New in Forcepoint DLP

This release integrates Forcepoint DLP with the new Forcepoint AI Security solution, extending data loss prevention to AI applications and AI agents. It introduces the following new features:

Note: These features are available only from Forcepoint DLP 10.4.5 and are not included in the Forcepoint DLP 10.4.0 base release. To use them, install the 10.4.5 maintenance release on top of 10.4.0.

AI Security (AI Detection & Response) over DLP Cloud API channel

Forcepoint DLP now extends data loss prevention to sanctioned AI applications by integrating with the new Forcepoint AI Security solution. This integration allows security teams to monitor and mitigate user prompts, file uploads, and AI responses as potential data transfer events. The events are analyzed by Data Protection Service, and DLP incidents are recorded in Forcepoint Security Manager.

Sanctioned AI applications are defined in Forcepoint Data Security Cloud and synchronized into Forcepoint Security Manager (for more information, see New in Forcepoint Security Manager). These AI applications can be selected as a destination in a DLP policy rule over the DLP Cloud API channel.

This solution requires a Forcepoint AI Security license, a provisioned Data Protection Service, and a DLP license which provide access to Forcepoint Security Manager’s DATA module’s DLP policies (i.e. DLP Endpoint, DLP Suite, DLP Network). For more information, see Getting started with AI Security over DLP Cloud API channel.

MCP Gateway (AI Agent Gateway) channel

AI agents can call business applications like Atlassian exactly as an employee would, bypassing DLP inspection and leaving no audit trail. The new Forcepoint AI Security solution addresses this problem with Forcepoint MCP Gateway connectors, which sit between every AI agent or AI application and the business applications it calls. Every call is inspected before it executes. By integrating Forcepoint DLP with the Forcepoint AI Security solution, Data Protection Service analyzes that traffic through a new MCP Gateway channel, and DLP incidents are recorded in Forcepoint Security Manager.

Three resource types - AI Agents, AI Agent Groups, and MCP Gateway Connectors - are defined on Forcepoint Data Security Cloud and synchronized into Forcepoint Security Manager (for more information, see New in Forcepoint Security Manager). AI agents and agent groups can be selected as the source of a DLP policy rule, and MCP Gateway connectors as the destination.

This solution requires a Forcepoint AI Security license, a provisioned Data Protection Service, and a DLP license which provide access to Forcepoint Security Manager’s DATA module’s DLP policies (i.e. DLP Endpoint, DLP Suite, DLP Network). For more information, see Getting started with the MCP Gateway channel.

URL categories for DLP Endpoint

Note: This feature will be supported in the upcoming Forcepoint F1E 26.09 and in an upcoming Forcepoint DSE Agent release. Stay tuned for the respective release notes notification.

Forcepoint DLP can now enforce URL categories on the endpoint web channel. A DLP rule can use URL categories as a destination for endpoint HTTP and HTTPS traffic. DLP inspects data transfers to a categorized site - including an unsanctioned AI site - and can audit or block the transaction from the endpoint.

The solution is available for customers who purchased a DLP Endpoint or DLP Suite license.

For more information, see Supporting URL categories for the endpoint web channel