We documented how the explosive growth of ChatGPT was yet another blow to traditional, perimeter-based security

This year, we reported on how the growth of ChatGPT was resulting in the egress of confidential data from secure environments and onto the open internet. Our labs identified this trend ahead of press from major companies signaling that they would ban the tool internally. We found that on average, companies were leaking sensitive material into ChatGPT hundreds of times per week. Detecting such data is challenging, since confidential information could be anything from customer data (which has a pattern) to text ripped from a board presentation (which may not have a pattern). This story highlighted the urgency companies are experiencing as legacy data protection solutions struggle to keep up with new types of egress vectors.

We gained strategy and insight from our CISO Series guests

We launched our CISO Series webinars where we spoke with C-level security executives about the structure of their security function, and how they’re approaching novel challenges this year, like generative AI adaption and board reporting in the face of the SEC’s new disclosure rules. From each discussion, some of the core themes that emerged were:

• The importance of communication with stakeholders outside of security. This was something that everyone—Dan Walsh, Adam Shostack, Eric Johnson, Prabhath Karanth, and Mark Settle—spoke to. Whether it’s in the context of working with legal and risk to build generative AI policy, or educating employees about changes in best practices and policy, the security function needs to continue to engage stakeholders to enable good policy and best practices throughout the organization.
• Clear and frequently updated cost-benefit analyses are crucial to security’s function. Another theme that emerged from our discussions with everyone was how crucial it was to have a clear, well-framed understanding of risk from a cost-benefit perspective. Security is ultimately in the business of enabling the business in the safest way possible, meaning that it’s important for both the security function and the broader organization to understand the tradeoffs involved with security policy and technology adoption. It’s the security team’s job to illustrate what these tradeoffs look like in a clear and consistent manner.
• There’s an opportunity to lean into AI to help enable security. Something that several guests were bullish on was the potential for AI to play a role in reducing risk and enabling security within the organization. Security leaders will have to be thoughtful, however, about the particularities of their organization, as this will influence the type of support that AI-augmented solutions can provide. Whether it’s improving data classifications or allowing analysts to more efficiently sift through findings, or something else entirely, will depend on the specific needs of your security program.

We learned specifics about building a modern DLP program from our Data Security Innovators

In tandem with the CISO series, we launched a program titled Data Security Innovators (DSI), where we spoke to security leaders about more tactical aspects of their security program, and how they’re leveraging new technologies to build policies and procedures within their programs to enable data security for their organizations. Some shared lessons from these discussions include:

• The role of security as an enabler of business function. As with our CISO Series, many of our featured data security innovators highlighted the importance of being an enabler to the business. This means making communication a core pillar of the security function, in order to receive feedback from employees who are affected by security policies to address their concerns and minimize the impact of security processes on productivity.
• The challenges of enabling data classification with traditional tools. All of our DSI guests spoke directly to the challenges of leveraging legacy data loss prevention for data classification, as classification schemes are pretty brittle and terrible at capturing context or how data is actually used in their environments. The result is a lot of lost time and efficiency triaging false alerts, rather than developing a genuine understanding of what is happening in their organization.
• Data lineage is empowering new ways of classifying and enabling security. Another theme of our discussions revolved around how next-generation tools are enabling security teams to have access to the data lineage of data in their environments. This data lineage allows security teams to see the context surrounding every sensitive finding, letting them have more robust classification of data on the basis of its location, how it’s being used, who accessed it, its source, in addition to its content. Our guests detailed how they’re building detailed DLP policies, audit reports, employee educational opportunities and more leveraging data lineage.

We’re helping design modern security best practices Comprehensive Cyber Capabilities Working Group

Earlier in the year, we took part in the launch of the Comprehensive Cyber Capabilities Working Group (C3WG) which released version 2.0 of the Data Security Maturity Model (DSMM) in June. The DSMM provides a data-centric approach to protecting business-critical assets and is informed by, and compatible with, notable industry standard frameworks like the NIST Cybersecurity Framework (CSF).

We spoke on important trends in the industry

We got lots of press coverage this year, speaking on generative AI trends, layoff trends, the complications of the SEC’s new rules, and highlighting how CISOs are adopting to new technologies.

We reported on the 7 major trends affecting DLP adoption

In a report on seven major trends impacting DLP adoption, we highlighted how post-pandemic transformations like hybrid work and layoffs are requiring better and more extensive ways to monitor the egress and movement of data to better manage risk. For a comprehensive insight into these trends, read the full report here.

We broke records and set new milestones

This year, we received multiple awards and acknowledgements, including making Fortune Magazine's Cyber 60 list, being named a Gartner Cool Vendor, and making Inc Magazine’s best places to work list.

To 2024 and beyond!

We’re proud of all the work our team accomplished this year. Heading into 2024 we aim to build on the work we’ve produced to empower security practitioners everywhere and serve as a leader in data security!