A prospect told us recently that he would rather have a root canal than use a DLP. He has run data protection programs for most of his career, so he wasn’t even being dramatic.
A few weeks ago, Gartner® published a report called Coolest Vendor Innovations in Data Security. Jazz is in it.
We have spent the past year saying DLP sucks, on stage, on shirts, on a website built for the purpose, because it was the most useful true thing we could say about the category. So the two facts sitting next to each other deserve an explanation.
The framework was broken, and so was the promise
DLP was sold as prevention. What it produced was a record of things that had already happened. In our State of DLP survey coming out soon, among organizations that had a confirmed data loss incident in the past two years, only 16% said their DLP blocked it before the data left. Everyone else found out afterwards, from another tool, from a person, or during an audit.
The framework explains the gap. For twenty years data protection ran on rules and pattern matching, and a rule can flag that a file moved to a personal account without establishing whether the movement made sense for the person who moved it, the project they are on, or the week they are in. Every one of those judgments needed a human being, and there were never enough human beings, so security teams ended up deciding which risks they accepted based on how many investigations they could staff in a week.
That is how a mailbox folder ends up with forty thousand unread messages in it, and why the category earned the reputation it has.
What the report actually named
The category Gartner named is agentic AI-driven DLP, described as an approach that “replaces static rules with autonomous AI agents that perform deep, context-aware investigations across data, systems, users/identities and business processes, dynamically learning and adapting the security posture.”
Read that as a job description rather than a product category. The interesting word is investigations, because investigating is the part that always required a person.
How Melody sees a data movement
Melody, our agentic investigator, works every data movement across four dimensions: the data itself, the systems involved including whether the destination is a corporate or a personal tenant, the people and how they normally work, and the business process the movement belongs to. Out of those four comes the thing a rule can never produce, which is intent.
What reaches your team is a reasoned incident rather than a raw alert. The evidence is attached and the reasoning is visible, so the verdict is there to agree or disagree with.
You tell Melody what matters in plain English. Zach Lewis, the CISO at UHSP, put it better than our own copy does: “No rules, no regex. I just say I’m FERPA-regulated and it gets it.”
If Melody gets something wrong, you say so in the moment, the way you would correct an analyst. That correction becomes a directive, gets screened against your existing policy for contradictions, and goes live once you approve it.
Underneath all of it is the Endpoint Context Vault, an encrypted rolling buffer that captures context-rich forensics across browsers and desktop applications at sub-0.2% CPU. It includes encryption rewind, so an investigation can look at data as it was immediately before a user encrypted it.
Thirty days, two million signals, eighty incidents
In a thirty-day deployment at a 1,000-person organization, Jazz processed around two million signals, investigated roughly 220,000 potential events, identified about 1,300 real violations and surfaced approximately eighty incidents that deserved a person’s attention.
The number that matters in that sequence is the eighty, because each one arrives already worked. A customer described the experience as “a whole other member of the team doing all this back-end work that no one really wants to do.”
So, the answer to the question in the headline. Jazz understands the business it protects, and everything else comes from that. Understanding is what turns a signal into a verdict you can act on, and what makes it possible to let a machine close the things that never needed you. That is what we mean by cool: a data protection program your team uses on purpose, run by a security team that can tell you the story of its own data on the day somebody asks.
DLP still sucks.*
*Except Jazz. We’re officially a Cool Vendor.
Gartner, Coolest Vendor Innovations in Data Security, Joerg Fritsch, Andrew Bales, Paulo Aresta, Sarah Almond, Niyati Daftary, 26 August 2026.
Gartner and Cool Vendor are trademarks of Gartner, Inc. and/or its affiliates.
Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.
The Cool Vendor badge is a trademark and service mark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved.
