A Cloud Security Alliance (CSA) survey found that data loss prevention (DLP) tools often fail to stop sensitive information leaving an organisation. Of organisations reporting data loss, 73% had experienced at least one confirmed incident in the previous 24 months, but only 16% said DLP blocked their most significant incident before data left. The findings come from *DLP in the AI Era*, based on 433 online responses from IT and security professionals gathered in June and July 2026. The research was funded by Jazz, which co-developed the questionnaire; CSA said it independently analysed and interpreted the results.
The survey points to gaps between perceived risks and enforcement. GenAI was named a leading data-exfiltration risk by 48% of respondents, yet only 22% said their organisation strictly blocked it. Cloud-storage uploads were cited by 41% as a top risk, but 19% strictly blocked them. Fewer than a third (29%) could produce a routine 30-day report on sensitive data sent to GenAI tools.
Meanwhile, 54% of teams said most DLP alerts they triaged were false positives, and 90% reported at least one measurable effect of alert fatigue in the past year. Business resistance also weakened controls: 71% said security teams had faced pushback on DLP enforcement, while 54% of all respondents said enforcement had been softened in some form. CSA’s Hillary Baron said new GenAI-related data-exit routes are exposing gaps in older DLP approaches.