MIND unveils Autonomous DLP Analyst to cut alert noise

MIND has launched Autonomous DLP Analyst, which it positions as an automation layer for data loss prevention (DLP) and insider risk management operations.

The release aims to reduce the manual work behind many data security programmes, including defining what sensitive data looks like in a specific organisation and investigating alerts across multiple systems to determine whether an event represents genuine risk.

DLP programmes have long relied on analysts to set policies, tune rules, and assess noisy alerts. This work can be difficult to scale as data moves across cloud services, messaging tools, and collaboration platforms, and as employees and systems use generative AI applications.

Autonomous DLP Analyst includes two pre-built skills: Custom Classifier and Issue Investigator. MIND describes them as focused components that automate specific operational steps in classification and investigation.

Classification Work

MIND is targeting business-specific sensitive data that does not follow predictable patterns, such as proprietary formulas, source code, internal strategy documents, and operational records.

Security teams often rely on regular expression rules and static policies to detect this information, an approach that can be hard to maintain and may generate false positives that consume analyst time.

The Custom Classifier skill allows teams to upload examples of sensitive data from their own environment. The system analyses those examples and generates classifiers, then uploads them into MIND's multi-layer AI classification engine.

MIND says the classifiers run within the customer's private MIND instance and can operate across SaaS and generative AI applications, agentic AI systems, on-premise file shares, endpoints, and email.

The emphasis on private instances reflects a broader shift towards tighter control over where sensitive detection logic runs and how it is applied. Vendors are also competing on the breadth of environments they can cover, particularly as organisations mix cloud services with legacy file shares and endpoint estates.

Investigation Flow

The second skill, Issue Investigator, focuses on alert triage and incident investigation. These workflows often require analysts to reconstruct user actions, file activity, and data sensitivity across different systems before deciding what action is necessary.

MIND says Issue Investigator provides automated issue analysis, highlighting risk signals and guiding security teams through investigations with contextual information about what occurred.

MIND frames the outcome as faster triage and clearer context for decision-making. In practice, security teams often measure improvements by reduced time to validate alerts and fewer hand-offs across teams handling identity, endpoints, cloud, and collaboration tooling.

Product Direction

MIND describes Autonomous DLP Analyst as part of a broader move towards autonomous data security operations and says it plans to add more AI skills over time.

The company also points to ISO 42001 as part of its approach to AI management, saying it was the first data security company to achieve the certification.

"Security teams should not have to write endless regex rules or manually conduct investigations to protect their data," said Eran Barak, co-founder and CEO of MIND.

MIND links the release to operational pressures such as rising alert volumes and the need to apply consistent policy across a growing list of data locations. Many organisations now expect DLP controls to extend beyond traditional endpoints and email into collaboration suites and AI tools, where data can be summarised, rewritten, or shared in new ways.

MIND says its approach applies AI and autonomy to operational workflows to reduce manual effort while improving the ability to identify and respond to genuine risk. It positions this as a way for organisations to expand coverage without adding headcount.

A core design choice is using customer-provided examples as an input for classification. This reflects a trend towards enabling teams to express what matters to the business using representative data, rather than relying only on patterns or keyword lists. MIND says the generated classifiers are then used across the customer environment.

Another focus is packaging investigation guidance into an automated workflow rather than only surfacing alerts. In DLP operations, analysts need enough context to decide whether an event is a policy violation, a benign business action, or a sign of insider risk. MIND says Issue Investigator provides that context.

"Every organization has sensitive data that is unique to its business," said Tom Mayblum, VP of Product at MIND. "The Autonomous DLP Analyst allows security teams to teach the platform what matters most in their environment and quickly understand potential data security issues."