controlled since 2021.

Forcepoint DLP traces to Websense (founded 1994) and the 2015 Raytheon+Vista merger that formed Forcepoint. Francisco Partners acquired Forcepoint in 2021 ($1.1B) and consolidated the platform under Forcepoint ONE in 2023. The DLP module retains broad workload coverage (endpoint, network, cloud, email) and a deep installed base across Fortune-500. Wins on workload-coverage breadth and Forcepoint ONE SSE integration. Loses on post-PE product-investment-velocity questions, customer-support quality, and modernization speed versus Microsoft Purview.

API-first SaaS-data DLP for modern cloud-native enterprises.

Nightfall launched 2018 (founder Isaac Madan) and closed a $40M Series B Mar 2022 led by Bain Capital Ventures. The platform serves SaaS-data DLP with API-first integration into Slack, Salesforce, GitHub, Confluence, Notion, Google Workspace, and other modern cloud-collaboration tools. Wins on SaaS-data coverage breadth, modern UX, and developer-friendly architecture. Loses on traditional endpoint DLP coverage and brand mindshare in legacy-enterprise procurement defaults.

Broadcom-owned Symantec DLP with deepest legacy-enterprise installed base.

Symantec DLP traces to the 2007 Vontu acquisition and was inherited by Broadcom when Broadcom acquired Symantec Enterprise Security in 2019 ($10.7B). Broadcom is known for post-acquisition margin extraction: cost-restructure, customer-support reduction, pricing increases. The Symantec DLP module retains the deepest legacy-enterprise installed base (Fortune-500 deployments going back 15+ years) but suffers from post-Broadcom product-investment-velocity questions and customer-support quality concerns. Wins on Fortune-500 references and content-inspection-engine maturity. Loses on post-Broadcom trajectory and modernization speed.

McAfee Enterprise + FireEye merged DLP under Symphony Technology Group ownership.

Trellix was formed in January 2022 when Symphony Technology Group (STG) merged McAfee Enterprise + FireEye after acquiring both in 2021. The DLP module inherits McAfee DLP heritage (one of the longest-tenured enterprise DLP products) but suffers from post-merger consolidation and STG cost-restructure pressure. Wins on McAfee DLP heritage and broad workload coverage. Loses on post-STG product velocity concerns, customer-support quality, and Trellix brand recognition still maturing.

Email-anchored DLP with cloud-collaboration coverage; Thoma Bravo-owned since 2021.

Proofpoint was acquired by Thoma Bravo in 2021 ($12.3B take-private). The Information Protection module extends Proofpoint email security into DLP across email, cloud collaboration (Microsoft 365, Google Workspace, Slack), endpoint, and data discovery. Wins on email-security heritage and tight integration with Proofpoint email anti-phishing platform. Loses on post-Thoma-Bravo product investment trajectory and broader workload coverage versus Forcepoint and Symantec.

Insider-risk-management leader with file-data context across endpoint and cloud.

Code42 launched 2001 and rebranded its DLP platform as Incydr in 2020 to focus on insider-risk-management rather than traditional content-inspection DLP. The platform monitors file activity across endpoint + cloud + web with risk-based scoring of user behavior. Wins on insider-risk-management leadership and file-data context. Loses on traditional content-inspection DLP (less of focus) and broader workload coverage versus integrated platforms.

Cloud-native DLP integrated with Netskope SSE/CASB platform.

Netskope DLP is the DLP module of the broader Netskope SSE platform (covered in our CASB ranking under netskope and ZTNA ranking). The module wins on cloud-native architecture, SSE integration, and modern UX. Loses on standalone-DLP feature depth versus Forcepoint + Symantec for legacy workloads.

Cross-platform endpoint DLP with strong Mac + Linux coverage.

Endpoint Protector launched 2004 by CoSoSys in Romania and was acquired by Netwrix in 2023. The platform serves mid-market and upper-mid-market with cross-platform endpoint DLP (Windows + Mac + Linux). Wins on cross-platform endpoint coverage (especially Mac + Linux versus Microsoft Purview), affordable mid-market pricing, and European GDPR-native positioning. Loses on network + cloud DLP feature depth and brand mindshare in US enterprise procurement defaults.

Data-discovery-led DLP with PII + PCI + regulated-data inventory.

BigID launched 2016 (founder Dimitri Sirota) and closed a $200M Series E Apr 2023 at $1.2B+ valuation led by Riverwood Capital. The platform serves data-discovery-led DLP: discover sensitive data across the estate, classify it, build inventories, then integrate with downstream DLP enforcement. Wins on data-discovery depth, PII + PCI + regulated-data inventory, and integrations with downstream DLP platforms. Loses on standalone DLP enforcement and traditional content-inspection workflows.