OEM capability comparison
Every capability in the DLPST taxonomy, rated for each OEM from its official documentation. Priorities shown are from the default brief - run an assessment to score against your own.
NativeAdd-on productPartialNot documentedNot available
#1
Netskope
96%
Strong fit
#2
Proofpoint
94%
Strong fit
#3
Forcepoint
93%
Strong fit
#4
Symantec
92%
Strong fit
#5
Fortra
92%
Strong fit
| Capability | Your priority | Symantec | Forcepoint | Netskope | Proofpoint | Fortra |
|---|---|---|---|---|---|---|
| Endpoint | ||||||
| Windows endpoint agent | Must have | Native DLP Agent for Windows 11 (incl. ARM64) and Windows Server 2019-2025; full Endpoint Prevent + Discover channel… source | Native Forcepoint DLP Endpoint (F1E) for Windows; compatible with DLP 8.9.x+. source | Add-on product Endpoint DLP is an optional add-on to the Netskope Client; Windows 10/11 x64 (not Win11 Enterprise Multi-Sess… source | Native Lightweight user-mode agent for Endpoint DLP/ITM; Windows 10/11, Server 2016-2022, ARM64. source | Native Kernel-level DG Windows agent; Windows 11 24H2 supported (2025). source |
| macOS endpoint agent | Must have | Native DLP Agent for macOS 14-27 (Apple Silicon; Intel deprecated); most channels (no CD/DVD, local drive, HTTP/FTP). source | Native Forcepoint DLP Endpoint for Mac; macOS 13-15 need full disk access. source | Add-on product Endpoint DLP add-on on macOS 14/15/26, Intel or Apple Silicon, needs Full Disk Access. source | Native macOS 14-27 agent, Intel and Apple Silicon. source | Native DG macOS agent; macOS 26 Tahoe certified in 9.2.0. source |
| Linux endpoint agent | Not needed | Partial Linux agent (RHEL 8/9, Ubuntu 24.04) supports Endpoint Discover only; monitoring channels are not supported o… source | Not available F1E package builder creates Windows 64-bit and Mac packages; 'The Linux option is currently unavailable'. source | Partial Netskope Client supports Linux for steering (inline web/cloud DLP) but Endpoint DLP device/content control on… source | Native SaaS Linux agent (Ubuntu, Debian 13, RHEL 9/10, Fedora); ITM On-Prem Unix/Linux agent; DLP prevention parity … source | Native DG Linux agent 11.0.0: RHEL 8.10-10.0, Ubuntu 22.04/24.04; privileged user monitoring. source |
| VDI / virtual desktop support | Not needed | Native Azure Virtual Desktop (Win 11 single/multi-session), Citrix, VMware virtual desktops/apps, Windows 365 Cloud … source | Partial Windows VDI (Citrix XenApp/XenDesktop/Virtual Apps) with limited functionality. source | Partial Client supported on Citrix, AVD, Omnissa Horizon, Amazon WorkSpaces; Endpoint DLP not supported in multi-sess… source | Native Azure Virtual Desktop listed as supported; master-image/cloning install for Citrix/Microsoft VDI documented. source | Native Agents embedded in gold images/linked clones; Citrix, VMware, Hyper-V, AWS WorkSpaces; SaaS VDI use case carr… source |
| Email, web & network | ||||||
| Cloud email DLP (Microsoft 365 / Google) | Must have | Native Microsoft 365 Exchange Online via Cloud Service for Email / Cloud Prevent for Email or Network Prevent for Em… source | Native DLP Email Gateway (Azure virtual appliance) for Exchange Online; Data Security Cloud DLP for Email; requires … source | Native SMTP proxy integrated in Exchange Online outbound flow plus Next Gen API for Outlook. source | Native Email DLP via Proofpoint gateway (PoD) in M365 mail flow; Adaptive Email DLP integrates with Outlook. source | Native DG Network DLP inspects outbound Exchange/Office 365 email; Clearswift SEG (separate product) integrates with… source |
| On-prem email DLP (Exchange / MTA) | Not needed | Native Network Prevent for Email with any strictly SMTP-compliant MTA, forwarding or reflecting mode, TLS. source | Native Protector explicit MTA mode (block/quarantine) or passive SMTP monitoring; Forcepoint Email Security. source | Partial SMTP proxy supports upstream MTAs (e.g. Mimecast, Proofpoint); datasheet claims support for on-prem MTAs, but… source | Native PPS on-prem hardware/virtual appliances host Email DLP via Regulatory Compliance module; or cloud gateway as … source | Native DG network appliance includes inline MTA; Clearswift SEG is a full SMTP gateway (separate SKU). source |
| Web DLP via existing proxy (ICAP) | Nice to have | Native Network Prevent for Web ICAP server (REQMOD/RESPMOD, Secure ICAP) behind any ICAP proxy; ProxySG recommended. source | Native Web Content Gateway (local policy engine) or protector as ICAP server for Squid/other proxies (DLP Network). source | Native Next Gen SWG with inline DLP; client, explicit proxy, proxy chaining, tunnels; all ports. source | Add-on product Proofpoint Web Security cloud proxy with inline upload/download DLP; ICAP integration with Zscaler also suppo… source | Add-on product Clearswift Secure Web Gateway (proxy) and Secure ICAP Gateway; DG Network DLP integrates with Cisco/Zscaler S… source |
| Passive network monitoring (SPAN/TAP) | Not needed | Native Network Monitor on SPAN/TAP with NIC or Napatech capture cards (up to 900 Mbps x 4 interfaces). source | Native Protector on SPAN/mirror port or TAP monitors HTTP, SMTP, FTP, plain text (monitor only). source | Not available DLP is inline/cloud; datasheet states it does not require ICAP or SPAN. No passive network-tap DLP documented… source | Not available No network (SPAN/TAP) DLP appliance found on official pages. source | Native DG appliance monitors via SPAN or TAP, all TCP/IP, SMTP/HTTP/S/FTP/SSL/webmail. source |
| Secure Web Gateway from the same vendor | Must have | Add-on product Symantec Cloud SWG / ProxySG are separate products; Cloud SWG purchased separately from Cloud Detection Servi… source | Add-on product Web Security in Data Security Cloud; on-prem Forcepoint Web Security/Content Gateway. source | Native Netskope One Next Gen SWG on NewEdge. source | Add-on product Proofpoint Web Security SWG (2021 datasheet); current 2026 availability not confirmed. source | Add-on product Clearswift SWG (on-prem) and Fortra cloud SWG (ex-Lookout) with DLP on web traffic. source |
| Cloud apps, CASB & GenAI | ||||||
| API CASB DLP for sanctioned SaaS | Must have | Add-on product CloudSOC CASB Securlets (API, data at rest) for AWS, Azure, Box, Google Workspace, Office 365, Salesforce, Se… source | Add-on product Forcepoint CASB API scanning via DPS: Box, Dropbox, Google Workspace, M365/OneDrive/SharePoint, Salesforce, S… source | Native Classic and Next Generation API Data Protection for ~30 SaaS apps. source | Native Cloud DLP (formerly CASB) API connectors for M365, Google Workspace, Salesforce, Box, etc.; remediation via v… source | Add-on product Fortra CASB (ex-Lookout, acquired May 2025) API-based security; DG Cloud Data Protection scans Box/O365 etc. … source |
| Inline CASB (shadow IT, instance control) | Must have | Add-on product CloudSOC Gatelets enforce policies on data in motion in real time; separate CloudSOC product. source | Add-on product Forcepoint CASB reverse proxy (managed) and forward proxy (unmanaged/BYOD) modes. source | Native Forward and reverse proxy inline CASB with DLP across ~100,000 SaaS apps incl. instance awareness. source | Native Multimode CASB: forward and reverse proxy modalities, SAML/OIDC Adaptive Access Control; SaaS Isolation is an… source | Add-on product Fortra CASB provides inline and API-based security (ex-Lookout SSE). source |
| GenAI app protection (ChatGPT, Copilot, ...) | Must have | Native 26.1 adds Generative AI application category (ChatGPT, Microsoft Copilot) to endpoint global application moni… source | Add-on product Forcepoint AI Data Security: prompt/response/upload inspection for ChatGPT, Claude, Copilot, Bedrock; shadow … source | Native Visibility/control over 3,300+ GenAI apps, inline DLP on prompts, AI Guardrails, AI Gateway; API protection f… source | Native Detect/block/redact sensitive data in prompts and uploads to ChatGPT, Gemini, Copilot, Claude, etc. via agent… source | Native Generative AI Content Pack: block AI sites, block paste/upload of classified data, flag sensitive patterns; A… source |
| Data-at-rest discovery | ||||||
| File-share discovery scanning | Must have | Native Network Discover / High Speed Discovery for SMB, NFS, DFS, PST; Network Protect quarantine/copy. source | Native Forcepoint Data Discover network/file discovery with remediation; endpoint local discovery. source | Add-on product Via Netskope One DSPM with on-prem appliance/sidecars: CIFS, SMB, NFS, NetApp ONTAP. source | Add-on product Via Proofpoint DSPM on-prem containerized scanner (Windows File Shares, port 445). source | Native DG Data Discovery: CIFS/SMB, NFS, workstations; remediation delete/encrypt/move. source |
| SharePoint / collaboration discovery | Must have | Native On-prem SharePoint 2019 and Subscription Edition (High Speed Discovery on SE); SharePoint Online via CloudSOC… source | Native Discovery tasks for SharePoint sites; SharePoint Online via DLP Cloud Applications/CASB. source | Native SharePoint Online via API Data Protection and DSPM for SaaS. source | Native DSPM scans SharePoint/OneDrive/Teams via AWS or Azure sidecar; Cloud DLP API covers M365 file exposure. source | Native DG Network DLP discovery covers SharePoint/OneDrive; DCS for Data at Rest/Illuminate scans SharePoint on-prem… source |
| DSPM | ||||||
| DSPM for AWS | Must have | Add-on product CloudSOC DSPM lists AWS among supported cloud storages (via AWS securlet); requires CloudSOC + Cloud DLP REST… source | Add-on product Forcepoint DSPM connectors for AWS S3 and AWS IAM. source | Native Netskope One DSPM: S3, RDS, Aurora, DynamoDB, Redshift, Athena, EBS, EFS, FSx. source | Add-on product Proofpoint DSPM (separate product): S3, RDS, Aurora, DynamoDB, Redshift, EBS and more; in-account scanner. source | Add-on product Fortra DSPM covers AWS (AWS Marketplace listing); DG ARC ingests Amazon Macie S3 findings. source |
| DSPM for Azure | Must have | Add-on product CloudSOC DSPM lists Azure among supported cloud storages (via Azure securlet). source | Add-on product Forcepoint DSPM connectors for Azure Blob, Azure Files, Azure AD; MS SQL on Azure. source | Native Blob, Files, Managed Disks, Azure SQL, MySQL/PostgreSQL/SQL Server, Synapse, Databricks. source | Add-on product Proofpoint DSPM: Blob, File Shares, Azure SQL, CosmosDB, etc.; onboarding via script/Terraform. source | Add-on product Fortra DSPM discovers Azure Blob Storage containers and sensitive data. source |
| DSPM for Google Cloud | Not needed | Add-on product CloudSOC DSPM lists Google among supported cloud storages. source | Partial Documented Google connectors are Google Drive, Gmail and Google IAM; product page claims GCP but no GCS/BigQu… source | Native GCS, BigQuery, Cloud SQL, Firestore, Spanner, Persistent Disks. source | Add-on product Proofpoint DSPM: buckets, Cloud SQL, Memorystore; single-project resource deployment for org. source | Partial GCP not named on Fortra DSPM pages; Dataguise DgSecure datasheet lists Google Cloud Storage. source |
| DSPM for SaaS data (M365, Google, ...) | Should have | Add-on product CloudSOC DSPM data catalog for Google Drive, M365 OneDrive/Sites, Salesforce, Box, ServiceNow, plus Cloud Man… source | Add-on product DSPM: Exchange Online, OneDrive, SharePoint Online, Box, Confluence Cloud, Gmail, Google Drive; Salesforce cl… source | Native Box, Google Drive, OneDrive, SharePoint Online, Salesforce. source | Add-on product Proofpoint DSPM: M365 (SharePoint/OneDrive/Teams), Google Drive, Salesforce, Databricks, Snowflake. source | Add-on product Fortra DSPM packages protect SaaS apps: Essentials up to 5 apps, Advanced unlimited. source |
| DSPM for structured data / databases | Should have | Partial No DSPM for databases documented; on-prem Network Discover scans Oracle 19c, SQL Server 2017/2019, DB2 11.5 v… source | Add-on product DSPM Structured add-on: DB2, MySQL, PostgreSQL, MS SQL, Oracle, Databricks. source | Native Snowflake, Databricks, MongoDB, Heroku Postgres, OCI databases, and on-prem Db2/SQL Server/MySQL/Oracle/Postg… source | Add-on product Cloud databases (snapshot-based scan) and on-prem MSSQL/MySQL/Postgres/Oracle via containerized scanner. source | Native DG appliance discovery & fingerprinting of MS SQL, Oracle, MySQL, DB2, Sybase, Informix, PostgreSQL; DSPM men… source |
| Detection & classification | ||||||
| Exact Data Match (EDM) | Must have | Native Exact Data Matching and EMDI. source | Native PreciseID database fingerprinting of tables/views/CSV. source | Native EDM with 2B+ records; hashing via UI, VA, REST API or Cloud Exchange. source | Native Cloud EDM service; email, cloud, web; endpoint EDM URLs in agent safelist. source | Native DBRM ('also known as Exact Data Matching') on DG; EDM also in DSPM Advanced. source |
| Document fingerprinting (IDM) | Must have | Native Indexed Document Matching (exact/partial/derivative), server and agent. source | Native PreciseID file, directory and SharePoint fingerprinting, also on endpoints. source | Native Document fingerprinting for exact/partial matches. source | Native IDM on cloud/web and document fingerprinting on email; architecture paper said not on endpoint agent. source | Add-on product Full/partial document fingerprinting via Clearswift IG Server with Clearswift gateways; DG 'fingerprinting' i… source |
| OCR / image text detection | Should have | Add-on product On-prem OCR Server requires the Sensitive Image Recognition add-on license (product brief says SIR is provide… source | Native OCR in policy engine from 10.4 (OCR server deprecated). source | Native OCR on images and PDFs, including on endpoint. source | Native OCR for images and embedded images; listed in DLP Transform detector set. source | Add-on product Clearswift OCR is a priced option for SEG/SIG/SXG/SWG; OCR in DSPM Advanced / cloud DLP add-on. Endpoint OCR … source |
| Machine-learning classifiers | Should have | Native Vector Machine Learning (VML) profiles. source | Native Trainable ML classifiers for unstructured file-system data. source | Native Built-in ML classifiers plus custom trainable classifiers. source | Native 110+ AI classifiers (Nexus). source | Add-on product DCS Data Detection Engine uses ML + deep learning; Fortra DSPM AI classifiers. DG core uses ML for anomaly de… source |
| AI / LLM-based classification | Nice to have | Not available No LLM-based classification found in the DLP 26.1 Help Center; ML detection is VML. source | Add-on product AI Mesh with Small Language Model in Forcepoint Data Classification / DSPM. source | Partial AI Guardrails classify prompts/responses (MITRE ATLAS/OWASP LLM); LLM-based classification of general data co… source | Native Autonomous Custom Classification uses LLMs; LLM-enriched alerts. source | Not documented DSPM cites 'AI classifiers' but no LLM-based classification documented. source |
| Protection & insider risk | ||||||
| User risk scoring / risk-adaptive policy | Should have | Native User Risk Based Detection with Symantec ICA 6.6 (ICA provided with DLP Core per brief); risk scores drive pol… source | Add-on product Risk-Adaptive Protection add-on to DLP, 150+ IOBs, cloud-based; endpoint risk calculated locally via Dynamic … source | Add-on product Advanced UEBA with UCI score and UCI-based inline policies requires additional licensing. source | Native ITM user risk, Cloud DLP ML insider-risk models, adaptive policies that collect more evidence for high-risk u… source | Native UEBA risk scores and ML baselines in DG Analytics; deviations can trigger additional monitoring/blocking cont… source |
| Insider-threat activity / screen capture | Nice to have | Not available No screen/session recording capability found in DLP 26.1 docs. source | Not documented Legacy Forcepoint Insider Threat (screen capture/replay) page no longer available; insider-threat URL now sho… source | Not documented No screen/session recording capability found on official pages. source | Add-on product ITM visual capture (screenshots) - full ITM license or add-on; ITM On-Prem session recording. source | Native User Activity Monitoring: capture files, screenshots and keystroke logging before/after suspicious activity w… source |
| User-driven classification & labelling | Should have | Native Applies MPIP classification labels via Endpoint: MPIP Classification and Network Protect: Apply MPIP Classifi… source | Native DLP uses imported MIP labels for detection and labeling; full user-driven/AI classification via Forcepoint Da… source | Native API Data Protection can apply/update MPIP labels; DSPM auto-tags sensitive data. source | Partial DSPM MIP Labels 2.0 (beta) applies labels to SharePoint/OneDrive Office files; endpoint agent only reads labe… source | Native DG content/context/user-based tagging natively; full visual labeling via Fortra Data Classification Suite (se… source |
| Microsoft Purview (MIP) label integration | Should have | Native Microsoft Purview Information Protection integration for agents, on-prem detection servers and DLP Cloud (rea… source | Native Imports M365 sensitivity labels, File Labeling classifiers, automatic MIP decryption during analysis. source | Native Reads MPIP labels (inline CASB, API, Endpoint DLP) and writes via API Data Protection. source | Native Agent extracts MIP labels (Windows/Mac); Cloud DLP uses MIP labels in rules; requires Microsoft AIP P1/P2 lic… source | Native DG reads MIP labels and maps to actions; DCS MIP Classification Adapter maps labels bidirectionally. source |
| Encryption / DRM on block or quarantine | Nice to have | Partial Encryption/DRM via integrations: MPIP labels, Perform DRM / Encrypt Data-at-Rest actions, Email Security.clou… source | Partial Endpoint removable-media encryption (profile key / user password); SMTP routing to encryption gateways; no ow… source | Native Policy actions include encrypt and IRM protect; DRM label reading on endpoint. source | Add-on product Email Encryption (policy-based, Secure Reader, Trusted Partner Encryption); no file DRM product found. source | Add-on product DG policy actions include encrypt (e.g. removable media); persistent DRM via Digital Guardian Secure Collabor… source |
| Operations & integration | ||||||
| Incident workflow & remediation | Must have | Native Enforce incident lists/snapshots, remediation workflows, End User Remediation, ServiceNow integration, automa… source | Native Incident management plus remediation scripts run by policy engine, endpoint or management server. source | Native Incidents pages for DLP incidents, quarantine, legal hold; forensics; remediation actions (quarantine, unshar… source | Native Unified alert manager, Data Security Workbench, Smart Send self-remediation, cloud auto-remediation, anonymiz… source | Native ARC workflows/incident management; remediation actions encrypt, quarantine, move, reroute; discovery file mar… source |
| SIEM / SOAR integration | Must have | Native Log to a Syslog Server response rule for SIEM; ServiceNow incident integration; REST APIs; CloudSOC event str… source | Native Syslog for DLP audit and system logs, ArcSight CEF compatible (10.2+); DSPM has SIEM integration and webhooks. source | Native Cloud Exchange Log Shipper (Splunk/syslog, Sentinel, etc.) and Ticket Orchestrator; Log Streaming (separately… source | Native Webhooks to Splunk Cloud, Teams, Slack, ServiceNow/generic; S3/Azure data export every 15 min. source | Native Splunk, IBM QRadar (DG App), ArcSight, McAfee; SaaS includes SIEM export setup; SOAR shown in platform diagra… source |
| REST API | Should have | Native Enforce REST APIs (OAuth/OIDC, API-only users, rate limiting) and Detection REST API 2.0 (API Detection Serve… source | Native REST API (JWT) for incidents, policies/rules/resources, deploy. source | Native REST API v2 token-based (Netskope-API-Token), 4 calls/s per endpoint; v1 24 req/5 s. source | Native External applications access platform via REST APIs; Cloud DLP forensics export via REST. source | Partial Platform diagram lists RESTful APIs; DSPM Advanced includes REST APIs; Secure Collaboration SDK/REST. Public … source |
| Deployment & compliance | ||||||
| On-premises management console | Not needed | Native Enforce Server with Oracle 19c, on Windows or RHEL. source | Native Forcepoint Security Manager on Windows management server. source | Not available Management is delivered from Netskope-hosted management planes; no on-prem management console documented (inf… source | Native ITM On-Prem (ObserveIT) fully customer-hosted; PPS on-prem appliances for email DLP. Core Enterprise DLP/Clou… source | Native Fortra DLP offered on-premises (customer-controlled, supports data residence); DCS Policy Manager on-prem. source |
| SaaS management console | Not needed | Add-on product Cloud Managed DLP in CloudSOC (Cloud Management SaaS) for endpoint, CASB, Cloud SWG and email detectors; sepa… source | Native Forcepoint DLP SaaS deployment in Data Security Cloud (AWS). source | Native Single cloud console for all DLP channels. source | Native Information Protection platform is fully SaaS. source | Native Fortra DLP SaaS (cloud-delivered since 2017, AWS-powered) and Managed Security Program. source |
| Hybrid deployment | Not needed | Native Enforce-managed cloud detectors (CDS, Cloud Service for Email) combined with on-prem detection servers; Cloud… source | Native On-prem FSM + agents in Azure/AWS via VPN; FSM connects to Data Protection Service for CASB/Email Cloud; 10.4… source | Native Cloud service plus optional on-prem/IaaS components: NPA publishers, Virtual Appliances, DLP On Demand, DSPM … source | Native Email Protection supports cloud, hybrid and on-prem (virtual/physical appliances); DSPM hybrid with on-prem s… source | Native SaaS console/ARC with on-prem network appliances and discovery; Secure Collaboration hybrid key management. source |
| Regional data residency / in-region tenant | Not needed | Partial CloudSOC tenants in US or EU regions; on-prem Enforce keeps incident data customer-controlled. Cloud Detectio… source | Partial SSE in AWS regions US-East/West, Sao Paulo, Singapore, Mumbai, London, Frankfurt, Sydney; separate EU cloud p… source | Native Management planes in 9 countries; customers can define global/regional footprint for traffic processing. source | Native Endpoint/ITM/Cloud DLP regions: US1 (us-east-1), EU1 (eu-central-1), JP1, AU1, CA1, ME1 (me-central-1), IN1 (… source | Partial On-prem option supports data residence; DCS Policy Manager supports in-country/private clouds; SaaS region li… source |
| Government certification (FedRAMP or equivalent) | Not needed | Not documented No FedRAMP authorization for DLP/CloudSOC confirmed on a fetched official page; DLP 26.1 docs mention FedRAMP… source | Not documented No current FedRAMP authorization verified on a fetched official page. source | Native Netskope NewEdge Government / GovCloud FedRAMP High authorized; separate US FedRAMP and Canada PBMM API app l… source | Partial FedRAMP Moderate for Email Protection/TAP and Enterprise Archive; High/IL4 effort would extend coverage to Em… source | Partial Fortra pursuing FedRAMP High for data classification (May 2026, with Coalfire 3PAO) - not yet authorized; DCS… source |