Managed Security Services
Data Loss Prevention
Find where sensitive data actually sits, then stop it leaving by the routes people really use.
Every engagement includes manual validation, a two audience report and free re-testing.
Get a scoped quote+91 96682 00222What this actually is
Most DLP projects fail the same way. The tool goes in, blocking is switched on too early, the business revolts, and six months later everything is in monitor mode and nobody reads the alerts.
We do discovery first. You cannot write a sensible policy until you know where the sensitive data actually is and how people legitimately move it around, which is almost never how the architecture diagram says.
Then we tune in monitor mode, agree exceptions with the business, and only enforce once the false positive rate is low enough that people trust it.
What we go after
- Sensitive data discovery across endpoints, servers and cloud
- Classification scheme design and rollout
- Legitimate data flow mapping
- Policy design with the business rather than at it
- Tuning in monitor mode before enforcement
- Exception and approval workflow
- Insider risk detection use cases
- DPDP and sectoral obligation mapping
How we run it
- 01
Onboard
Log sources, agents and integrations connected, with a baseline of what normal looks like for you.
- 02
Tune
Detection rules written for your environment. We would rather spend two weeks tuning than send you noise for a year.
- 03
Monitor
Round the clock triage with severity-based response times, including nights and weekends.
- 04
Respond
Playbook-driven containment with approval gates on anything that touches production.
- 05
Report and improve
Monthly reporting your board understands, and detection coverage that grows every quarter.
What you receive
- Sensitive data inventory and classification scheme
- DLP policy set with tuned thresholds
- Exception handling procedure
- Rollout plan staged from monitor to enforce
- Operational runbook for the team who will own it
Who needs this
Organisations handling regulated or commercially sensitive data, particularly where staff move data between cloud services and personal devices.
How long it takes
Eight to sixteen weeks from discovery to enforcement.
Standards this satisfies
- DPDP Act
- ISO 27001
- PCI DSS
- GDPR
Why it matters
Detection is not a product you buy, it is a capability you operate. Most organisations that have bought the tooling still do not have the capability, because coverage thins overnight and at weekends, which is precisely when intrusions begin.
Dwell time is the single largest driver of what a breach costs. Everything managed defence does is aimed at that one number: seeing it sooner, understanding it faster, and containing it before it becomes a recovery exercise.
Choose how you want this delivered
Most of the price difference between quotes comes down to this one choice, and it is rarely explained. Pick one to see what it covers, what it suits and what it costs you.
We take monitoring, triage, investigation and first response, around the clock, with a named service lead who knows your environment. Escalation reaches a person with context rather than a queue, which is the difference that matters at three in the morning.
Choose this when
- No internal security operations capability
- Regulatory expectation of continuous monitoring
- You want one accountable party for detection and response
Effort and cost
Monthly, scaled by estate size and log volume. Predictable, which is usually the point.
Scope it yourself, before you call anyone
Answer a few questions and you get an indicative number, the working behind it and what your answers tell us. It runs in your browser, so nothing you type reaches us.
Roughly how many personal records do you hold?
What we look for, and keep finding
These are the classes of problem this work exists to surface. Not every engagement finds all of them, but these are the ones that turn up often enough to be worth naming.
Sensitive data nobody knew existed
Discovery almost always finds personal or regulated data in places it was never meant to be: test environments, exports, shared drives and analytics copies.
Egress routes that are not covered
Policy applied to email while the actual leakage happens through personal cloud storage, messaging apps or a browser upload. We test the routes people really use.
Classification nobody applies
A four tier scheme that staff ignore because it is unclear and slows them down. Automated classification with a small number of tiers works better than a taxonomy nobody uses.
Blocking tuned so hard it gets disabled
False positives that interrupt legitimate work produce pressure to switch the control off. We tune for the flows that matter rather than for maximum coverage.
Insider exfiltration over time
Slow, low volume extraction by someone with legitimate access, which threshold based rules are specifically bad at catching.
Who runs your engagement
A named service lead and a real team behind them
You get a named lead who knows your environment, backed by an analyst team running around the clock. Escalation reaches a person who has context rather than a queue, which is the difference that matters at three in the morning.
Questions we get asked
Which DLP product should we buy?
That depends on where your data lives and what you already own. We work with Safetica, Data Resolve and Seqrite among others, and if your existing platform is adequate we will tell you rather than sell you another one.
How long before we can turn on blocking?
Usually two to three months of monitoring first. Enforcing early is the single most reliable way to lose the organisation's goodwill and end up back in monitor mode permanently.
Often scoped alongside
- SOC as a Service24x7 monitoring, triage and response, powered by our AI SOC 360 platform.Read more
- Managed Security ServicesDay-to-day operation of your security stack against agreed SLAs.Read more
- Managed SIEMUse-case engineering, tuning and continuous detection improvement.Read more
- Red Teaming & Attack SimulationGoal-oriented adversary emulation that tests people, process and technology together.Read more
Ready to scope your data loss prevention?
Thirty minutes with a senior engineer, and you leave with a written scope and indicative effort.