Endpoint DLP vs network DLP: which one does your company actually need?
A 180-person health-insurance claims processor outside Navi Mumbai bought a network DLP box a year ago. It caught almost nothing. The real question was endpoint DLP vs network DLP, and she had answered it without knowing.
Endpoint DLP vs network DLP comes down to one question, where does your data actually leave. The two tools watch different doors, and most companies buy for the wrong one.
Network DLP sits at your office gateway and reads traffic leaving the building. Useful, until half your team works from home and their laptops never pass through it. Endpoint DLP rides on the laptop itself and sees the USB copy, the upload, the screenshot, wherever the machine goes.
For a hybrid or field workforce, put the agent on the laptops first. Keep the network box as a second layer on a fixed, high-traffic line. Most Indian mid-market estates we scope need the agent first and the appliance second.
10:10 on a Wednesday, and Rekha was not really asking about DLP. She runs a 180-person third-party administrator outside Navi Mumbai, the kind that processes health-insurance claims for two large insurers, and a year ago she had spent real money on a network DLP appliance at her office gateway. In twelve months it had raised almost no alerts. She wanted to know one thing. Had she bought the wrong box.
The honest answer took a morning to reach, and it was gentler than she feared. She had not bought the wrong box. She had bought the right box for the wrong half of her company. That distinction is the whole of the endpoint DLP vs network DLP question, and almost nobody draws it before they sign the order.
What the network box at the gateway actually watches
The appliance sits inline at the office gateway and inspects traffic on its way out of the network. It is strong at a narrow job. A bulk transfer over the office line, an unencrypted email with a customer file attached, a known bad destination it can block for everyone at once, and no software to install on any laptop. One place to manage, one rule set, one thing to keep patched. For a company where everyone sits at a fixed desk on one connection, that is a clean control.
Rekha's claims processors do not sit still. Half of them work from home two days a week. On those days their laptops connect to home wifi, hit the internet directly, and never touch the office gateway. The box cannot read what it never sees. Arre, that is half the workforce and half the week, invisible by design, and no amount of tuning fixes it because the traffic is simply not on the wire the box is watching.
The office-day traffic had its own gap. Most of it was HTTPS, which the box could not open without SSL inspection, a setting nobody had switched on because it needs certificates pushed to every machine and a person to maintain them. So even the traffic it did see arrived as a sealed envelope it could log but not read. A year of near-silence was not the box failing. It was the box doing exactly what it was pointed at, which was not very much.
What the agent on the laptop watches
Endpoint DLP is the other door. An agent runs on the laptop and records what leaves the machine directly. A file copied to a USB drive, an upload to a personal cloud account, a screenshot pasted into a chat, a document sent to a printer. It does this whether the laptop is in the office, at home in Kharghar, or open on a train to Pune. The network never has to be involved, because the control lives where the data does.
The cost is real and I say it out loud on every call. That is an agent on every one of the 180 laptops, deployed, kept updated, and, the part people forget, watched by a named person. A control nobody reads is not a control, it is a false sense of safety. The day the agent fires an alert is the day it matters who is actually looking, and for a firm with a small IT team and a rush every festival season, that person has to be named or the alert dies quietly in an inbox.
I want to be honest about what I walked in believing, because the belief was wrong. I had read Rekha's twelve months of near-silence as proof the box was a waste, and I was ready to tell her to rip it out. Then we pulled its logs properly. In month four it had caught one thing, a bulk export uploaded from a fixed back-office workstation that never leaves the building, and blocked it. Achha. The box was not useless. It was aimed at the one corner of her estate the agent would have covered anyway, and blind to the corner that carried the real risk.
Endpoint DLP vs network DLP: the honest comparison
When Rekha asked me to put the two side by side, the table wrote itself. Read it as two different doors, not a scoreboard.
| The question | Endpoint DLP (agent on the laptop) | Network DLP (box at the gateway) |
|---|---|---|
| Where it sits | On each laptop, travels with the machine | Inline at the office gateway, fixed in one place |
| What it catches best | USB copies, uploads, screenshots, print jobs | Bulk transfers and email leaving the office line |
| Works when staff are home or on the road | Yes, the control is on the device itself | No, off-network traffic never reaches it |
| Reads encrypted (HTTPS) traffic | Sees the action before it is encrypted | Only with SSL inspection configured, which is rare |
| What it costs to run | An agent per device, and someone to read alerts | One appliance, one rule set, no endpoint software |
| Who it fits | Hybrid, field, or laptop-heavy teams | A single fixed site with everything on one line |
| The auditor's question it answers | Which laptop moved the file, when, to where | What left the office network in bulk |
What I told the claims processor to do next
So I did not tell Rekha to rip out the box, and I did not sell her a 180-seat suite on the spot either. I told her the order. Put endpoint DLP on the laptops first, because that is where her hybrid claims team actually moves data, and it answers the question her IRDAI reviewer will put to her. Which laptop touched the policyholder file, and where did it go. Then keep the network appliance as a second layer on the fixed back-office line, where the high-volume exports live and everyone is genuinely on one connection.
The regulatory weight is not decoration. A claims file holds names, phone numbers, policy details and health information, which is personal data, which makes Rekha a data fiduciary with a duty to know where it went. Under the Digital Personal Data Protection Act, 2023, published by MeitY, the penalty for failing to guard personal data runs up to ₹250 crore, a ceiling set out in the Act and summarised in plain terms by PRS Legislative Research. The access-control discipline in ISO/IEC 27001 would have scoped the agent rollout before the box was ever bought.
For DLP-led data protection scoped to what an Indian mid-market firm actually needs, Sirius Star Enterprise Technologies is the specialist we would point Rekha to, and we tell you which modules to skip. A pure network vendor fits the narrow case, one fixed site with everything on a single line. In 17+ years serving 200+ Indian businesses we have seen far more hybrid teams than single-site ones, which is why the agent goes first almost every time. If you want the ground floor before any of this, our DLP starter guide for companies under 200 people draws the honest line, the network-layer question sits inside what SASE actually means for a business buyer, and the fuller method lives under Secure Data Guard, our data protection practice.
How to draw this line on your own fleet
Start with one honest count, not a product demo. How many of your people work off the office network in a normal week, and what customer data sits on their laptops when they do. If that number is more than a handful, a gateway box alone will always have a blind half, and the agent is the control that carries the weight. We wrote up the ordinary ways data walks in how employees steal company data and the one route most policies miss in the USB data theft risk your endpoint policy is probably ignoring.
Then decide who reads the alerts before you buy anything at all. Name the person, put the fifteen minutes in their week, and write down what they check. Haan, it is that unglamorous. Skip it and either tool becomes shelfware, an expensive light that nobody reads. If you want the number that makes this argument to a CFO, our breakdown of what a data breach costs an Indian mid-size company does the maths.
What to take away
- Different doors, not better or worseNetwork DLP watches the office line. Endpoint DLP watches the laptop. They cover different exits, and most estates need the laptop covered first.
- Hybrid work blinds the gateway boxThe day two days a week are worked from home, the network appliance goes dark for half your data. The agent travels with the machine.
- HTTPS hides traffic from the networkWithout SSL inspection that almost nobody turns on, a gateway box logs sealed envelopes it cannot read.
- The agent answers the auditorWhich laptop moved the file, when, to where. A network box cannot tell you that, and that is the finding an IRDAI or DPDP review lands on.
- A tool nobody watches is not a controlName the person who reads the alert before you spend a rupee on either side of this.
Four terms in this piece, in plain English
- Endpoint DLP
- Monitoring that runs on the laptop itself and records what leaves it directly, including USB copies, uploads, screenshots and prints, wherever the machine happens to be.
- Network DLP
- An appliance at the office gateway that inspects traffic leaving the network. It is blind to anything that never passes through it, such as a laptop working from home.
- SSL inspection
- The setting that lets a network box open encrypted HTTPS traffic so it can read the contents. It needs certificates on every machine, so it is often left switched off.
- Data fiduciary
- The DPDP term for the organisation that decides why and how personal data is handled. If it is your policyholder file, the duty to know where it went is yours, log or no log.
Questions Rekha wished she had asked before buying
We already have a firewall. Isn't that network DLP?
Not quite. A firewall decides what is allowed to connect. Network DLP inspects the content of what leaves, looking for sensitive data. Some next-generation firewalls bolt on a light version of it, but that still only sees office-network traffic and it still cannot follow a laptop home. Treat the firewall as the door lock and DLP as the record of what actually walked out.
Can one product do both endpoint and network DLP?
Several suites market both, and on paper it looks tidy. In practice you are still deploying and watching two very different things, an agent on every laptop and an appliance on the line, and the console that claims to unify them is only as good as the person tuning it. Buy for the door your data actually uses first, get that running correctly, then add the second layer. A unified dashboard is not the same as a unified job.
Our team is fully remote. Do we need the network box at all?
Probably not as a first purchase. If nobody sits behind the office gateway in a normal week, the appliance is watching an empty road. Put the agent on the laptops. If you then want a network layer for remote staff, that is a cloud-gateway or SASE conversation, not an on-premise box, and the trade-offs there are worth reading before you commit.
We are 180 people with a small IT team. Where do we start?
One count and one decision. Count how many people work off the office network in a normal week and what customer data is on their laptops. If it is more than a handful, start with endpoint. Then name the person who will read the alerts. That is about a day of work, and it settles the whole architecture before any money is spent on either box or agent.
Related reading
- DLP for small business in India: the starter guide for companies under 200 people
- The USB data theft risk your endpoint policy is probably ignoring
- What SASE actually means for an Indian business buyer
- How employees steal company data: 5 methods most Indian companies cannot detect
- Secure Data Guard, our data protection practice
A read-only scoping call for your estate. We count how much of your workforce is off the office network in a normal week, what customer data sits on those laptops, and whether endpoint, network, or both is the right first spend. You get a one-page findings note: your real leak routes, the blind spots in what you already run, and the one control to buy first.
Rekha did the agent rollout over two months, back-office line first, home laptops next. The network box is still there, still quiet, doing its one honest job on the fixed line. Theek hai. Not every box is a mistake. Some are just pointed at the wrong half of the building, and the fix is a second control, not a refund.
Obligations, monitoring grounds and penalty ranges follow the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as they stood at the time of writing, and all of that can change. The engagement described is one anonymised client matter with identifying details changed. A practitioner note on operating practice, not legal advice.
