Financial Services · Managed platform (Forcepoint)

Data Loss Prevention

Stop Social Security and card numbers leaving by email, web or endpoint, with Forcepoint run by Moraph

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Moraph resells, implements and runs Forcepoint data loss prevention for banks, credit unions, lenders and investment firms. We configure Forcepoint to recognize Social Security numbers, payment card numbers and your own customer data, enforce policies on endpoints and network channels, and triage the incidents it raises so your team only handles the ones that need a decision. Forcepoint provides the platform; Moraph operates it; your organization decides the policies and what happens to people who break them.

The problem it solves

Consumer financial data leaves institutions in ordinary ways: a spreadsheet of account holders emailed to a personal address, a file of card numbers uploaded to a web form, a customer list copied to a USB drive. Many institutions own a DLP tool but run it in monitor-only mode because the policies were never tuned, the false positives overwhelm the security team, and nobody has time to review incidents. When a regulator or customer asks how sensitive data is protected in transit, the honest answer is that the tool is installed but not really used.

  • DLP policies left in monitor-only mode because tuning never finished
  • Too many false positives for the team to review, so real incidents are missed
  • Agents missing or out of date on part of the endpoint estate
  • No clear record of incidents, decisions and follow-up for examiners

Who uses it

  • Banks, credit unions, lenders and investment firms that handle Social Security and payment card numbers
  • CISOs and security teams who own data protection controls
  • Privacy, compliance and fraud teams who decide what happens after an incident
  • IT teams who deploy and maintain endpoint agents
  • Internal audit and examiners reviewing safeguards for customer information

Requirements it supports

Gramm-Leach-Bliley Act Safeguards (Interagency Guidelines Establishing Information Security Standards; FTC Safeguards Rule, 16 CFR Part 314)SEC Regulation S-P (17 CFR Part 248), including its incident response and customer notification requirementsPayment Card Industry Data Security Standard (PCI DSS) v4.0, where cardholder data is handledNYDFS Cybersecurity Regulation (23 NYCRR Part 500)FFIEC IT Examination Handbook: Information SecurityState data breach notification laws

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

Forcepoint provides and supports the DLP platform, Moraph configures and runs it for you, and your organization owns the policies, the data and the decisions about people.

AreaMoraphForcepointYour organization
LicensingResells Forcepoint licences sized to your users and channels, and tracks renewalsSets licence terms and entitlementsApproves the licence scope and the users covered
Platform availabilityRuns the management servers or tenant configuration and monitors agent and channel healthProvides the software and any Forcepoint-hosted components under its own service commitmentsProvides the infrastructure where components run on your premises
Policy configurationBuilds and tunes classifiers, rules and actions for each channel, and documents every versionProvides the policy engine, predefined classifiers and templatesDecides what data is protected and whether each policy audits, warns or blocks
Identity and accessConfigures administrator and reviewer roles in the DLP console and links them to your directoryProvides the role model in the platformDecides who may see incidents and the data inside them
Agent deploymentPackages and tests endpoint agents and reports coverage gapsSupplies agent releasesDeploys agents through your software distribution tools
Incident triageReviews incidents, closes false positives with a reason and escalates real onesGenerates incidents from policy matchesDecides on escalated incidents, investigations and any action involving staff
Breach responseProvides incident records and evidence to your response teamSupports platform defects through its own support channelDecides whether an event is a breach and makes any customer or regulator notification
ChangesTests policy changes in audit mode and applies them after approvalChanges the product under its own release termsApproves policy changes and moves from audit to block
Patches and updatesPlans and applies Forcepoint server and agent updates with youPublishes updates and fixesApproves maintenance windows and deploys agents
User supportHandles questions from your service desk about blocks and justificationsSupports Moraph on product issuesRuns your service desk and staff communications

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of Forcepoint itself, which belongs to its vendor.

  1. Step 1

    Onboarding tracker

    Moraph tracks each channel and agent wave from setup to enforcing, so you can see where protection is live.

    ScopeComponentCoverageModeStatus
    Outbound emailNetwork channelAll mailboxesBlock for card numbersEnforcing
    Web uploadsNetwork channelHead office and branchesAuditTuning
    Branch endpointsEndpoint agent wave 1412 of 430 devicesWarnPilot
    Operations endpointsEndpoint agent wave 20 of 268 devicesNot startedScheduled
    Removable mediaEndpoint agentWave 1 devicesBlockEnforcing
    Moraph tracks each channel and agent wave from setup to enforcing, so you can see where protection is live.

  2. Step 2

    Policy baseline review

    Before a policy blocks anything, the policy owner sees what it detects, where it applies and what audit mode showed.

    Policy P-07 · Social Security numbers in outbound email

    Data type
    Social Security numbers
    Threshold
    5 or more in one message
    Channel
    Outbound email to external recipients
    Current mode
    Audit
    Proposed mode
    Block, with notice to the sender
    Audit matches last month
    86, of which 61 to allowed partners

    Allowed routes in this policy

    • Encrypted email to Example Credit Bureau Partner (fictional)
    • Secure file transfer to Example Payroll Processor (fictional)
    • Internal recipients only
    Before a policy blocks anything, the policy owner sees what it detects, where it applies and what audit mode showed.

  3. Step 3

    Change request

    A policy change goes from proposal through testing and approval, with every step recorded.

    Change CR-0418 · Policy P-07 to block

    1. Tuning proposal and audit-mode impact attachedMoraph engineer
    2. Allowed routes confirmed with lending operationsPolicy owner
    3. Change approved for pilot groupPolicy owner
    4. Applied to pilot group; 2 blocks, both correctMoraph engineer
    5. Change approved for all usersPolicy owner
    6. Applied organization-wide and recordedMoraph engineer
    A policy change goes from proposal through testing and approval, with every step recorded.

  4. Step 4

    Alert triage

    Moraph analysts review incidents and escalate the ones that need your decision, with a summary ready.

    Incident IN-55120 · Employee 4471 (fictional)

    Policy
    Card numbers in web upload
    Channel
    Browser upload, endpoint agent
    Destination
    Personal file-sharing site
    Matches
    212 card numbers
    Action taken
    Blocked
    User justification
    None given

    Analyst summary

    • Upload blocked; no data left the endpoint
    • Second blocked attempt by the same user this week
    • Escalated to your reviewer for follow-up under your procedures
    Moraph analysts review incidents and escalate the ones that need your decision, with a summary ready.

  5. Step 5

    Monthly service review

    Each month Moraph reviews incidents, tuning and coverage with your policy owner and brings the decisions that are due.

    Monthly service review · sample month

    Incidents raised
    1,940
    Closed as false positive
    1,602
    Escalated to your reviewers
    28
    Policies enforcing / in audit
    9 / 4
    Agent coverage
    93 percent of devices in scope
    Forcepoint updates pending
    1

    Decisions needed

    • Approve web-upload card number policy for block
    • Agree a maintenance window for the server update
    • Confirm allowed route for a new payroll provider
    Each month Moraph reviews incidents, tuning and coverage with your policy owner and brings the decisions that are due.

  6. Step 6

    Reviewer access review

    Because incident evidence can contain customer data, the policy owner certifies who may see it.

    PersonRoleBusiness unitsEvidence accessDecision
    Reviewer 2208 (fictional)Incident reviewerRetail branchesYesKeep
    Reviewer 1934 (fictional)Incident reviewerWealthYesKeep
    Officer 0311 (fictional)Compliance officerAllYesKeep
    Reviewer 1650 (fictional)Incident reviewerLendingMoved to another teamRemove
    Moraph analyst groupTriageAllNoKeep
    Because incident evidence can contain customer data, the policy owner certifies who may see it.

Workflows

The principal workflows

  1. Discover

    Before blocking anything, Moraph configures Forcepoint to watch the channels in scope and learn where sensitive data actually moves.

    • Data types and channels in scope agreed with your security and compliance leads
    • Classifiers for Social Security numbers, card numbers and your own data identifiers configured
    • Policies run in audit mode on endpoints and network channels
    • Matches reviewed with business owners to separate legitimate flows from risky ones
    • Legitimate flows documented as allowed routes

  2. Enforce

    Once a policy is tuned, your organization approves moving it from audit to warn or block, channel by channel.

    • Tuning results and expected impact presented to the policy owner
    • Policy owner approves the change from audit to warn or block
    • Change applied to a pilot group, then the wider organization
    • Staff see a notice explaining why a transfer was stopped
    • Business justifications captured where your policy allows the user to continue

  3. Triage

    Moraph analysts work the incident queue, close false positives with a reason, and send real incidents to the people at your institution who decide on them.

    • Incidents grouped by user, policy and channel
    • Analyst reviews the match, the destination and any justification given
    • False positives closed with a reason and fed back into tuning
    • Incidents needing a decision escalated to your reviewer
    • Reviewer records the outcome and any follow-up

  4. Improve

    Each month Moraph reviews incidents, coverage and tuning with you and proposes the next policy changes.

    • Monthly service report prepared from incidents and agent health
    • Agent coverage gaps listed for your IT team
    • False-positive sources and tuning proposals reviewed
    • Policies ready to move to block brought for approval
    • Evidence exported for audit and exam requests

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

DLP policy owner

CISO, information security officer, data protection lead

Owns the DLP program: what is protected, on which channels, and how strictly.

Sees

  • All policies, classifiers and their versions
  • Incident volumes, outcomes and false-positive trends
  • Agent coverage across the estate
  • Monthly service reports

Does

  • Approves the data types and channels in scope
  • Approves policy changes and moves from audit to warn or block
  • Approves allowed routes for legitimate business flows
  • Reviews the monthly service report with Moraph
  • Decides who may see incident evidence

Cannot

  • Apply policy changes directly; Moraph applies approved changes
  • Edit or delete incident history or the audit trail
Approvals
Approves every policy change, allowed route and reviewer role; changes they propose themselves need a second approver your organization names.
Notified about
Policies ready for approval, high-severity incidents and agent coverage below the level you set.

Compliance or privacy officer

Chief compliance officer, privacy officer, BSA or consumer compliance lead

Decides whether an incident involving customer data needs notification or further action.

Sees

  • Escalated incidents and their investigation notes
  • Incident evidence, where your organization grants it
  • Incident outcomes and notification decisions

Does

  • Reviews incidents escalated as possible exposure of customer information
  • Records whether an incident is reportable and why
  • Coordinates notification with legal and the incident response team
  • Reviews data types in scope with the policy owner

Cannot

  • Change policies or classifiers
  • Close incidents that are still under investigation by another reviewer
Approvals
Records notification decisions; policy changes go to the policy owner.
Notified about
Incidents escalated as possible exposure of customer data.

Incident reviewer

Security analyst, insider risk investigator, HR or line-of-business reviewer

Investigates escalated incidents and decides what happened.

Sees

  • Incidents assigned to them, with the policy matched and the destination
  • Incident evidence, where their role allows
  • Earlier incidents for the same user

Does

  • Reviews escalated incidents and the user's justification
  • Contacts the user or their manager under your procedures
  • Records the outcome and any follow-up action
  • Refers incidents to compliance where customer data may have been exposed

Cannot

  • Change policies or allowed routes
  • See incidents outside their assigned business units
  • Delete incidents or evidence
Approvals
Their outcomes on possible exposures are reviewed by the compliance or privacy officer.
Notified about
Incidents assigned to them and incidents reopened by compliance.

IT endpoint administrator

Desktop engineering, endpoint management team

Deploys and maintains the Forcepoint agent on your endpoints.

Sees

  • Agent coverage, versions and health
  • Agent packages and release notes from Moraph

Does

  • Deploys agent packages through your software distribution tools
  • Fixes endpoints missing an agent or not reporting
  • Schedules agent updates in agreed windows

Cannot

  • See incident evidence
  • Change policies or disable enforcement
Approvals
Agent removal on any endpoint needs approval from the policy owner.
Notified about
Coverage gaps, agent health problems and new agent releases ready to deploy.

Moraph DLP engineer

Moraph data protection engineer

Configures, tunes and maintains Forcepoint so policies catch what they should and little else.

Sees

  • Policies, classifiers, routes and their version history
  • Incident statistics and false-positive patterns
  • Platform and channel health

Does

  • Builds and tunes classifiers and policies
  • Tests changes in audit mode and reports their expected impact
  • Applies approved changes and records them
  • Plans and applies platform updates
  • Works product issues with Forcepoint support

Cannot

  • Approve their own changes or move a policy to block without your approval
  • View incident evidence unless you grant time-bound access for a stated task
  • Close incidents as reviewed on your behalf
Approvals
Every change is approved by your policy owner and peer-reviewed by a second Moraph engineer before it is applied.
Notified about
Approved changes ready to apply, channel or server health alerts and Forcepoint product notices.

Moraph security analyst

Moraph security operations analyst

Works the incident queue so your team sees only the incidents that need a decision.

Sees

  • Incident metadata: user, policy, channel, destination and justification
  • Incident evidence, only where your organization permits Moraph triage of it
  • Triage runbooks and escalation contacts

Does

  • Reviews and groups incidents
  • Closes false positives with a reason
  • Escalates incidents to your reviewers with a summary
  • Feeds false-positive patterns back to the DLP engineer

Cannot

  • Decide on staff conduct or notification
  • Change policies
  • Export incident evidence
Approvals
Closures are sampled by your policy owner at the monthly review.
Notified about
New incidents by severity and responses to escalations.

Auditor or examiner (read-only)

Internal auditor, external auditor, regulatory examiner (under temporary access)

Reviews the DLP program's policies, incidents and decisions without changing anything.

Sees

  • Policies in force and their version history
  • Incident records and outcomes within the scope granted
  • Monthly service reports and coverage reports

Does

  • Reads and searches records within their scope
  • Exports reports they have been given access to, with each export logged

Cannot

  • Change, close or delete anything
  • See incident evidence unless specifically granted
  • Keep access after it expires
Approvals
Their access is approved by the policy owner, with a scope and an end date.
Notified about
Nothing by default.

Permissions at a glance

ActionPolicy ownerComplianceReviewerIT adminMoraph engineerMoraph analystAuditor
Propose a policy changeFullFullNo accessNo accessFullFullNo access
Approve a policy changeApprovesNo accessNo accessNo accessNo accessNo accessNo access
Move a policy from audit to blockApprovesNo accessNo accessNo accessNo accessNo accessNo access
Apply policy changesNo accessNo accessNo accessNo accessFullNo accessNo access
Approve an allowed business routeApprovesView onlyNo accessNo accessNo accessNo accessNo access
Triage and close false positivesView onlyNo accessNo accessNo accessNo accessFullNo access
Investigate escalated incidentsFullView onlyOwn work onlyNo accessNo accessNo accessNo access
View incident evidenceFullFullOwn work onlyNo accessNo accessNo accessNo access
Record a notification decisionView onlyFullNo accessNo accessNo accessNo accessNo access
Deploy and maintain agentsView onlyNo accessNo accessFullView onlyNo accessNo access
View reports and coverageView onlyView onlyOwn work onlyView onlyView onlyView onlyView only
View audit trailView onlyView onlyNo accessNo accessView onlyView onlyView only
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Moraph proposes and applies policy changes, but only your policy owner can approve them, and nothing moves from audit to block without that approval.
  • Incident evidence can contain the Social Security or card numbers that triggered it, so access to it is limited to the roles you name; Moraph analysts triage from incident details unless you choose otherwise.
  • Console roles follow groups in your directory, and reviewers can be limited to the business units they are responsible for.
  • Every policy change, incident decision and evidence view is recorded with the person and time, and auditors get temporary read-only access with a scope and an end date.

Features

What it does

Social Security number detection

Forcepoint classifiers configured to find Social Security numbers in documents, email and uploads, tuned to reduce matches on numbers that only look similar.

Payment card number detection

Forcepoint detects primary account numbers using pattern matching with checksum validation, so random strings of digits are less likely to trigger.

Your own data identifiers

Account number formats, member numbers and customer files fingerprinted so Forcepoint recognizes data specific to your institution.

Endpoint enforcement

The Forcepoint endpoint agent applies policy to removable media, printing, browser uploads and other endpoint channels you choose.

Network enforcement

Policies applied to outbound email and web traffic through Forcepoint's network components or your existing gateways.

Graduated actions

Each policy can audit, warn the user, require a business justification or block, and moves between them only with your approval.

Staged rollout

Policies tested in audit mode and on pilot groups before they block anyone, with the expected impact shown first.

Managed incident triage

Moraph analysts review incidents, close false positives with a reason and escalate the rest to your reviewers.

Policy version record

Every policy, classifier and action change kept with its reason, test result and approver.

Agent coverage monitoring

Endpoints missing an agent, running an old version or not reporting are listed for your IT team to fix.

Restricted evidence access

Incident evidence, which can include the sensitive data itself, is visible only to the roles you approve.

Exam-ready reporting

Policies in force, incidents and outcomes for a chosen period, exportable for internal audit and examiners.

Integrations

How it connects to your systems

Connects toHowWhat flows
Your directoryUser and group information from your directory so policies can apply by group and incidents show the user's department and manager.In: users, groups and organizational attributes.
Email gatewayOutbound email inspected by Forcepoint, either through its own components or alongside the gateway you already run.In: outbound messages and attachments for inspection. Out: allow, quarantine or block decisions.
Web proxyWeb uploads inspected through Forcepoint's web components or an existing proxy that supports content inspection.In: outbound web uploads for inspection. Out: allow or block decisions.
Endpoint managementAgent packages deployed and updated through the software distribution tools your IT team already uses.Out: agent packages and configuration. In: deployment status.
Your SIEMDLP incidents forwarded to your security information and event management tool for correlation with other alerts.Out: incident records, without evidence content unless you choose otherwise.
IT service managementEscalated incidents, change requests and agent issues raised in your ticketing system.In and out: tickets, approvals and status.
Moraph managed servicesCoordinated with Moraph's Mobile Device Management, Secure File Transfer or Public Cloud Infrastructure services where you use them, so allowed routes for sensitive data are consistent.Out: allowed routes and policy scope, as agreed.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Your reviewers sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Configuring policies, triaging incidents and seeing evidence are separate roles, granted only as you approve.

Encryption and keys

Incident data held by the service is encrypted, and Moraph staff cannot reach it without your explicit, time-bound authorization.

Complete audit trail

Every policy change, incident decision and evidence view is logged with the person and time, and cannot be edited.

Tested changes

Moraph's own configuration tooling and scripts pass security testing gates before release, and a software bill of materials is kept for them.

Data residency

Incident data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

10 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Operational

Incident queue

For moraph analysts and your reviewers

Open incidents with severity, policy, channel, user and age, and who holds each one.

Break down by
Severity, Policy, Channel, Business unit, Age
Delivered as
Live dashboard
Used for
Making sure every incident is triaged and escalations are answered.

Agent coverage

For iT endpoint team and policy owner

Endpoints with a current agent, an old version, no recent check-in or no agent at all.

Break down by
Status, Agent version, Device group, Location
Delivered as
Live view; CSV export
Used for
Closing gaps where policies cannot be enforced.

Blocks and justifications

For policy owner and business managers

Transfers blocked or allowed with a business justification, and the justification given.

Break down by
Policy, Channel, Business unit, Action
Delivered as
Live dashboard; scheduled email
Used for
Spotting workflows that need an allowed route and justifications that need review.

Tuning

False-positive sources

For policy owner and Moraph DLP engineer

Incidents closed as false positives by policy, classifier and cause.

Break down by
Policy, Classifier, Closure reason, Period
Delivered as
Live dashboard; CSV export
Used for
Deciding what to tune next.

Audit-mode impact

For policy owner

For policies still in audit mode, what would have been blocked and for whom, if the policy were enforcing.

Break down by
Policy, Channel, Business unit
Delivered as
Live view; PDF export
Used for
Approving a move from audit to block with the impact understood.

Management

Monthly service report

For policy owner, compliance, IT leadership

Incidents, outcomes, escalations, policy changes, coverage and platform health for the month.

Break down by
Period, Channel, Business unit
Delivered as
PDF; reviewed in the monthly meeting
Used for
Governing the service and setting priorities.

Sensitive data movement

For cISO and risk committee

Where Social Security and card numbers are leaving the institution, by channel and destination type, and how much was blocked or allowed.

Break down by
Data type, Channel, Destination type, Period
Delivered as
PDF; live dashboard
Used for
Reporting data protection risk to management and the board.

Regulatory and audit

Policies in force

For internal audit and examiners

Each policy with its data types, channels, action and the version and approval history.

Break down by
Policy, Channel, Action, Approval date
Delivered as
Live view; PDF export
Used for
Showing what safeguards are applied to customer information in transit.

Escalated incident register

For compliance and auditors

Incidents escalated as possible exposure, the reviewer's findings and the notification decision.

Break down by
Outcome, Data type, Notification decision, Period
Delivered as
Live view; PDF and CSV export
Used for
Evidencing that possible exposures were investigated and decided.

Audit trail extract

For internal audit and examiners

Who changed a policy, closed an incident or viewed evidence, and when, for a selected period.

Break down by
User, Action, Record, Date range
Delivered as
On request; CSV and PDF export
Used for
Answering audit requests without assembling evidence by hand.

Exports, access and evidence

  • Reports are built from Forcepoint incident and policy data and from Moraph's triage and change records.
  • Every report can be exported to CSV, and summary and evidence reports to PDF; the monthly service report is reviewed with you in a meeting.
  • Incident records can be forwarded to your SIEM or data platform, without evidence content unless you choose to include it.
  • Reports respect each viewer's role: reviewers see their business units, the policy owner sees the whole program, and evidence content never appears in summary reports.
  • Evidence reports can be run for a past period, and running or exporting a report is itself recorded.

Deployment

Where and how it runs

Forcepoint-hosted components

Where you use Forcepoint's hosted options, Moraph configures and runs them; Forcepoint operates the hosting.

Components on your infrastructure

Management and network components installed in your data center or cloud account, operated by Moraph under the service agreement.

Existing deployment

Where you already own Forcepoint, Moraph takes over its operation and tuning without a fresh installation.

With other Moraph services

Run alongside Moraph's Mobile Device Management, Secure File Transfer or Public Cloud Infrastructure services.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Scoping

We agree the data types, channels, users and locations in scope, and review any existing Forcepoint deployment. We need contacts from security, compliance and your endpoint team.

Platform setup

Forcepoint management components, network channel integration and directory connections are configured, or an existing deployment is taken over.

Agent rollout

Endpoint agents are packaged and tested with your IT team, then deployed in waves with coverage tracked.

Discovery in audit mode

Policies run in audit mode so legitimate data flows can be found and documented as allowed routes before anything is blocked.

Enforcement by stages

Tuned policies move to warn or block on a pilot group and then wider, each step approved by your policy owner.

Triage handover

Escalation routes, reviewer roles and runbooks are agreed, staff communications are prepared, and Moraph's analysts take over the incident queue.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not Forcepoint. Forcepoint's own service commitments, support terms, roadmap and outages apply to the platform, and Moraph cannot change them.
  • Licences bought through Moraph remain subject to Forcepoint's licence terms.
  • DLP reduces the chance of sensitive data leaving; it cannot stop every route, such as photographs of a screen or data typed out by hand.
  • Policies are only enforced on endpoints with a working agent and on network traffic routed through the inspection points.
  • Encrypted or password-protected files may not be inspectable; how they are treated is a policy decision you make.
  • Decisions about staff conduct, breach determination and customer or regulator notification remain with your organization.
  • Mobile devices and cloud applications are outside this service unless covered by separate policy or another Moraph service.
  • Moraph supports your PCI DSS and other assessments with evidence; it does not certify your environment.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Send test messages and uploads with fictional Social Security and card numbers and see what is caught and how the user is told
  2. Review the audit-mode impact report for a policy before approving it to block
  3. Walk through an incident from detection to escalation and outcome
  4. Check who can see incident evidence and how that is controlled
  5. Review agent coverage reporting against your device inventory
  6. Review the responsibilities table with your third-party risk team

Questions

Frequently asked questions

Will this block legitimate work?

Policies start in audit mode, legitimate flows are documented as allowed routes, and nothing blocks until your policy owner approves it after seeing the expected impact.

Can Moraph see our customers' data in incidents?

Only if you choose. By default Moraph analysts triage from incident details, and evidence content is limited to the roles you name.

We already own Forcepoint. Can you run it?

Yes. Moraph can take over an existing deployment, review its policies and coverage, and tune it rather than reinstalling.

Does it cover mobile phones?

Not by itself. Corporate data on mobile devices is handled through Moraph's Mobile Device Management service, and the two can share allowed routes.

How is it priced?

Forcepoint licences are priced under Forcepoint's terms, usually by users or devices, and the managed service by the scope of channels and users operated. See Working with Moraph for what drives a quotation.

Who decides whether an incident is a breach?

Your organization. Moraph provides the incident record and evidence; breach determination and notification are your decisions.

Next steps

Evaluate Data Loss Prevention

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Data Loss Prevention guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Data Loss Prevention support guide.

Related products