Inside Bold's AI-Powered Data Classification on the Endpoint

Everyone loves to hate DLP. But what they should really hate is the data classification underneath it.

The biggest issue with data classification is that it’s historically relied on deterministic methods. Regular expressions, dictionaries, keyword lists, and other predefined detectors match known characteristics of data rather than understanding what it means or how sensitive it is. That means someone has to define what sensitive data looks like before the tool can reliably see it.

Bad classification creates two different challenges:

1. False positives: a nine-digit string could be a Social Security number or an employee ID. A rule with no context will flag both, so analysts end up spending their time triaging noise.
2. False negatives: On the other side of the coin, it can't match what it doesn't know. Source code, financial models, and unique IP often have no fixed shape to match, so some of the most damaging data to lose is also the hardest to flag with predefined rules.

On top of that, much of modern data classification happens away from the device. DSPM classifies data in cloud storage, and DLP has traditionally inspected traffic at network chokepoints or relied on centrally defined detection logic. But more and more, the endpoint is where sensitive data is created, opened, and moved.

Bold is Different: Semantic AI Classification on the Endpoint

In Bold's pursuit of actually preventing sensitive data loss, we knew we had to rethink data classification and where it had to happen.

Why Bold Uses Purpose-Built AI Models

Accuracy comes first. A model that reads content and determines what it is can recognize source code, a financial model, or other sensitive business content without a rule describing exactly what that data looks like. For company-specific proprietary work, Bold can build a classifier from examples rather than requiring teams to hand-write detection logic.

But that accuracy is not something you get by simply adding an AI feature to a rules engine. Bold's models are built specifically for data security and trained to answer a narrow set of questions about business data, which is what makes them precise enough to use for enforcement.

Why Bold Runs on the Endpoint

Accuracy alone prevents nothing. To prevent data loss, enforcement has to be accurate and fast, before the data is gone. Classification in the cloud introduces a round trip, adding latency between the action and the decision. It can also separate inspection from the richest context surrounding the action on the device: where the data came from, which application is asking for it, and whether a person or an autonomous process is behind the request.

Running locally lets Bold combine an understanding of what the data is with an understanding of what is happening to it, at the moment a decision needs to be made.

How Bold’s AI-Powered Data Classification Engine Works

Bold’s classification engine runs directly on the device deployed by our lightweight agent. It’s built around a shared AI backbone that manages multiple small language models that gather context for every piece of content it classifies.

How it works:

• Delivered by one lightweight agent: A single agent on the device hosts the models and enforcement pipeline. The models do the classification locally, running alongside everything else without disrupting normal workflows.
• One engine, two data contexts: Data in motion is classified during the interaction, whether a person or an AI agent is behind it, before the action completes, so the policy engine can respond with the right decision: allow, coach, justify, redirect, or block. Data at rest is classified through continuous background scanning, so sensitive files sitting unprotected are surfaced before they become a risk.
• Multiple detections, not one label: The small language models are purpose-built to detect regulatory data (e.g., PCI, HIPAA), content type (e.g., financial, IT, HR), business documents (e.g., tax forms, RSU grants, financial statements), how confidential the data is, and more. Organizations can add custom classifiers for their own proprietary data from a handful of examples. All of that context is used when making decisions.
• A shared AI backbone: Most of the computation happens once, on a shared model, with smaller expert models producing each output. That’s what makes four dimensions affordable on a laptop instead of four separate passes over the same content.
• External labels layer in: Microsoft Information Protection labels, Google Drive classification labels, and labels from DSPM providers like Cyera, Sentra, and Varonis become additional classification input rather than being replaced.‍
• User & behavior context are factored in: Knowing data is sensitive is only half the equation. The other half is the behavior around it, and Bold benchmarks each user against their own history and the rest of the organization to tell routine work from real risk.‍
• Lineage is captured automatically: Bold traces where a file came from, how it changed, and where it moved across the device. Investigations that used to mean correlating logs across sources take minutes, with the full story in one view.‍
• Feeds into our enterprise platform: Classification results from every endpoint roll up into one view of alerts, posture, and risk. Your team can customize classifiers, manage policy across the fleet, and approve the policy Bold generates.

The Result

Bold's AI-powered data classification was built to produce fewer false positives, provide coverage of proprietary data out of the box, and, most importantly, put the "prevention" back into DLP.

• Prevention over detection: When classification isn't accurate enough, teams are forced toward broad policies, endless exceptions, or monitor-only deployments. Bold is accurate enough that teams can turn blocking on and leave it on.
• Block risk, not work: Classification tells Bold what the data is; endpoint context tells Bold what’s happening to it; policy combines the two. A financial model going to a personal account gets blocked. The same file going to an approved work application gets left alone. And when the intent is unclear, Bold can coach the user or ask them to justify the action instead of guessing.
• Coverage without classification rules: Every new data type and workflow can require new detection logic, so coverage depends on how many people you have maintaining it. Bold doesn't require teams to write and maintain classification rules for every data type. And for proprietary data no vendor could know about, Bold builds a classifier from a few examples instead.
• Nothing leaves the device: The models run on the endpoint's own resources, so no file content is sent anywhere to be classified, classification keeps working on a disconnected laptop, and there is no per-decision cloud or token cost.

Get in touch to see Bold’s on-device AI data classification in action.