Endpoint DLP owns
Files leaving the device — removable media, email attachments, print, sync clients.
What each inspects
Four controls, four different units of inspection.
They sound overlapping in a procurement conversation and see almost nothing in common.
| Endpoint DLP | CASB | Secure web gateway | AI DLP | |
|---|---|---|---|---|
| Unit of inspection | Files, egress channels | SaaS connections | HTTP requests | Outbound text blocks |
| Sees a pasted prompt | — | — | After send | ✓ before send |
| Sees the destination | Partly | ✓ | ✓ | ✓ |
| Can block before submission | — | — | — | ✓ |
| Needs TLS interception | — | — | ✓ | — |
| Covers unsanctioned new tools | — | Weak | As a domain | As a destination |
| Inspects content without transmitting it | ✓ | — | — | ✓ |
Why each misses
The surface is outside the model.
Endpoint DLP was designed around documents: a file has a classification, and here are the channels through which files leave. A paste into a textarea is none of those. The data never becomes a file and never triggers a rule. The product is working correctly; the surface is outside its model.
CASB was designed around sanctioned SaaS. It reliably tells you that someone connected. It does not tell you the connection carried 400 patient records, because inline content inspection of an arbitrary web composer is not what it does.
Secure web gateways come closest and still miss on timing: they see the request after send, so the disclosure has already happened and only alerting remains. Certificate pinning and encrypted client hello steadily reduce what can be decrypted at all.
Layering
These are not substitutes.
The useful exercise is not choosing between them. It is writing down every surface where company data can reach an AI tool, naming the control that owns each, and being honest about which rows have no owner.
CASB owns
Sanctioned SaaS posture, OAuth grants and app discovery.
SWG and firewall own
Destination policy — which AI tools are reachable at all.
AI DLP owns
The content of what is typed into AI tools, and whether the destination is sanctioned.
One question worth asking every vendor in this space: where does classification physically execute? Several products marketing themselves as AI DLP achieve inspection by routing prompts through their own cloud. That is a real architecture with real benefits — and it means the content you were trying to protect is now processed by an additional third party. If the answer is “our cloud”, that is not disqualifying, but it belongs in your risk assessment alongside the original problem.
Straight answers
Why doesn’t our existing DLP catch data pasted into ChatGPT?
Endpoint DLP is built around files and egress channels — USB, email attachments, print, upload. Text typed or pasted into a browser textarea is not a file and does not traverse those channels, so it is outside what the product models.
Can a CASB block ChatGPT?
It can block or allow the destination and report that a connection happened. What it generally cannot do is see the contents of the composer, so it can tell you someone used the tool but not what they put into it.
Does a secure web gateway with TLS inspection solve it?
Partly, and after the fact. It sees the request only once it has been sent, so it cannot block a message before submission — and increasing certificate pinning and encrypted client hello reduce what it can decrypt.
Do we need to replace our existing controls?
No. These are complementary layers covering different surfaces. The practical exercise is mapping which control owns which surface, and identifying which surfaces nothing owns.