Data loss prevention for MSPs: a small category you sell as a service

Data loss prevention is the security category clients ask for after an incident and MSPs find hardest to sell before one. It is also small: 38 products from 32 vendors under Data Loss Prevention as of October 2026, against 117 for email security. This guide covers what is on the shelf, how MSPs package it, and what to ask before you commit a client to it. It is shorter than the other explainers because the catalog has audited fewer of these products so far, and the numbers say so where it matters.

Key facts, October 2026

• 38 DLP products from 32 vendors; 8 have been through the capability audit so far.
• None is classified as internal MSP tooling: 26 are run by the MSP and paid for by the client, 12 are resold. DLP is a sell-through category you package as a service.
• Of the 8 audited products, 6 expose a public API and 2 have an MCP server (Nightfall AI, IRONSCALES).
• 23 of 38 carry an AI feature flag, 61%, the highest share of any security subcategory.
• 34 of 38 products come from US vendors.

What the category covers

DLP tools stop sensitive data leaving a client's control, by accident or on purpose. The products split by where they watch.

• Email DLP. Outbound mail inspection, encryption on policy, and blocking a message with a card number or a client list in it. The most common form, and the one that overlaps with the email security category.
• Endpoint DLP. Watching USB, print, clipboard and upload on the device itself.
• Cloud and SaaS DLP. Scanning Microsoft 365, Google Workspace, Slack and the like for sensitive data at rest and in motion, often as part of a CASB or SSPM product.
• Discovery and classification. Finding and labelling sensitive data so the other three have something to enforce. Several products here are classification engines rather than enforcement points.

Backup is next door in the same root category, and the two get confused in sales conversations. Backup gets data back; DLP stops it leaving.

Sell through, and bundle it

The use-or-resell verdict puts DLP firmly on the client side of the invoice.

No DLP product in the catalog is classified as internal tooling. Twenty-six of 38 are "both", which in this category means the MSP owns the policy work and the console while the client pays per user, and that is the right way to sell it. DLP that the client configures themselves ends up either switched off or blocking payroll. DLP that comes with a managed policy service, a quarterly review and a report the client's auditor will accept is a service line, not a licence.

The landscape in numbers

• 38 products, 32 vendors. Proofpoint lists 3, Rubrik, Dope Security, Fortra and Kaseya 2 each, everyone else one. Trellix, Netwrix, Trustifi, VIPRE and Nightfall are among the single listings.
• Almost entirely American. 34 of 38 products come from US vendors, 2 from Canada, 1 each from Germany and Pakistan. If a client needs an EU-headquartered DLP vendor, the catalog does not currently have a strong answer. Check before you promise one.
• Vendor size is evenly spread. 14 products from vendors under 50 people, 11 mid-sized, 13 from vendors over a thousand staff.
• The heaviest AI marketing in the catalog. 23 of 38 products carry an AI feature flag, 61%, the highest share of any security subcategory. Some of it is real: classification by content rather than by regular expression is a genuine improvement and most vendors now do it. Some of it is a label. Ask what the model does, where it runs and what it was trained on.

Agent-readiness: what we can say so far

Only 8 of the 38 products have been through the capability audit at the time of writing; the rest are queued. For the audited eight:

Nightfall AI and IRONSCALES are the two with a verified MCP server, and IRONSCALES is the only product in the category with API, CLI and MCP all documented. The remaining 30 products will show their flags as the audit reaches them, and this page will be updated then rather than guessed at now. For comparison, RMM platforms are at 35 MCP servers out of 104.

What agent access means for DLP in practice: "show me every policy violation for this client this month", "which users triggered the credit-card rule more than twice", and "add this file share to the scan scope" are questions an agent can answer through an API or MCP server, and they are exactly the questions that go into the quarterly review you charge for.

PSA integrations

Three products list a verified ConnectWise PSA integration and two Autotask. DLP vendors integrate with the data platform, not the service desk, and the volume of events makes ticket-per-violation a bad idea anyway. The integration you actually need is a reporting export per tenant, for the review meeting and for billing.

What actually separates products

1. Where it enforces. Email only, endpoint, cloud apps, or all three. Most clients need email first, and a product that does email well and nothing else is a legitimate choice for a small client.
2. Classification quality. Regular expressions catch card numbers and miss everything interesting. Ask how the product finds a customer list in a spreadsheet with no obvious pattern, and ask for the false-positive rate on a sample of the client's real data.
3. Policy templates for the regulations your clients face. GDPR, HIPAA, PCI, and the sector rules. Templates are a starting point, not the finish, but starting from zero is how DLP projects stall.
4. The end-user moment. When a user is blocked, what do they see, can they justify and continue, and is that logged? A product that silently drops mail generates support tickets; a product that explains and allows an override with a reason generates compliance evidence.
5. Multi-tenant policy management. Can you maintain one policy set and apply it to twenty clients with exceptions, or do you rebuild it twenty times?
6. Reporting the auditor will accept. Per tenant, per regulation, exportable, scheduled.

Questions to ask in the demo

• Take this sample of my client's real documents and show me what your classifier flags and what it misses.
• Walk through what a user sees when a policy blocks them, and how an override is recorded.
• Show me one policy set applied to two tenants with one exception.
• Which events reach my PSA, which reach a report, and can I get both per tenant through an API?
• Where does the classification run: on the endpoint, in your cloud, or in the client's tenant? What leaves the client's environment?
• What does the quarterly review report look like, and can it be scheduled to me and to the client?

How to use the catalog for this

The category page lists the 38 products with the flags verified so far. The use-or-resell filter is less useful here because everything is client-facing; the capability filter will become useful as the audit completes. The product pages for the audited eight link to the documentation behind their flags. If a DLP product you use is missing, paste its URL on the submit page and the system will classify and add it.

Frequently asked questions

Do MSPs resell DLP or use it internally?

Resell, always in the catalog's data: 26 of 38 products are run by the MSP and paid for by the client, 12 are resold outright, none are internal tooling.

Which DLP products have an MCP server?

Nightfall AI and IRONSCALES, among the 8 products audited so far in October 2026. The other 30 are queued for the capability audit.

What is the difference between DLP and backup?

Backup copies data so it can be restored after loss. DLP watches data in use and in motion and stops it leaving the client's control. They sit in the same root category in the catalog because vendors often sell them together, but they solve opposite problems.

Does Microsoft Purview replace a third-party DLP for MSP clients?

For clients on the higher Microsoft 365 licences, Purview covers email, endpoint and SharePoint DLP and many MSPs standardise on it. Third-party products win on multi-tenant management, classification quality and coverage of non-Microsoft apps. The answer depends on the client's licence tier and how many of them you manage.

Why is DLP such a small category compared with email security?

Because it is harder to buy and harder to run. Email security is a filter you switch on; DLP is a policy programme that needs ownership, which is exactly why it suits a managed service.

---

Numbers are from the MSP Navigator catalog on 11 October 2026: 38 published products in Data Loss Prevention, 8 of them through the capability audit so far. Capability flags are verified against vendor documentation and linked on each product page. The use-or-resell verdict is produced by a classifier reading each product's description and reviewed by hand in samples. When the audit reaches the remaining products, this page is refreshed. Related guides: Email security for MSPs, RMM platforms for MSPs.