Endpoint DLP Test Plan
A vendor-neutral plan for evaluating or validating an endpoint DLP deployment: 174 test cases across 4 sheets, as an Excel workbook you fill in as you go. Use one copy per product you are evaluating, or per environment you are validating.
It names no DLP product. Every row is written as a capability to test rather than a feature to look for, so it applies equally to any endpoint DLP tool.
Download the test plan (.xlsx)Version 7 · Last updated October 9, 2026
What is in it
1. Classification21 rows
Can the tool find the data?
Four use cases: regulatory PII, PHI and card data; intellectual property and source code; financial reporting and material nonpublic information; and bulk exports out of business applications. Covers match counting, confidence levels, exact data match, OCR and nested archives.
2. Policy91 rows
Can it act on what it found?
32 egress channels (GenAI tools, webmail, cloud storage, browsers, USB, printing, AirDrop, RDP and more), scored for Monitor / Warn and separately for Block, because seeing a channel is the easy half. One row per channel per operating system, since a channel that is table stakes on Windows is often advanced on macOS and rare on Linux. A Block timing column records whether each block landed before the data left.
3. Investigations31 rows
What happens after an alert?
Evidence and context, timeline and lineage, pivoting from a user or a file or a destination, insider-risk behaviour, case workflow, privacy controls, response actions, and AI agent activity: which agents run on an endpoint, what they did, and which identity they acted under.
4. Usability31 rows
What does it cost to run?
AI-assisted classification, policy authoring and triage, rollout and change control, agent footprint and user-visible latency, and the end-user experience that decides whether people route around the agent.
A Read Me sheet explains how to fill the workbook in and includes a glossary, and a Scoring Summary rolls everything up with formulas by sheet, by operating system and by maturity tier, and lists every table stakes row that failed, so the totals update as you work. A Change Log sheet records what changed in each version and why, with a map of every row ID that changed, so a scored workbook from the previous version can be ported.
How the scoring works
Every result cell uses the same four values, picked from a dropdown. Leave a cell blank if you have not tested it yet: blank andFail mean different things, and blanks are excluded from the coverage percentage.
| Pass | Works as described. |
|---|---|
| Partial | Works with caveats. Record them in the Notes column. |
| Fail | Does not work, or needs a workaround you would not accept. |
| N/A | Not applicable to your environment. Excluded from scoring. |
Every row also carries a maturity tier, because not all failures are equal:
| Table stakes | The basics. Coverage below 70% means a product cannot cover them, whatever its differentiator score. Individual failures belong in your findings rather than averaged into a percentage. |
|---|---|
| Advanced | Where mature products separate from adequate ones. |
| Differentiator | Few products do this well. A low score is information, not a verdict. |
Test data
The plan refers to these pages for the files and endpoints it asks you to use. Everything here is synthetic. Never use real customer, employee or patient data to test a DLP tool.
- Sample Data: ready-made tables of synthetic PII.
- Data Generator: build a dataset to order, including Luhn-valid card numbers and international identifiers.
- HTTP Post and HTTPS Post: live endpoints for web upload tests.
- FTP & S3 Test: public file-transfer targets.
- Regex Test: a library of DLP patterns, useful for building the credential and secret test files.
Feedback
This plan is a work in progress and suggestions are welcome: a channel we have missed, a test that does not survive contact with a real product, or a tier you would score differently. Get in touch through thecontact page.