Zscaler — DLP inspection of AI service uploads
Zscaler Internet Access DLP policy that inspects content uploaded to AI services, detecting and preventing sensitive data from being sent to consumer generative AI platforms.
Rule
# Zscaler Internet Access (ZIA) — DLP Policy for AI Service Uploads
# Navigation: ZIA Admin Portal > Policy > Data Loss Prevention
#
# DLP Rule: Block Sensitive Uploads to AI Services
#
# Rule order: Place after sanctioned-AI DLP exceptions
#
# Web Application Rules:
# - Name: AI Service Sensitive Data Upload Prevention
# - Cloud applications: select all apps in 'AI/ML Applications' category
# OR specify: ChatGPT, Claude, Gemini, Perplexity, DeepSeek, Mistral
# - File types: All (or scope to: documents, spreadsheets, code files, text)
# - Direction: Upload only
#
# DLP Engines (Settings > DLP > DLP Engines):
# - Engine: AI-Upload-Sensitive-Content
# - Dictionaries (match any):
# - Built-in: Credit Card Numbers, Social Security Numbers, IBAN,
# Passport Numbers, National ID Numbers, Health Insurance Claim Numbers
# - Custom dictionary: Internal-Project-Codenames (regex-based)
# - Custom dictionary: Source-Code-Patterns (file extensions + syntax markers)
# - Custom dictionary: Customer-ID-Patterns (org-specific format)
# - EDM (Exact Data Match): configure for employee PII, customer PII databases
# - IDM (Indexed Document Match): fingerprint confidential document repositories
# - Confidence threshold: High (reduce FPs at cost of some FN)
#
# Actions:
# - Primary: Block
# - ICAP notification: enabled (if ICAP server configured)
# - User notification: display custom block message with AUP link
# - Incident receiver: AI Governance team email / SIEM webhook
# - Severity: High
#
# Exceptions:
# - Sanctioned enterprise AI instances (match by domain or cloud app instance)
# - Approved AI pilot user groups (synced from IdP)# Zscaler Internet Access (ZIA) — DLP Policy for AI Service Uploads # Navigation: ZIA Admin Portal > Policy > Data Loss Prevention # # DLP Rule: Block Sensitive Uploads to AI Services # # Rule order: Place after sanctioned-AI DLP exceptions # # Web Application Rules: # - Name: AI Service Sensitive Data Upload Prevention # - Cloud applications: select all apps in 'AI/ML Applications' category # OR specify: ChatGPT, Claude, Gemini, Perplexity, DeepSeek, Mistral # - File types: All (or scope to: documents, spreadsheets, code files, text) # - Direction: Upload only # # DLP Engines (Settings > DLP > DLP Engines): # - Engine: AI-Upload-Sensitive-Content # - Dictionaries (match any): # - Built-in: Credit Card Numbers, Social Security Numbers, IBAN, # Passport Numbers, National ID Numbers, Health Insurance Claim Numbers # - Custom dictionary: Internal-Project-Codenames (regex-based) # - Custom dictionary: Source-Code-Patterns (file extensions + syntax markers) # - Custom dictionary: Customer-ID-Patterns (org-specific format) # - EDM (Exact Data Match): configure for employee PII, customer PII databases # - IDM (Indexed Document Match): fingerprint confidential document repositories # - Confidence threshold: High (reduce FPs at cost of some FN) # # Actions: # - Primary: Block # - ICAP notification: enabled (if ICAP server configured) # - User notification: display custom block message with AUP link # - Incident receiver: AI Governance team email / SIEM webhook # - Severity: High # # Exceptions: # - Sanctioned enterprise AI instances (match by domain or cloud app instance) # - Approved AI pilot user groups (synced from IdP)
How it works
Zscaler's cloud-native DLP engine inspects content inline as it transits through ZIA. This policy targets uploads to AI/ML categorized applications, applying dictionaries for PII, PHI, financial data, source code, and proprietary content. Zscaler supports Exact Data Match (EDM) for structured data (employee/customer databases) and Indexed Document Matching (IDM) for fingerprinting confidential documents — both significantly reduce false positives compared to regex-only approaches. Because inspection occurs in the Zscaler cloud, it covers all traffic regardless of the user's browser or client application.
Required data sources
- Zscaler Internet Access (ZIA) with DLP subscription
- Zscaler Client Connector deployed on endpoints
- SSL/TLS inspection enabled for AI service domains
Prerequisites
- Zscaler Internet Access with Cloud DLP licensed (Transformation bundle or DLP add-on)
- SSL/TLS inspection enabled — AI service domains must NOT be in the bypass list
- Zscaler Client Connector deployed to managed endpoints
- DLP dictionaries configured with organization-specific patterns
- EDM/IDM databases populated for structured/unstructured sensitive data (optional but recommended)
Expected volume
After tuning: 15-60 DLP incidents per day per 10k users. Higher in engineering and data-heavy departments. Volume decreases 50-70% within 30 days as awareness builds.
False-positive guidance
Major FP sources: (1) sample/test data in documents containing realistic PII patterns, (2) public code repositories being discussed that match source-code dictionaries, (3) marketing materials with financial-format strings. Use EDM and IDM to dramatically reduce FPs compared to dictionary-only matching. Tune confidence thresholds iteratively.
Tuning steps
- Deploy in log-only mode for 2 weeks and classify every DLP match as TP/FP.
- Adjust dictionary confidence thresholds based on FP analysis.
- Enable EDM for employee and customer PII databases to replace broad regex patterns.
- Enable IDM for confidential document fingerprinting to catch paraphrased content.
- Transition to block mode after achieving < 10% FP rate.
- Review DLP incidents weekly — feed new patterns back into custom dictionaries.
Framework mappings
- NIST AI RMF: GOVERN-4.1, MEASURE-2.7, MANAGE-2.2
- ISO/IEC 42001: 8.2, 8.3, 8.4
- MITRE ATT&CK: T1567.002
- NIST CSF: DE.CM-3, PR.DS-5