Organizational Resistance to DLP Modernization and How to Manage It

Budgets for insider risk and data protection are rising at most organizations, and insider-related incidents are rising right alongside them. That combination should not be possible if the problem were simply a matter of funding. It tells a different story: organizations are spending money on tools that do not address the exposure they actually face, and something beyond the budget line is keeping them from switching to tools that would. That something is organizational, and it appears as ownership disputes, switching-cost anxiety, and a sincere but mistaken belief that current coverage is already adequate. Each of those pressures compounds the others, and understanding them individually is the first step toward dismantling the stalemate they create together.

Fragmented tool ownership and political stalemate

Before an organization can modernize its data protection program, it has to agree on who owns the problem, and most organizations cannot do that cleanly. Fortinet's 2025 Insider Risk Report shows ownership of insider risk spread across Security and the SOC, dedicated data protection teams, dedicated insider risk teams, broader IT functions, and risk management groups, with some organizations reporting no insider risk function. Fortinet's report calls for formal insider risk programs built around clear directives, a governance group, and a senior decision-maker who owns funding and visibility, because without that, the cross-functional gap slows incident response and leaves policy enforcement inconsistent across the organization. The modernization argument security leaders need to win is a governance argument first: who is accountable for the outcome, not which vendor has the better feature set. Some organizations will point to an existing cross-functional committee as proof the ownership problem is already solved. A committee without one accountable owner just reproduces the same stalemate at every decision point, so budget, vendor selection, policy scope, and incident escalation all wait on a consensus that never quite arrives.

Why security teams believe their current DLP is working

The harder obstacle to modernization is sincere confidence that no change is needed. Fortinet's 2025 Insider Risk Report found that only about half of security professionals strongly agree their existing DLP tools are effective at protecting sensitive data from leaving the organization, so a substantial share of practitioners believe their current tools already do the job well enough. The case of Intel engineer Jinfeng Luo shows how this confidence forms. Luo just switched to a second device and completed the transfer anyway. That gap between what a tool blocks and what it actually prevents is the whole problem, and it stays invisible to any team whose dashboards only show blocked events. Fortinet's report found that a large majority of organizations cannot see how users interact with sensitive data across endpoints, cloud apps, and GenAI platforms, because the tools in place were never designed to look there.

The architectural gap that false confidence conceals: what legacy DLP cannot see

Legacy DLP produces false confidence because of its architecture, not because of tuning or effort. Legacy tools assume sensitive data moves in predictable, classifiable patterns, and that assumption falls apart in cloud, hybrid, and AI-tool environments where data moves constantly and through channels no rulebook anticipated. The New DLP report describes the root issue directly: legacy tools were built around a perimeter-centric model that works against organizations in modern cloud environments and AI-driven workplaces, cannot understand behavioral context, cannot tell structured data from unstructured data, and generate enough false positives that analysts learn to treat the alerts as noise. Coverage is also thinner than most security teams assume. Fortinet's 2025 Insider Risk Report found that just over half of surveyed organizations (53%) had at least one DLP technology deployed, and most individual DLP types fell below that mark, so enforcement gaps remain across surfaces that attackers and careless employees actively exploit. The GenAI surface makes this worse. Fortinet's report found that a majority of organizations are very concerned about sensitive data being shared with tools like ChatGPT, but only a small fraction feel fully prepared to respond to it, and rules-based DLP cannot close that gap because the data moves through browser-based prompts that pattern matching was never built to classify. Three real cases show what this looks like on the ground. And Luo's exfiltration at Intel happened through a channel the tool could see but could not stop once it understood the attempt had already succeeded once. In each case, the fix was never more rules. It was a system that could ask whether this behavior was normal for this user, with this data, in this context, combining content, identity, role, and behavioral signal in a single decision.

Switching costs and integration anxiety as an internal veto

Even security leaders who accept every point above often lose the internal argument on cost and disruption, and that objection is not irrational. Retraining analysts, re-tuning policies, absorbing integration work, and surviving a visibility gap during transition are real operational costs, and a modernization proposal that waves them away will lose the room. But the status quo is not free either. Fortinet's 2025 Insider Risk Report found that 49% of organizations cite DLP complexity as a top barrier, 42% say implementation is difficult, and only 47% say their current DLP tools are effective at preventing sensitive data from leaving the organization. The comparison security leaders should be making is not new cost against no cost, but new cost against the ongoing cost the organization is already paying for complexity and poor effectiveness. The specific fear that kills most modernization proposals in budget review is the forklift migration: ripping out existing tools and replacing them wholesale. The answer to that fear is that modern platforms are built to integrate with existing SIEM, EDR, and SOAR investments through open APIs rather than demanding a wholesale swap, which lets modernization happen gradually without disrupting day-to-day operations. One way to think about the stack that resolves fragmentation without a forklift: telemetry feeds detection through SIEM and EDR, behavioral enrichment through UEBA adds the context those systems lack, DLP enforces policy on top of that context, and SOAR orchestrates the response. A platform that layers into that stack can be pitched internally as an addition, not a replacement, which is a far easier sell to IT and finance. Time-to-value matters just as much as architecture here. If a new platform takes weeks or months to deliver usable visibility, the disruption argument wins by default, so the platforms worth proposing are the ones that offer fast deployment and real data visibility from day one, not ones that need months of policy tuning before producing a usable signal.

The insider threat landscape that makes delay expensive: what is actively circulating against organizations now

While organizations debate ownership and cost internally, the threat landscape is not waiting. Flashpoint's 2026 insider threat intelligence report counted tens of thousands of posts that solicited insiders or advertised insider-enabled services across illicit forums and channels in 2025, and Telegram served as a prominent medium for that activity. That volume means threat actors are recruiting employees as insiders at scale, not simply waiting around for an opportunistic leak to happen on its own. The 2025 Coinbase case shows what that recruitment looks like when it succeeds: external attackers bribed Coinbase support agents, who then used their own legitimate access to pull customer data out of the company's systems. That is a collusive insider incident driven by outside financial motivation, the same pattern Flashpoint's solicitation data predicts happening at scale across other organizations right now. Flashpoint also notes that extortionist groups are deliberately targeting employees to turn them into paid insiders. The bribery pathway is organized and repeatable. Because most incidents are unintentional rather than deliberate, a DLP program built only to catch malicious insiders is incomplete by design. It needs behavioral visibility across the entire user population, including contractors and other third parties who touch sensitive systems.

Departing employees and the 90-day risk window

Of all the moments in an employee's lifecycle, departure concentrates the most risk in the shortest window, and most legacy DLP programs have no mechanism built for the escalation that window demands. Fortinet's 2025 Insider Risk Report found that 55% of security professionals name departing employees as a key insider risk concern, and 47% are very concerned specifically about departing employees taking sensitive data with them. That makes offboarding the single most predictable and most preventable risk concentration point across the entire employment lifecycle. The risk window opens before the organization even knows it has entered one. A system that only escalates monitoring after a formal resignation notice is already behind events by the time it reacts. Legacy DLP has no native concept of lifecycle stage at all: it applies the same static rules to a new hire, a ten-year employee, and someone in their final week on the job. A behavior-aware platform can escalate monitoring automatically the moment an employee's status changes, without anyone having to manually rewrite a policy. That gives security leaders a specific, bounded scenario to bring into a budget conversation: here is exactly when the organization is currently blind, and here is how predictable that blind spot is. That argument lands harder in a budget review than a general claim that the existing tooling is inadequate.

Structuring the internal modernization argument so it survives a budget review

If a modernization proposal opens with technical architecture, it tends to lose in budget review. One that opens with governance accountability, a bounded use case, and a layered integration path has a real chance of winning. The first step is the governance argument, not the technology argument: name a single executive owner for insider risk outcomes before proposing any tool change, because without that owner, every technical proposal gets routed back to committee and stalls there. Fortinet's 2025 Insider Risk Report calls explicitly for a senior decision-maker who owns funding and visibility as the prerequisite for any cross-functional coordination to actually happen. The second step is a visibility audit: document, in plain terms, what the current tools cannot see, specifically across endpoints, cloud apps, and GenAI tools, since Fortinet's report found that a large majority of organizations admit they cannot see how users interact with sensitive data across those surfaces. Presenting the organization's own blind spots is a far more credible case for change than repeating a vendor's marketing claims. The third step is the use case anchor: frame the initial modernization scope around the departure-event window described above. It is time-bounded, it is high-value, and it can be addressed by layering behavioral detection on top of existing tools, sidestepping the rip-and-replace objection. The fourth step is the integration framing: position modernization as an extension of the existing stack, not a replacement for it. Behavioral detection and investigation capability that integrates with existing SIEM and EDR investments lowers the switching-cost objection and makes the proposal easier for IT and finance to sign off on. More detection sounds like more analyst work. A platform that investigates candidate events before they ever become human alerts, and assembles the full behavioral context automatically, reduces analyst burden. The goal is fewer alerts, each arriving with higher confidence and with much of the investigation already done.

A mature, behavior-aware DLP program in practice

The end state of DLP modernization is a program that combines content understanding, behavioral context, and investigation efficiency into one picture of both the data and the person handling it. Fortinet's 2025 Insider Risk Report found that the capabilities security leaders most want in next-generation solutions are real-time behavioral analytics and control over SaaS and GenAI tools, with day-one visibility named as a best practice organizations should expect. That combination is what legacy DLP cannot deliver, and it defines the architecture organizations should be building toward. A mature program understands both halves of the equation: what a piece of information actually means to the business, beyond whether it matches a regex pattern, where it is headed, who is touching it, and what behavioral pattern that interaction fits into across a user's full timeline. Investigation efficiency matters just as much as detection does. A program that surfaces the right alert but still buries analysts in hours of manual triage has not solved the underlying problem; the goal is a platform that pre-assembles the behavioral story around each candidate event so analysts spend their time making decisions. Shadow AI is a specific and growing version of this gap that rules-based tools cannot close: controls need to depend on the data itself, its destination, who owns the account, and the surrounding context, with the ability to intervene before sensitive data actually leaves, rather than relying on URL blocklists that any motivated employee can route around in minutes. A useful benchmark for any security program: ask whether it can answer three questions about a given data risk event. What data was involved and why does it matter to the business. What does this person's behavioral pattern look like across their full timeline, not just this one moment. And how quickly the investigation can be completed with evidence already assembled. Most programs today cannot answer all three, and that gap, not the budget line, is the real measure of how far modernization still has to go.