A Fraud Prevention Company Builds Data Protection Into Its Customer Promise with ORION Security
How an e-commerce fraud prevention company tracked sensitive data across cloud, endpoints, and AI tools, and built data loss protections that don’t slow employees down.
-case-study(2).jpg)
For a global e-commerce fraud prevention company, protecting customer data is fundamental to its business. The company analyzes order and browser activity to help merchants approve legitimate purchases and stop fraudulent ones, handling large volumes of merchant and customer personally identifiable information (PII) along the way.
When a major customer asked the company to demonstrate that it had a robust data loss prevention (DLP) system, the security team began looking for a more comprehensive solution.
The company's CISO and security engineer were familiar with traditional DLP, which relies on predefined rules and thresholds to identify and protect sensitive data. But they wanted broader protection, including for unstructured business information, and visibility into how sensitive data moved across the systems and applications employees used every day.
After evaluating their options, the team chose ORION Security.
"I'm a best-of-breed person," the CISO says. "It has to do the thing I brought it in for, better than anyone else."
Sensitive Data Wasn't Just Where They Thought It Was
Before deploying ORION Security, the team viewed its DLP approach as fragmented. The company had concentrated much of its data security effort on AWS, where the team assumed most of its sensitive data lived. It had used a data security posture management (DSPM) tool for data discovery and classification in AWS, another data security tool for some use cases, and some DLP rules in Google Workspace.
Those tools could tell the team useful things. What they couldn't do was follow sensitive data as it moved across all the places employees actually worked.
"We initially focused on AWS specifically, assuming that's where most of the sensitive data lived," the security engineer says. After deploying ORION, "we found it in many other systems too; on users' Macs, and now, with AI tools as well."
That distinction matters because employees need to work with data. Developers may download information from AWS to their computers, and customer success employees generate reports for merchants. Data moves through email, browsers, and SaaS applications.
Before ORION, investigating that movement often meant stitching together logs from Splunk, CrowdStrike, Google, Salesforce, and other systems. Even the terminology changed from one application to another. What Salesforce called a "download," for example, Google might call an "export."
In some cases, the work was substantial. Tracking Salesforce exports required a large manual effort because the logs weren't structured in a way that made the activity easy to follow.
ORION gave the team a common view of that movement, including the endpoint, which had been a particularly important gap.
The security engineer saw the difference when that merchant asked about its customers' data on employee Macs. She was able to filter for the activity in ORION and export the results in a few clicks.
Protect your data the moment it moves.
Give us 30 minutes to show you how ORION identifies sensitive data, understands context, and prevents data loss with 95% fewer false positives.
From Defining Sensitive Data to Understanding Its Context
The broader visibility is also changing the way the company thinks about DLP policy.
With traditional DLP, the security team had to decide in advance exactly what it was looking for. A Google Workspace rule, for example, might flag an email or file containing a certain volume of financial information or PII.
The approach works when the risk is defined by the rule. It gets harder when sensitive data is unstructured, or when the important question isn't simply what the data contains but where it came from and where it's headed.
That's particularly important here. The CISO is concerned not only about merchant and customer PII, but also sensitive internal information, including financial information and details about the company's proprietary algorithms. Much of that data is unstructured.
CISO, Global E-Commerce Fraud Prevention Company
And the scale involved is considerable: roughly 80% of the data the company processes through its Databricks environment alone is customer PII.
With ORION Security, the security engineer can start with a source the company already knows is sensitive and build policy around where data from that system should and shouldn't go. A policy might allow data from a particularly sensitive source to move between approved business systems, for example, while flagging attempts to move it to the web, a personal drive, or another unauthorized destination.
"I don't have to define an arbitrary threshold, like 30 Social Security numbers," she says.
The team still uses thresholds with ORION, but as one input to a policy, not the basis of it. When it created a policy to flag transfers of 50 or more PII records, for example, the security engineer found that much of the activity was legitimate business traffic. She raised the threshold to 100 and refined the policy further by excluding specific approved destinations. Instead of treating every large transfer the same way, the policy could account for where the data was going.
Before putting a new policy into enforcement, the team can test it against the previous 30 or 90 days of activity to see what it would have flagged. That helps spot legitimate business activity, adjust the policy, and reduce unnecessary alerts before activating it.
AI Put the Visibility to the Test
Nowhere has that context been more useful than with AI.
The company's leadership actively encourages AI use, and adoption is heavy among both technical and non-technical employees. Gemini, Claude, and ChatGPT are among its approved tools.
But ORION showed the security team that the reality was considerably messier than the approved-tool list suggested.
Employees were using personal AI accounts. Others were signing up for free versions of approved products with their work email addresses rather than using company-licensed accounts. The team could also see employees using unapproved tools, including DeepSeek.
The company had wanted to block personal and free AI accounts, but security needed broader support inside the company to put those controls in place. The security engineer used evidence from the ORION platform to show that sensitive company data was actually moving into those accounts, helping the team make the case to act.
ORION has continued to provide a second set of eyes even after the company added a dedicated AI security product to block personal and free accounts.
The security engineer recently noticed in ORION that employees were still getting through to personal AI accounts that should have been blocked. She took the evidence to the AI security vendor, which confirmed that a bug in its product was allowing the activity.
From Visibility to Enforcement
The company is now beginning to put more of that visibility into action, and the effort required to create, test, and maintain DLP policies matters as the program grows.
The team is preparing to move from monitoring and policy simulation into active enforcement. At the time of the interview for this case study, the security engineer had tested ORION's blocking experience and was preparing to activate the company's first blocking policy, designed to prevent data from known sensitive systems from being uploaded to the web, personal drives, and other unauthorized destinations.
When an offshore employee needed access to a sensitive system, for example, the security team wanted to make sure the employee could do the job without downloading information from it. The security engineer created a targeted policy in ORION Security in a matter of minutes.
As the company moves into enforcement, the team can choose how strongly to respond to different types of activity. ORION can hard-block an action where the policy is clear, warn employees when security wants to change behavior without immediately stopping the work, or allow users to request an exception when there's a legitimate business reason for an action.
Passing DLP Confidence On to Customers
As the company strengthened its DLP program, one large prospective customer it was pitching specifically asked about its DLP capabilities. The concern was understandable: the company would be handling the customer's data, and the customer wanted assurance that it would be protected.
Having ORION Security in place helped the company ultimately win the business, the security engineer says.
That's a tangible example of why DLP has become more than a security control. Businesses’ customers are asking about it and factoring the quality of DLP programs into their decisions to select them—or not. And for a company whose business depends on being trusted with other companies' data, the ability to show how that data is protected has become part of the value it delivers.
-case-study(2).jpg)
-case-study(2).jpg)