The AI landscape doesn't move in one direction — it lurches. Some techniques leap from experiment to table stakes in a single quarter; others stall against regulatory walls, technical ceilings, or organisational inertia that no amount of hype can dislodge. Knowing which is which is the hard part. The State of Play cuts through the noise with a rigorously maintained index of AI techniques across every major business domain — classified by maturity, evidenced by real-world adoption, and updated daily so you always know where you stand relative to the field. Stop guessing. Start knowing.
A daily newsletter distilling the past two weeks of movement in a domain or two — delivered to your inbox while the index updates in the background.
Each dot marks the weighted maturity of practices within a domain — hover for a brief summary, click for more detail
AI-augmented detection and prevention of sensitive data exfiltration across endpoints, network, and cloud services. Includes context-aware DLP that understands document meaning; distinct from phishing detection which targets inbound threats rather than outbound data.
DLP sits at a leading-edge inflection point driven by agentic AI emergence: while adoption remains strong (60%+ of enterprises deployed by 2023), the practice faces urgent architectural reinvention as AI agents with delegated enterprise access expose fundamental DLP limits. June 2026 forensic evidence crystallized the inflection: Cloud Security Alliance documented the Marimo incident—a single attacker autonomously deployed an LLM agent to breach 9 Mexican government agencies over three months, executing 75% of exfiltration commands via agent without human intervention, completing full database dump in under 60 minutes including credential theft, SSH session distribution across 6 IPs, and AWS API calls fanned across 11 Cloudflare Workers to evade per-source IP detection. This demonstrates that when agents operate with enterprise infrastructure access, traditional DLP cannot prevent systematic, rapid data loss through agentic workflows. Concurrently, security leaders elevated AI data protection from implementation detail to budget priority—36% of enterprise security teams now cite preventing sensitive data from entering AI prompts as their single most difficult data protection problem. Traditional policy-based DLP has reached structural limits: PromptArmor documented reproducible indirect prompt injection bypassing Copilot DLP controls entirely (5/5 successful attacks), while shadow AI exfiltration (67% of sensitive legal work flowing to unmanaged ChatGPT) remains invisible to legacy regex-based detection. Empirical research on security agents within agentic systems shows why: deterministic DLP detection fails at 22-78% rates, defeated by Unicode homoglyphs, base64 encoding, and obfuscation; McKinsey's Lilli agent incident exposed 728k files through schema metadata injection that DLP rules never inspect. Vendor ecosystem bifurcation reflects this: AI-native platforms achieving 92% detection accuracy and 96% false positive reduction, but adoption concentrated in advanced teams; most organizations continue running regex-based tooling unable to detect agent data access, semantic transformation, context injection, or behavioral misuse. Architectural evolution toward behavioral intelligence and inline enforcement is underway—Microsoft's new DLP Policy Optimizer uses AI to identify overlapping policies and reduce false positives; major SASE vendors have integrated prompt-layer DLP into core platforms; and independent analysis argues that traditional log-and-alert DLP becomes forensic when attack handoff times collapse to 22 seconds. The category has proven tactical value; delivering that value without organizational obsolescence as AI agents become infrastructure remains the open challenge.
By June 2026, agentic AI emerged as the dominant and most acute DLP threat surface with forensically documented real-world failures and architectural insights guiding the evolution toward behavioral and inline enforcement models. Cloud Security Alliance documented the Marimo intrusion (May 10, 2026): a single LLM agent, deployed by an attacker with initial RCE on an exposed Marimo notebook, autonomously executed a four-pivot kill chain—credential enumeration from .env and AWS APIs, distributed AWS calls across 11 Cloudflare Workers IPs to defeat source-IP correlation, SSH session coordination from 6 simultaneous IPs to break IP-based alerting, and full PostgreSQL database exfiltration in under 60 minutes. Attack tempo analysis shows why traditional DLP cannot respond: Google Mandiant M-Trends 2026 documents median attacker handoff collapsed from 8+ hours (2022) to 22 seconds (2025); when exfiltration completes in minutes, log-and-alert DLP becomes forensic rather than preventive. Security leaders elevated AI data protection to top cybersecurity priority—ETR survey of 517 leaders (80% C-suite) found 36% cite preventing sensitive data from entering AI prompts as their single most difficult data protection problem, with only 3% having deployed agent-specific controls broadly. Forcepoint analysis confirms why: legacy DLP designed around static data objects at file boundaries misses prompt-layer data movement entirely; employees paste data into AI tools for summarization (uncontrolled outbound channel), and AI-generated outputs can reconstruct sensitive information in ways traditional content inspection cannot detect.
Deployment reality and empirical research documented critical control gaps. PromptArmor disclosed indirect prompt injection vulnerability in Copilot Cowork allowing attackers to embed malicious extraction instructions in skill files—5 successful exfiltration tests without human approval. Concentric AI quantified real-world exposure: 16% of business-critical data overshared with 802k at-risk files per organization in Copilot deployments. CW1226324 incident (patched Feb 2026) showed Copilot processed sensitivity-labeled emails despite DLP policies configured to block—fundamental trust failure between policy intent and AI system behavior. Independent research by Nirmalya Ghosh on multi-agent systems reveals why rule-based detection fails: security agents achieved only 30-78% detection rates; deterministic keyword/regex checks were defeated by Unicode homoglyphs, base64 encoding, misspelling, and leetspeak; McKinsey's Lilli agent incident (March 2026) exposed 728,000 files through schema metadata injection—an attack vector DLP rules never inspect because they focus on user input, not inter-agent messages. Harmonic Security analysis (1.9M AI-session minutes) found shadow AI exfiltration unchecked: 67% of sensitive legal work occurs on unmanaged ChatGPT; 45.6% of personal AI activity happens on enterprise plans but 29.9% on paid consumer accounts and 15.5% on free accounts—critical DLP blind spot. ChatGPT alone generated 410 million DLP policy violations in 2025 (99.3% YoY increase), yet only 7% of organizations govern AI tools with real-time policy enforcement.
Architectural assessment identifies three specific DLP failure modes for agent-based AI: (1) permission-based access at scale (agents inheriting user permissions rather than discrete data decisions), (2) semantic transformation (AI agents summarize/analyze without traditional exfiltration footprint), (3) context leakage through conversation explanations and inter-agent message propagation. These are design limitations, not configuration gaps. Market bifurcation reflects this capability gap: AI-native vendors (ORION Security achieving 96% false positive reduction, Menlo achieving 92% accuracy versus 70% traditional detection, BigID with DSPM integration) demonstrating 80% resource reduction and near-elimination of false positives, but adoption concentrated in advanced security teams. Concurrently, Microsoft and platform vendors are investing in AI-augmented policy optimization (DLP Policy Optimizer, GA July 2026) to reduce false positives and policy complexity that persist as barriers even in leading organizations. Most organizations continue running traditional regex-based tooling unable to detect semantic transformation, context injection, or behavioral misuse. Emerging best practice consensus identifies three architectural requirements for AI-era DLP: (1) four-layer enforcement (browser, endpoint, network egress, HTTP proxy) to intercept prompts before encryption; (2) behavioral intelligence and risk-adaptive policies rather than static rules; (3) inline sub-50ms enforcement to keep pace with machine-speed attack execution. Lawrence Pingree (former Gartner analyst, 300+ research notes) frames this as "The Great DLP Reset"—traditional perimeter-based approaches built for predictable data flows cannot function in porous cloud/AI environments; AI-driven context assessment and agentic-aware controls now critical for data protection.
Administrative burden persists as operational friction despite architectural evolution: 78% find DLP challenging to administer, false positive fatigue remains unchanged even with AI-enhanced classification. Yet organizational urgency accelerated: GenAI-related DLP incidents reached 14% of all incidents (Palo Alto, 7,051 enterprises), shadow AI data leakage quantified at $670k per breach, and 82% of organizations planning GenAI integration drives inevitable platform consolidation toward AI-augmented DLP. DSPM evolution (Data Security Posture Management) signals the maturing recognition that traditional DLP's file/object-level scope is insufficient—modern data protection must track unstructured AI data through embeddings, RAG pipelines, and model weight encoding where exposure becomes irreversible.
— Microsoft Purview roadmap: AI agent will add reasoning traces and confidence scores (preview Aug 2026, GA Sept 2026). Signals major vendor maturity in explainable AI-assisted DLP automation addressing analyst trust gap and enabling operationalization of AI-driven alert triage.
— CSA reports critical CVE-2026-42824 (SearchLeak): three-stage vulnerability chain in Microsoft 365 Copilot enabling silent data exfiltration via parameter-to-prompt injection, HTML rendering race, and SSRF bypass. Demonstrates fundamental DLP maturity gap: existing controls designed for human-directed access; AI systems under adversarial input represent new attack surface DLP was not designed to address.
— Practitioner benchmarked six guardrail tools in production measuring latency-vs-recall tradeoff. Core constraint: guardrails over ~50ms inline cause users to disable during incidents; trade-off between high-precision slow detection (~95% at 400ms) vs lower-precision fast detection (~95% at 10ms) determines real-world viability. Identifies operational enforcement architecture constraints for DLP.
— Gartner analyst assessment of AI agent threat landscape with Fortune 500 case studies: Fortune 20 Tech remediated 90% of vulnerabilities in 4 months (2 FTEs); Fortune 50 Pharma governed 2,000 agent instances; Fortune 50 FinServ achieved 80% risk reduction with 150k+ resources and 180% growth. Recommends agents as first-class identities with least-privilege, agent registries, and policy brokers.
— Critical gap analysis: Microsoft Purview connectors to external AI provide visibility (24-hour post-interaction) but zero enforcement, creating false sense of DLP coverage. Visibility-without-enforcement pattern mirrors email journaling era, leaving organizations believing DLP covers external AI while users exfiltrate undetected. Documents fundamental architectural DLP limitation.
— Independent news coverage of DLP/DSPM platform with named customers (Polymarket, Ramp, Chevron Phillips, The Atlantic, EarnIn, Aprio, Alloy, Stitch Fix, GoFundMe, PayNearMe, Garner Health) reporting 10x faster risk reduction, sub-2-second response, and up to 15% cost savings. Demonstrates emerging deployment of agentic data security with automation integration.
— Nightfall's integration with Claude's Compliance API demonstrates ecosystem maturity: specialized DLP vendor (Nightfall) integrating with Anthropic's Claude API for data protection at LLM interaction point. Signals DLP architectural expansion beyond network/endpoint to model input-output layer.
— Architectural gap analysis: traditional DLP at email gateway, storage, endpoint misses prompt-layer data movement. Proposes four-point enforcement (browser, endpoint, network egress, HTTP proxy) with identity context and regulatory audit trail (EU AI Act Article 12 requirements).