By scenario: which data, which channel, which control
Each scenario below starts from the console’s policy templates and goes live in monitor mode. The move to blocking happens after the pilot group’s false-positive rate has been measured.
Seven core scenarios
Data leaking into generative AI
Source code, customer data and contracts pasted into ChatGPT, Copilot and similar tools. The proxy with AI platform packs, the browser extension on typed text; override with justification available.
Leavers and insider risk
Bulk copies to USB, uploads to personal cloud storage, attachments to personal e-mail. User-risk view, shadow copy and the incident timeline as evidence.
KVKK: personal data leaving the organisation
TCKN, health and contact data leaving by e-mail, web form, file sharing and clipboard; inventory with a discovery profile, control with egress blocking.
PCI-DSS: card data spilling out of scope
Card numbers on call-centre and accounting endpoints; quarantine for files at rest, blocking on the network, evidence in reports.
Source code and intellectual property
Code copied out of the repository, pushes to the wrong account, secret leaks. Document fingerprinting, GitHub CASB scanning and the browser extension together.
Multi-user servers (RDS, Citrix)
Many sessions on one machine; the incident must be attributed to the right user. Per-session identity, validated in agent and Kerberos modes.
Systems where no agent can run
Production servers, guest networks, contractor devices. Agentless proxy mode: the same policy and the same console with PAC/WPAD and Kerberos.
Where regulation defines the data
Finance and payments
Banking regulation and PCI-DSS; card data, customer identities, credit files. Network and endpoint blocking, call-centre RDS identity, audit log.
Healthcare
Patient records and special-category data; HIPAA patterns and KVKK; discovery on PACS and hospital information system endpoints, OCR on images.
Public sector and defence
Closed networks, installation without internet, offline licence, local data types, identity through AD/Kerberos.
Software and technology
Source code, API keys, customer data; GitHub scanning, AI-prompt DLP, low resource use on developer machines.
Retail and e-commerce
Customer database exports, campaign lists, card data; EDM for real customer-record matching.
Services and consulting
Client documents and contracts; document fingerprinting, Office labels, external-sharing categories.
From monitoring to blocking in four weeks
The recommended approach: visibility, measurement, enforcement. The output of every step is reported in the console.
- 1
Discovery and inventory
Endpoint and repository scans with the chosen framework profile (KVKK, PCI, HIPAA); a data inventory report.
- 2
Monitor mode
Policies only raise incidents in the pilot group; the false-positive rate is measured in the review queue with justifications.
- 3
Warn and justify
Users are warned in their own language; override with justification is on; behaviour and justifications are reported.
- 4
Block and expand
Measured rules move to blocking; rollout proceeds group by group; SIEM and notification rules are connected.
See it in your own environment
With the installation guide and a 30-day trial licence, a proof-of-concept environment can be set up within a day. The trial licence works offline.