Data Loss Prevention

Principal workflows

• Discover: Before blocking anything, Moraph configures Forcepoint to watch the channels in scope and learn where sensitive data actually moves.
• Enforce: Once a policy is tuned, your organization approves moving it from audit to warn or block, channel by channel.
• Triage: Moraph analysts work the incident queue, close false positives with a reason, and send real incidents to the people at your institution who decide on them.
• Improve: Each month Moraph reviews incidents, coverage and tuning with you and proposes the next policy changes.

Who uses it

• Banks, credit unions, lenders and investment firms that handle Social Security and payment card numbers
• CISOs and security teams who own data protection controls
• Privacy, compliance and fraud teams who decide what happens after an incident
• IT teams who deploy and maintain endpoint agents
• Internal audit and examiners reviewing safeguards for customer information

Reporting

• Open incidents by severity, policy and channel
• Agent coverage and health
• False-positive sources for tuning
• Impact of audit-mode policies before they block
• Escalated incidents and notification decisions
• Policies in force with their approval history

Features

• Social Security number detection: Forcepoint classifiers configured to find Social Security numbers in documents, email and uploads, tuned to reduce matches on numbers that only look similar.
• Payment card number detection: Forcepoint detects primary account numbers using pattern matching with checksum validation, so random strings of digits are less likely to trigger.
• Your own data identifiers: Account number formats, member numbers and customer files fingerprinted so Forcepoint recognizes data specific to your institution.
• Endpoint enforcement: The Forcepoint endpoint agent applies policy to removable media, printing, browser uploads and other endpoint channels you choose.
• Network enforcement: Policies applied to outbound email and web traffic through Forcepoint's network components or your existing gateways.
• Graduated actions: Each policy can audit, warn the user, require a business justification or block, and moves between them only with your approval.
• Staged rollout: Policies tested in audit mode and on pilot groups before they block anyone, with the expected impact shown first.
• Managed incident triage: Moraph analysts review incidents, close false positives with a reason and escalate the rest to your reviewers.
• Policy version record: Every policy, classifier and action change kept with its reason, test result and approver.
• Agent coverage monitoring: Endpoints missing an agent, running an old version or not reporting are listed for your IT team to fix.
• Restricted evidence access: Incident evidence, which can include the sensitive data itself, is visible only to the roles you approve.
• Exam-ready reporting: Policies in force, incidents and outcomes for a chosen period, exportable for internal audit and examiners.

Integrations

• Your directory: User and group information from your directory so policies can apply by group and incidents show the user's department and manager.
• Email gateway: Outbound email inspected by Forcepoint, either through its own components or alongside the gateway you already run.
• Web proxy: Web uploads inspected through Forcepoint's web components or an existing proxy that supports content inspection.
• Endpoint management: Agent packages deployed and updated through the software distribution tools your IT team already uses.
• Your SIEM: DLP incidents forwarded to your security information and event management tool for correlation with other alerts.
• IT service management: Escalated incidents, change requests and agent issues raised in your ticketing system.
• Moraph managed services: Coordinated with Moraph's Mobile Device Management, Secure File Transfer or Public Cloud Infrastructure services where you use them, so allowed routes for sensitive data are consistent.

Deployment

• Forcepoint-hosted components: Where you use Forcepoint's hosted options, Moraph configures and runs them; Forcepoint operates the hosting.
• Components on your infrastructure: Management and network components installed in your data center or cloud account, operated by Moraph under the service agreement.
• Existing deployment: Where you already own Forcepoint, Moraph takes over its operation and tuning without a fresh installation.
• With other Moraph services: Run alongside Moraph's Mobile Device Management, Secure File Transfer or Public Cloud Infrastructure services.

Security and privacy

• Single sign-on: Your reviewers sign in through your identity provider, so your password and multi-factor policies apply.
• Role-based access: Configuring policies, triaging incidents and seeing evidence are separate roles, granted only as you approve.
• Encryption and keys: Incident data held by the service is encrypted, and Moraph staff cannot reach it without your explicit, time-bound authorization.
• Complete audit trail: Every policy change, incident decision and evidence view is logged with the person and time, and cannot be edited.
• Tested changes: Moraph's own configuration tooling and scripts pass security testing gates before release, and a software bill of materials is kept for them.
• Data residency: Incident data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Limitations

• Moraph is not Forcepoint. Forcepoint's own service commitments, support terms, roadmap and outages apply to the platform, and Moraph cannot change them.
• Licences bought through Moraph remain subject to Forcepoint's licence terms.
• DLP reduces the chance of sensitive data leaving; it cannot stop every route, such as photographs of a screen or data typed out by hand.
• Policies are only enforced on endpoints with a working agent and on network traffic routed through the inspection points.
• Encrypted or password-protected files may not be inspectable; how they are treated is a policy decision you make.
• Decisions about staff conduct, breach determination and customer or regulator notification remain with your organization.
• Mobile devices and cloud applications are outside this service unless covered by separate policy or another Moraph service.
• Moraph supports your PCI DSS and other assessments with evidence; it does not certify your environment.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/data-loss-prevention. Purchasing routes and company information: www.moraph.com/how-to-buy.