The Label and the Destination: 257 Labeled Files Reached an AI Tool in 12 Days

Over twelve days in one production tenant, 257 labeled files left a device and reached an AI tool within ten minutes of leaving. Neither the DLP system nor the network proxy could produce that list on its own. DLP knows the label but not the destination. The network sees the vendor but not the file.

This AI Interaction Data Fabric Insights teardown shows how one join closes the gap:

• DLP (Microsoft Purview): the label and the file, with no destination
• Network (Zscaler): the vendor and the bytes, with no file
• The correlation: same user, same AI tool, inside a 600-second window, across two sources
• The finding: a labeled file reached an AI tool, corroborated by two systems that can’t see each other’s half. It is not confirmed data loss.

The response is a conversation, not an incident: confirm whether the tool is sanctioned for that label, and if it isn’t, set a policy on the label and talk to the person.

More Kovrr videos: https://www.kovrr.com/resources/video-content-hub
Learn more: https://www.kovrr.com

Kovrr is a leading provider of AI and cyber risk, security, and governance solutions, helping global organizations evaluate exposure, quantify potential business impact, and strengthen resilience with data-driven insights.