Data loss prevention (DLP) tools may be better at documenting data loss than preventing it, according to a new survey from the Cloud Security Alliance (CSA). The report, DLP in the AI Era, found that 73% of organizations experienced at least one confirmed data loss incident in the past 24 months, while only 16% said their DLP systems blocked their most significant incident before data left the organization.

The study was conducted by CSA, a nonprofit organization focused on cloud, AI, and Zero Trust cybersecurity education, in collaboration with Jazz.

“Enterprise DLP has moved beyond the question of whether it should be deployed to whether it’s doing what it is intended to do. Enforcement is being softened, analyst capacity is consumed by noise, and new data-exit channels created through GenAI are exposing gaps legacy DLP was never meant to handle,” said Hillary Baron, AVP/Research, Cloud Security Alliance.

Baron continues, “In the AI era, where employees and applications can move sensitive data through more channels than ever, organizations can’t afford to discover gaps after the fact.”

The survey identified several challenges affecting organizations’ ability to detect and prevent sensitive data from leaving their environments.

Limited Visibility Into GenAI Data Movement

Although 48% of respondents ranked generative AI (GenAI) as their top data exfiltration risk, only 29% said they could routinely produce a 30-day report showing sensitive data sent to GenAI tools.

Cloud storage uploads also ranked high as a perceived risk, cited by 41% of respondents. However, just 22% of organizations strictly block data transfers to GenAI tools, and 19% on cloud storage uploads.

By comparison, removable media ranked lowest among the measured exfiltration risks, at 10%, yet 31% of organizations strictly block the channel—the highest strict-block rate among those surveyed.

The findings point to a potential mismatch between organizations’ perceived risks and their DLP enforcement policies.

Alert Fatigue Strains Security Teams

The survey also found that DLP alert volume is creating operational challenges. 54% of respondents said their teams triage DLP alerts for which most ultimately prove to be false positives.

90% reported at least one measurable impact from alert fatigue during the past year. Among the reported effects, 21% said DLP alert burdens had directly contributed to voluntary staff departures.

Business Resistance Leads to Weaker Enforcement

Operational and business pressures also appear to influence DLP effectiveness. 71% of respondents said their security teams faced pushback on DLP enforcement during the past two years.

Among those teams, 66% reduced enforcement for specific teams or use cases, 8% reduced enforcement broadly across the organization, and 3% reduced or paused their DLP programs entirely. Across all respondents, 54% reported softening enforcement in some form.

“Security teams know GenAI is creating new ways for sensitive data to leave the business, but many still cannot see the full impact,” said Ido Livneh, Co-Founder & CEO, Jazz.

Livneh continues, “Across the customer environments we observe, the average organization uses nearly 170 AI tools and fewer than 10 are sanctioned. Teams need to understand how data is actually moving so they can focus on real risk without blocking legitimate work.”

Survey Methodology

CSA conducted the online survey in June and July 2026, collecting 433 responses from IT and security professionals. Respondents represented organizations ranging from fewer than 1,000 employees to more than 50,000 employees and were primarily based in the United States and Canada.

Jazz funded the research and co-developed the questionnaire with CSA research analysts. CSA independently conducted the data analysis and interpretation.

Source: Cloud Security Alliance (CSA)

Stay Connected with ISE Magazine 

Subscribe to our newsletters and magazine for the latest telecom insights, explore the current issue for in-depth features and strategies, and register for upcoming webinars to learn directly from industry leaders.