The problem I kept seeing
Endpoints leak quietly: files to USB, clipboard paste, a screenshot at the wrong moment. Dashboards that only show “blocked” miss the investigation story.
Design belief
Blocking-first rollouts fail. People turn the agent off. Monitor → alert → block is slower to demo and more honest to operate.
What “enterprise DLP” meant here
Managed Windows endpoints, centralized events, sensitive-data detection, device control, and a dashboard an analyst can actually use.
What I would not invent
Production KPIs, fake customer counts, or “deployed at scale” claims. Architecture + local validation first.