cyber.hendryadrian.com
Security Report · darkreading.com

CSA Survey Finds DLP Often Detects Data Loss After It Occurs

· Original article ↗

Summary

A CSA survey of 433 IT and security professionals found 73% of organizations experienced a confirmed data-loss incident in the past 24 months, while only 16% said DLP blocked their most significant incident before data left the organization.

Key points

  • The online survey was conducted in June and July 2026; Jazz funded the research and co-developed the questionnaire, while CSA independently analyzed and interpreted the data.
  • Only 29% of respondents said they could routinely produce a 30-day report of sensitive data sent to GenAI tools, despite 48% ranking GenAI as a top exfiltration risk.
  • Only 22% strictly block GenAI and 19% strictly block cloud-storage uploads; removable media was strictly blocked by 31%.
  • Fifty-four percent of teams said most DLP alerts they triage are false positives, and 90% reported at least one measurable impact from alert fatigue in the past year.
  • Seventy-one percent reported pushback on DLP enforcement; across all respondents, 54% said enforcement had been softened in some form.

Article Details

Publisher
Cloud Security Alliance (CSA), in collaboration with Jazz
Report Period
June-July 2026
Scope
Survey of data loss prevention practices, data loss incidents, GenAI and cloud-storage risks, and enforcement and alert-fatigue impacts.
Sample Size
433 IT and security professionals; respondents represented organizations ranging from fewer than 1,000 to more than 50,000 employees and were primarily located in the United States and Canada.
Key Statistics
  • 73% of organizations reported at least one confirmed data loss incident in the prior 24 months.
  • 16% said DLP blocked their most significant incident before data left the organization.
  • 48% ranked GenAI as a top exfiltration risk, while 22% said they strictly block GenAI.
  • 90% reported at least one measurable impact from DLP alert fatigue in the past year.
  • 54% of respondents said they softened DLP enforcement in some form.
Recommendations
  • Understand how sensitive data moves through GenAI and other channels so security teams can focus on actual risk without blocking legitimate work.

People

Hillary BaronAVP/Research at the Cloud Security Alliance; commented on DLP enforcement, alert noise, and data-exit channels.Ido LivnehCo-Founder and CEO of Jazz; commented on GenAI-related data movement and visibility.

Vendors

Jazzcommitted to AI, cloud, and Zero Trust cybersecurity education. The study, conducted in collaboration with Jazz, found that 73% of organizations said they experienced at least one confirmed data loss incident in the

Products

Jazzcommitted to AI, cloud, and Zero Trust cybersecurity education. The study, conducted in collaboration with Jazz, found that 73% of organizations said they experienced at least one confirmed data loss incident in theMelodyJazz is the DLP platform built to understand your business. Its agentic investigator, Melody, delivers pre-investigated findings with the business context already attached with no rules, no regex, and no browser

Countries

Canadafrom fewer than 1,000 to more than 50,000 employees and were primarily located in the United States and Canada. Jazz funded the research and co-developed the questionnaire with CSA research analysts, while CSAUnited Statesranging from fewer than 1,000 to more than 50,000 employees and were primarily located in the United States and Canada. Jazz funded the research and co-developed the questionnaire with CSA research analysts,