Binding checks
The extension verifies on every page load that its hooks are attached to the live composer. An unbinding after a redesign raises a coverage incident, not a quiet drop in detections.
The failure mode
Zero detections and perfect coverage look identical on a dashboard.
The most dangerous state for a DLP product is not a missed detection. It is a silent coverage gap: a console showing green, no violations, and a security team that believes it is protected — while the capture layer quietly stopped working three weeks ago, when the AI tool shipped a redesign.
Two rules follow from that, and they govern the whole product.
Rule one
Coverage is measured, not assumed.
Every capture path reports whether it is currently binding — not merely whether it is installed.
Rule two
Uncovered is visible.
Anything Itzal does not see is enumerated — on this page, and in your console.
A customer sizing their other controls around our claim deserves an accurate claim. A coverage page that only lists strengths is a page that causes an incident at someone else’s company.
The matrix
Every surface, and where it stands.
Thirteen rows, four of them bad news. The two marked top gap are where we believe most real leakage happens today, which is why they are named rather than omitted.
| Surface | How | Status | What limits it |
|---|---|---|---|
| Web AI chat — supported sites | Browser extension | Primary | Selector drift when a site redesigns |
| Web AI chat — unsupported sites | — | Uncovered | Needs unknown-tool discovery |
| File attachment / upload | — | Uncovered — top gap | See 01 below |
| Image paste / screenshot | — | Uncovered — top gap | See 02 below |
| Desktop AI apps | Local proxy, opt-in | Partial | Certificate pinning; opt-in only |
| Coding assistants | — | Uncovered | A separate capture problem |
| LLM API calls from internal tools | Local proxy, opt-in | Partial | Opt-in only |
| AI in productivity suites | — | Uncovered | No composer to hook |
| Browsers outside managed Chrome / Edge | — | Uncovered | Firefox, Safari |
| Incognito / private windows | Extension, if explicitly allowed | Usually uncovered | Policy-dependent |
| Clipboard into any app | Clipboard watcher, opt-in | Low-fidelity fallback | Noisy without a destination |
| Mobile — iOS and Android | — | Uncovered | — |
| Personal / unmanaged devices | — | Out of scope by design | A boundary, not a gap |
“Out of scope by design” is not a gap. Personal and unmanaged devices are a boundary we chose, and a product that quietly reached onto them would be a different and worse product.
The gaps that matter
What we are missing, and what closing it takes.
Naming a gap is easy. These are written with the actual engineering cost attached, so you can judge how seriously to take the roadmap.
-
01
File attachments — the biggest one
The extension watches the composer text area. It does not see a dragged-in spreadsheet, and in practice this is where the real leakage is — nobody types five thousand customer records into a chat box, they attach the export. Closing it means intercepting drop, paste and file-input events, extracting text locally from CSV, XLSX, DOCX, PDF and JSON, and running the normal detection path under a size and time budget. Structured files are actually easier than prose: a column headed
SSNover 500 rows is a near-certain hit, reported as one finding with a count rather than 500 findings. Blocking mid-upload is the hard part, because some sites begin uploading on drop rather than on send. -
02
Pasted images and screenshots
A screenshot of a patient list is invisible to text detection. Three options, in order of cost: policy without inspection — warn or block on any image paste to an unsanctioned tool, which is cheap, honest and surprisingly effective; on-device OCR, realistic using platform APIs but adding 100 ms to a second, so it is a log-after-send path and never a blocking one; or nothing, documented. Pick one per tenant. The failure to avoid is implying image coverage you do not have.
-
03
Coding assistants
Source code with embedded secrets, customer data in test fixtures and proprietary logic flow to Copilot and Cursor continuously, and none of it passes through a browser composer. It is a genuinely different capture problem, and it gets its own solution rather than a footnote claiming coverage.
-
04
Tools nobody has heard of yet
A new AI product launches, an employee finds it, and it is by definition not in the supported-site list. Unknown-tool discovery — flagging submissions to hosts that look like AI chat interfaces but are not recognised — turns an unbounded gap into a queue an administrator can triage.
Proof, not assertion
How coverage is proven.
Synthetic canaries
Scheduled benign submissions containing known test patterns confirm the whole path — capture, detect, redact, upload — is alive end to end.
Deadline-exceeded rate
If detection routinely misses its budget and downgrades to log-after-send, protection has degraded even though detections still appear. It is tracked as a service level, not a footnote.
Coverage state in the console
Per surface, per device — so “we see nothing” and “we saw nothing” are visually distinct rather than the same green tile.
Sizing the rest
Itzal is one control, not a perimeter.
Size the rest of your stack against the matrix above. Endpoint DLP still owns file egress to removable media and email. Your CASB still owns sanctioned-SaaS posture. Browser policy still owns whether unmanaged browsers are permitted at all.
Anyone telling you one agent covers all of that is describing a product that does not exist. See what Itzal actually does.