Introducing the Bold Intent Engine: DLP That Goes Beyond the Data

The point of data loss prevention (DLP) is keeping sensitive data where it belongs, and that starts with knowing what the data is. Bold’s Data Classification Engine reads content by meaning, on the device where the data lives, so every decision begins with what’s at stake.

That handles the clear cases. Source code headed to a personal account is easy to call. The harder cases come down to intent. Did someone expose the company without realizing it, or did they mean to take the data out?

That’s the question the new Intent Engine answers. It weighs the signals that separate a mistake from a deliberate act: activity that’s unusual for this person, data leaving slowly to stay under the radar, files encrypted or disguised to hide what they hold. 

Why Both for DLP?

Data and behavior answer different questions, and each fails in a predictable way without the other.

• Data classification alone: tells you how strictly data needs to be protected. A financial model should never leak, but an employee’s own W-2 has to move eventually. For everything in between, where the data is sensitive and the user is allowed to have it, classification can’t say whether a given movement is a problem.
• Behavior analysis alone: UEBA (or as we’d call it, UDBA: user data behavior analysis) and insider risk tools watch what users do, but they weren’t built to understand data sensitivity. They flag that someone acted unusually, then leave an analyst to work out what was at stake and what the person intended: whether they exposed the company without realizing it, or tried to take the data out on purpose. 

Bold is different: Intent analysis built on data classification

Bold’s DLP starts with the data. Our Data Classification Engine uses small language models on the device to understand what every file contains, and the Intent Engine builds on that.

Content is the one thing a disguise can’t change. Someone hiding sensitive data can make the file name, type, and size look ordinary, but what’s inside stays the same. And when the content is ambiguous, or the file arrived already encrypted, lineage fills the gap: a file that came out of the finance system carries the sensitivity of where it came from.

With both, the Intent Engine can judge whether an action was a mistake or deliberate, so insider risk and data security teams work from the same answer. 

How the Intent Engine Works

By combining data lineage, data sensitivity, anomaly detection, and behavior analysis, Bold understands the intent behind each action, human or agentic. All three depend on data classification by design, so data stays at the center of every decision Bold makes.

Endpoint-native data lineage

Bold traces each file from the moment it appears on the device, through every change, to wherever it goes: downloaded, copied, opened, renamed, compressed, uploaded, pasted, and more.

Each part of that path tells Bold something different:

• Where the data came from shapes how sensitive it is: a file exported from an internal finance system carries more weight than one downloaded from a public website.
• How it changed and where it went say more about intent: whether the receiving account is personal or corporate is a signal, and renaming, compressing, and encoding can all point to an attempt to disguise the data.

Lineage has to be captured on the endpoint, because it’s the one place the whole path is visible. Network tools lose sight of local file activity, and of traffic they can’t decrypt. Browser tools stop at the browser. SaaS integrations see data inside the application and lose it once it’s downloaded. The endpoint is where data from all of those places arrives, changes, and leaves.

Behavior analysis and obfuscation detection

Lineage shows what happened to the data. Behavior analysis reads what those changes say about intent, whether a person or an agent made them. Some behavior is designed to hide the data, and each of these techniques changes it on the device before it travels, so the disguise is easiest to see where it happens. Bold detects:

• Disguised screenshots: an image of an internal system saved as a personal photo. The file genuinely is an image, so Bold catches it by comparing what the image contains with where it came from.
• Renamed files: a spreadsheet relabeled as an image, caught by checking the file’s real type against its extension.
• Encoding and concatenation: a file converted to Base64 or appended to an image at the command line, caught as the command runs.
• Compression: files zipped on the device, with lineage following the data into and out of the archive.
• Label downgrades: a sensitivity label changed to public or personal, compared against what the file contains.

Anomaly detection and user context

Whether an action is normal depends on who (or what) takes it and how it compares to a “normal” baseline. 

Bold has extensive context on who the user is, from role and department to title and departure date, and can distinguish between a human and an agent. And unlike most DLPs that define unusual activity with a fixed volume threshold. Bold learns what normal looks like for each user, their department, and the company, so an outlier among peers stands out even when the action is normal for the person:

• What it learns: the volumes, destinations, and types of data typical of each person’s work, and when they usually work.
• What it compares: data type against destination, and source against destination. Design files going to Canva are routine; a Salesforce export going to Pastebin is not.
• What it flags: a spike against a user’s recent average, a never-used destination, a sudden burst, or a slow drip over several days, across every channel.
• What it weighs: whether the activity fits the user’s role, the destination suits the data, and the timing fits normal work.

Bold’s model reviews each anomaly with that context before raising an incident, and thresholds adjust as analysts mark false positives. Being unusual never makes a harmless transfer an incident, and being common never makes a risky one safe.

The Result?

Unusual behavior on its own never makes a harmless transfer an incident, and a common one doesn’t make a risky one safe. Bold provides the best of both worlds.

• Coverage of what DLP misses: disguised files and unusual movement too small to cross any threshold.
• Fewer false positives: routine work for the role stays low, and each incident arrives with the data, the lineage, the user, and the reasoning behind its severity.
• One deployment instead of two tools: insider risk context built into DLP, from the same rollout.

Get in touch to see it live.