A coverage gap is a surface a security control does not inspect. A silent coverage gap produces no signal, on a dashboard it is indistinguishable from having nothing to report, which is why it is the more dangerous failure.
The core problem
A console showing no violations means one of two things.
One: nothing sensitive was submitted. Excellent.
Two: the capture layer stopped working three weeks ago, when the AI tool shipped a redesign and a selector stopped matching.
A dashboard that cannot distinguish these is worse than no dashboard, because it converts an outage into confidence.
Why AI monitoring is prone to it
Most capture layers depend on the structure of someone else’s web application.
When a vendor redesigns their composer, hooks unbind. No error is raised: there is simply nothing to report, from a component that is still running, still reporting healthy, still installed.
Deploy-and-forget is not viable here. The upstream surface changes without notice and without a changelog.
Making gaps loud
The mechanisms that help, roughly in order of value.
Binding verification
The capture layer checks on each page load that its hooks are attached to the live composer. Installed and binding are different facts and should be different fields.
Synthetic canaries
Scheduled benign submissions with known test patterns, confirming the whole path is alive end to end. A canary that stops arriving is an alert.
Published gap lists
A gap a customer knows about is a risk they can size. A gap they do not is an incident waiting for someone else.
Degradation as a metric
Where a control fails open under load, the rate of fail-open events is itself a service level. Silent fail-open is how a system reports perfect health while protecting nothing.
What to ask a vendor
Start with the question that can end the evaluation.
- 01
What surfaces do you not cover?
If the answer is “none”, end the evaluation.
- 02
How do I tell working-and-quiet from broken-and-quiet?
If the console cannot, neither can you.
- 03
What happens when a monitored site redesigns?
Specifically: how fast do you know, and how do I find out?
- 04
Does the console distinguish “nothing found” from “we ran out of time”?
Those are different events that look identical in most products.
Questions
How is a coverage gap different from a gap in policy?
A policy gap is a decision nobody made. A coverage gap is a surface the control cannot see at all, so no policy applied to it would have any effect. The second is worse, because the console reports nothing either way.
Why is a silent gap more dangerous than a known one?
Because quiet because nothing was found and quiet because nothing was watched look identical in a dashboard. A team that cannot tell them apart stops looking, which is the point at which the gap becomes an incident rather than a limitation.
How do I find the gaps in a product we already run?
Ask which surfaces it does not cover and insist on a list. If the answer is none, end the evaluation: every device-based control has a boundary, and a vendor who will not name theirs has not thought about it or is not telling you.
Can a gap be closed by buying another tool?
Sometimes, and sometimes the tools overlap without covering the gap between them. Endpoint DLP, a CASB and a web gateway can all be deployed and a prompt still falls between all three, because each inspects a different unit.
What does per-surface reporting actually give you?
The ability to answer which of the two silences you have. Coverage reported per device and per surface, in states rather than as a single number, is what turns an unknown into a known limitation you can plan around.
Is a gap the same as a bypass?
No. A bypass is somebody deliberately routing around a control that works. A gap is the control never having been able to see that route. A bypass shows up in the logs as a change in behaviour; a gap shows up as nothing at all.
Keep reading
- The comparison AI DLP vs CASB vs endpoint DLP What a CASB, endpoint DLP and a web gateway each inspect, and the surface that falls between all three. 6 min read
- Product Surface coverage An honest coverage matrix for AI DLP: which surfaces Itzal inspects, which it doesn't. Product page
- Product Deployment Signed installers through Intune, Jamf, Kandji or Ansible, browser extension by policy. Product page
- Glossary AI DLP Data loss prevention applied to the prompt layer, and why files, email and network traffic are the wrong place to look. 4 min read