Employees now work across Microsoft 365, messaging platforms, cloud applications, SaaS environments and generative AI tools, often moving between them throughout the day. Most of this activity is legitimate and necessary, yet every new application creates another route for sensitive information to leave the organisation.
This is where traditional data loss prevention (DLP) approaches are starting to show their age. Many were designed around a more contained technology environment, where businesses could identify sensitive information, classify it, build policies around it and control a relatively predictable set of channels. That model becomes much harder to manage when data is constantly being created, copied, uploaded, shared and transformed across applications that security teams may not even know employees are using.
We aren’t living in a world where deciding if an application should be allowed or blocked is enough anymore. Security teams need to understand what information is being handled, who is using it, where it came from, where it is going and what level of risk that activity presents.
The limits of traditional DLP
One of the biggest challenges with legacy DLP has always been the amount of work required before organisations begin seeing meaningful value. Traditional implementations can depend heavily on data discovery, classification and policy development, followed by ongoing tuning as the business changes.
That creates practical problems for security teams that are already under pressure. Policies can become complex, false positives create unnecessary noise and employees can become frustrated when legitimate activity is repeatedly interrupted.
The business impact matters just as much as the technical one. If employees genuinely need WhatsApp, a SaaS application or another collaboration tool to communicate with customers and colleagues, blocking the entire application may create more problems than it solves. The real concern is whether confidential business information is being sent through that channel inappropriately.
FortiDLP approaches the problem by examining data and user activity in real-time. It combines content inspection, behavioural analysis and context to help organisations understand how sensitive information is being used. It also supports a broader range of responses than a simple allow-or-block decision, giving security teams more control over how they deal with different levels of risk.
AI makes the data question more urgent
Generative AI has added another layer of risk, with employees often using new tools before the business has set clear rules around what data can be shared with them.
Employees see obvious value in tools that can summarise documents, analyse information, draft content or help solve problems. The risk arises when confidential information, customer records, financial data, intellectual property or source code is copied into a tool without the employee fully understanding where that data may go.
Organisations therefore need visibility into which AI and SaaS tools are used and what information moves into them. Simply prohibiting AI is unlikely to be practical for many businesses, particularly as these tools become part of mainstream productivity platforms.
FortiDLP provides visibility into activity across endpoints, cloud drives, SaaS applications and GenAI tools. Its capabilities include monitoring shadow AI usage, identifying sensitive data movement and applying controls when risky behaviour occurs. Data origin and data lineage can also help security teams understand where information originated and how it has subsequently been moved or manipulated.
This context becomes important when security teams are investigating an incident. Knowing that a file left the organisation is useful, but understanding where it came from, who accessed it and what happened to it beforehand provides a much clearer picture of the risk.
Experience matters as much as technology
Technology is only one part of a successful DLP strategy. Implementation can determine whether an organisation gets useful visibility quickly or spends months building a program that struggles to gain momentum.
That was one of the opportunities the team at Blue Turtle identified when it began working with what is now FortiDLP. A clear gap existed in the African market for a DLP approach that could deliver visibility faster without placing excessive demands on already constrained security teams – and Blue Turtle could meet it.
It therefore invested in building a dedicated capability around the technology. Blue Turtle uses the platform internally, which allows the team to work with it continuously, test functionality and build practical experience before deploying it into customer environments. The company has also developed skills across pre-sales, proof of concept, implementation and post-sales support.
Blue Turtle's recent recognition by Fortinet for its performance in security operations reflects the work it has put into building that capability and the volume of FortiDLP work it has delivered with customers. For Blue Turtle, the award is also validation that the specialisation and delivery model it has built around DLP is working in the market.
Turning the POC into part of the implementation
The proof-of-concept process is central to how Blue Turtle works. For Blue Turtle, a POC isn't simply about proving the technology works. It gives Blue Turtle the opportunity to understand the customer’s environment and do much of the groundwork needed if the project moves into production.
During the POC, Blue Turtle examines data flows, identifies risks, understands which applications employees use, and begins shaping policies around the customer’s actual environment. Blue Turtle retains that work, so if the customer decides to proceed, Blue Turtle does not start from scratch.
This has helped Blue Turtle shorten implementation timelines considerably. In one large financial services environment, an initial production phase covering approximately 8 500 agents was completed in around two-and-a-half weeks. Blue Turtle moved at that speed because much of the preparation had already been done during the POC and because of the experience it has built across previous deployments.
That matters because the longer it takes to put the right controls in place, the longer the business remains exposed to risks it already knows about.
DLP must follow the data
Data is now moving through environments that were never part of the traditional corporate perimeter, and AI will accelerate that movement further. Security teams need visibility that follows the information across those environments and controls that respond to the context of each interaction.
That is the change modern DLP needs to address.
Share
Editorial contacts