Why DLP Has Failed and What the Future Looks Like

Perhaps that’s why over half (61%) of employee survey respondents have training every 6 months or more and highly regulated industries like Financial Services and Healthcare have it even more frequently.

Security awareness training confronts the crux of data loss by educating employees on best practice and company policies. But, how effective is training and can it influence and actually change human behavior for the long-term?

Whether it’s because they’re afraid to admit wrongdoing or simply because they don’t know the implications or their internal reporting processes, this means many security leaders underestimate how many misdirected emails are sent within their organization every year.

IT leaders working at organizations with 1,000+ people in the US estimate 480 emails are sent to the wrong person every year. On the other hand, according to Tessian data, an average of 800 emails are misdirected in organizations with 1,000 employees during a single year.

Of course, sending company data to a personal email account can also be a sign of intentional data exfiltration by, for example, a disgruntled employee on their way out or an insider threat.

This happens much more often than IT leaders think. While they estimate just 720 unauthorized emails are sent each year in organizations with 1,000+ employees, according to Tessian data, an average of 27,500 unauthorized emails are sent a year in an organization with 1,000 employees.

That’s 38x more than estimated.

As many organizations have been forced to adopt remote-working structures and policies – and as more are opting to keep these flexible structures – maintaining visibility over data flow is now more difficult. The new office is a virtual one, which means past strategies have become obsolete. In fact, they became obsolete the day companies switched to remote-working. It’s no wonder, then, 84% of IT leaders say DLP is more challenging when their workforce is working remotely. 

Nonetheless, 91% of IT leaders say they trust their employees to follow security best practice while out of the office. 

Once again, there is a marked difference in responses based on age, region, and frequency of training. While just 19% of employees 51 and over feel they can get away with riskier behavior while working from home, 59% of employees aged 18-30 said the same. Likewise, US workers are almost twice as likely to agree they can get away with more while out of the office. 

Without the watchful eye of IT staff, employees are inclined to seek out the easiest or most convenient path to getting their jobs done. And, when you consider over half (51%) of employees say security policies impede their productivity, the easiest or most convenient path often involves skirting around security rules.