AI DLP tools compared: block vs redact vs pseudonymise
AI DLP tools differ most in what they do when they find sensitive data: block the request, redact the value, or replace it with a reversible pseudonym. Enterprise GenAI DLP products from Netskope, Zscaler, Palo Alto, Microsoft, Nightfall and Harmonic mainly block, warn or coach employees using AI apps. Shadow takes the third approach for API, agent and file traffic: it sends realistic fakes and restores the real values in the response.
Three ways to stop an AI data leak
Section titled “Three ways to stop an AI data leak”| Approach | What the model sees | User experience | Main risk |
|---|---|---|---|
| Block | Nothing; the request is refused | Task fails; user may be coached or asked to justify | People route around it (personal accounts, phones) |
| Redact | [REDACTED], <PERSON> or a masked value | Task runs with less information | Answers degrade; values can’t be restored |
| Pseudonymise (reversible) | A realistic stand-in: hui.zhao@zhilan.cn | Task runs normally; answer shows the real values | Depends on detection recall and vault security |
None of these is always right. Blocking is correct for data that must never be processed by an external AI at all. Redaction suits logs and analytics. Pseudonymisation suits everyday work where the answer needs to mention the real customer, colleague or account.
The main AI DLP tools
Section titled “The main AI DLP tools”| Tool | Where it runs | Block | Redact | Reversible | Streams | Files | Fleet management |
|---|---|---|---|---|---|---|---|
| Netskope One | SASE inline | Yes | Yes (mask, FPE, hash) | No | Redaction not for SSE | Not file content | Yes |
| Zscaler | SASE inline | Yes (also isolate) | Not documented | No | n/a | Uploads controlled | Yes |
| Palo Alto AI Access | SASE, Prisma Browser | Yes | Only in a community blog | No | n/a | Not documented | Yes |
| Microsoft Purview | Microsoft 365, Edge, endpoint | Yes (warn, audit) | No | No | n/a | Cannot scan files uploaded into prompts | Yes |
| Nightfall | Browser extension, endpoint agent | Yes | Yes | No | n/a | Uploads | Yes |
| Harmonic Security | Browser extension | Yes (warn, redirect) | Vendor-stated | No | n/a | Uploads | Yes |
| Prompt Security | Extension, gateway | Yes | Not verified | No | Not documented | Not documented | Yes |
| Lasso Security | Extension, gateway | Alert | Mask | Not documented | Not documented | Not documented | Yes |
| Strac | Extension, SaaS | Yes | Yes | Not documented | Not documented | SaaS stores | Yes |
| Shadow | Endpoint proxy, gateway, library | Optional (block for PDFs and images; secrets can be redacted) | Opt-in | Yes | Yes | DOCX/XLSX/PPTX in place, PDF to text | No central console |
Where enterprise AI DLP is strongest
Section titled “Where enterprise AI DLP is strongest”- Coverage of web chat. Browser extensions and SASE inspection see what employees type into ChatGPT, Gemini, Claude and Copilot web apps, including on unmanaged AI sites.
- Visibility and shadow-AI discovery. Which AI apps are in use, by whom, with what data.
- Central policy and reporting. One policy across thousands of devices, with audit logs, SIEM integration and incident workflows.
- User coaching. A pop-up that explains why a paste is risky changes behaviour over time.
- Existing investment. If you already run Netskope, Zscaler, Palo Alto or Microsoft 365 E5, adding GenAI controls may cost little extra.
Shadow does none of these. It has no console and no browser extension, and it does not see what people type into AI web apps such as chatgpt.com or claude.ai.
Where blocking and redaction fall short
Section titled “Where blocking and redaction fall short”- API and agent traffic. Developers, CI jobs and services call model APIs directly. Inline DLP built for browsers often does not inspect these well, and Netskope’s documentation explicitly excludes SSE streaming responses and MCP from redaction.
- Agents need real values back. If an agent’s tool call contains a redacted address, the action fails. Shadow restores tool-call arguments on your machine before the tool runs. See tool calls.
- Files. Several DLP products can block an upload but not transform it. Shadow masks Office documents in place so the model still gets the content.
- Answer quality. Placeholders strip meaning. Realistic, format-preserving fakes from a consistent persona keep prompts coherent.
How do I choose an AI DLP tool?
Section titled “How do I choose an AI DLP tool?”- Mostly employees in web chat, many managed devices? Start with your SASE or Microsoft 365 vendor, or a browser-first tool like Nightfall or Harmonic.
- Mostly developers, agents and services calling model APIs? Add a reversible layer like Shadow on those machines and containers.
- Both? Run both. Exclude the AI API hosts that Shadow handles from your SASE TLS inspection, or chain Shadow’s outbound traffic through your corporate proxy with
upstream_proxy, so the two do not fight over TLS. - Strict “never leaves” data classes? Use blocking for those, in either tool. In Shadow,
[policy.always] secret = "redact"and[files] pdf = "block"give hard stops.
Is Shadow a free alternative to enterprise AI DLP?
Section titled “Is Shadow a free alternative to enterprise AI DLP?”For API, agent, developer and file traffic on machines you control, Shadow is a free, open-source way to replace detected sensitive values before they reach AI providers while keeping answers useful. It is not a replacement for fleet-wide browser DLP, central reporting or user coaching. See the overview for the full landscape.
Sources
Section titled “Sources”- Netskope: redact sensitive data
- Zscaler: making generative AI safe
- Prisma Browser: GenAI prompt data controls
- Nightfall DLP for browsers
- Harmonic Security: browser-based GenAI security
- Lasso Security: contextual data protection
- Strac: ChatGPT DLP
Last reviewed: 2026-10-31. All product names are trademarks of their respective owners; this guide is based on public documentation as of the review date.
Frequently asked questions
What is AI DLP?
AI data loss prevention (AI DLP or GenAI DLP) stops sensitive data such as personal data, customer records, source code and secrets from reaching AI tools and model providers. Products do this by blocking the request, redacting the sensitive values, or replacing them with reversible pseudonyms.
Should an AI DLP tool block or redact?
Blocking is the simplest and safest for clearly prohibited data, but it breaks the task and encourages workarounds. Redaction lets the request through without the value but can make answers worse. Reversible pseudonymisation keeps answers useful by sending realistic stand-ins and restoring the real values in the response.
Which AI DLP tools can redact rather than block?
Netskope documents inline redaction with mask, format-preserving encryption or hash, excluding streamed responses, MCP and file content. Nightfall and Strac redact in their browser extensions. Harmonic and Lasso describe masking or redaction in vendor material. Shadow pseudonymises reversibly.
Is there an open-source AI DLP tool?
Shadow is an open-source (Apache-2.0) privacy layer for AI API traffic. It is not a full DLP suite: it has no central console, coaching or SIEM export. Presidio, LLM Guard and LiteLLM are open-source building blocks.
Does AI DLP make us compliant?
No tool makes an organisation compliant on its own. AI DLP helps meet requirements such as data minimisation and confidentiality, as part of a wider programme.