How a Large U.S. Brokerage Modernized Data Loss Prevention for Today’s World
-case-study(2).jpg)
This ORION Security case study is about a large U.S. insurance and financial services brokerage with more than $1 billion in revenue and 5,000 employees. The customer manages coverage and benefits for businesses across the country, and is responsible for the safekeeping of personal data for hundreds of thousands of people: Social Security numbers, health records, and financial information.
Protecting that data became significantly more complex as the company grew. It had expanded rapidly through about 120 acquisitions, leaving it with a patchwork of security tools, inconsistent security maturity across businesses, and little centralized visibility. A publicly disclosed data breach sharpened the urgency further.
The brokerage accelerated a company-wide initiative to standardize systems, tools, and security practices across more than 160 locations, while maintaining HIPAA, SOC 2 Type 2, and other evolving compliance requirements
To lead that effort, the company brought in a new CISO in 2025. His mandate was to build greater visibility, consistency, and control across the security environment, including a modern approach to data loss prevention.
A History Of DLP Disappointment
Like many organizations, the brokerage’s security team had struggled to find a data loss prevention (DLP) offering that actually worked. The pattern was familiar: manually configure policies, sift through false positives, and dedicate headcount to noisy alerts. It typically required one or two full-time employees just to manage DLP alerts.
The brokerage already had an enterprise DLP solution in place when the CISO arrived. While the tool included AI capabilities that looked promising on paper, it proved unreliable in practice. Ordinary data was frequently labeled as sensitive, generating so much noise that the team disabled certain features entirely. Improving the system required significant time and investment, and even then, results remained inconsistent.
That changed when his security team discovered ORION Security.
"With ORION, you drop it in and let it do its thing," says the CISO. "You're immediately presented with information you would've had to manually configure in the past."
"There's no question in my mind that ORION has solved for the pain and agony of prior DLP. It's completely changed the DLP landscape."
Discovering Modern, Agentic DLP
As part of his regular practice of evaluating emerging technology, the company’s CISO came across ORION Security through SageTap, a peer intelligence network for technology buyers.
What he discovered was a fundamentally different answer to a problem the industry had been failing to solve for years. While every DLP tool he had evaluated before relied on rules engines with AI bolted on as an afterthought, ORION was built AI-native from the ground up.
Instead of checking static rules, it understands context and intent, surfacing real data movement risks from day one without policy tuning, manual configuration, or the false positive flood that made legacy DLP unworkable.
"I thought, if ORION Security does what it says it’ll do with AI, it's a home run," recalls the CISO.
It quickly became one.
Implementation: Easy Deployment and Communicative Support
The CISO describes deploying ORION Security as “a walk in the park.”
The security team pushed the ORION agent via existing deployment mechanisms, installed the browser plug-in, and immediately gained visibility into data movement. There was no lengthy configuration phase or training period before value appeared.
One challenge surfaced during rapid rollout. Because the brokerage’s acquired businesses all operated different machine configurations and software environments, the ORION agent encountered conflicts on certain systems.
What stood out was ORION’s responsiveness throughout the process. “The team was fantastic about getting to the bottom of it,” the CISO says. “They quickly discovered the problem and knew how to solve it.”
The experience also highlighted an advantage of working with a growing company: direct influence on the product roadmap. At the time of deployment, ORION’s in-app warning feature for personal AI tool usage (see below) did not yet exist. The brokerage’s security team pushed for it as a priority, and now it’s available to all customers.
“Having that influence on ORION’s roadmap was huge,” the CISO says. “We got there faster, and it helped us be successful.”
What ORION Security Found Without Being Asked
Almost immediately, ORION Security surfaced risks that previous tools had missed entirely, without requiring policy tuning, manual configuration, or training examples.
Three use cases rose to the top.
1. Sensitive Data Flowing Into Personal AI Tools
Across the company’s 5,000-person workforce, employees were using personal accounts with ChatGPT, Gemini, and Perplexity to support day-to-day work. But some were also copying company data into those platforms. The security team used ORION to identify and alert on those risks in real time.
They then rolled out a three-stage approach to workforce education and enforcement:
- Monitor behavior and educate users directly
- Display in-app warnings when sensitive data was headed toward personal AI tools
- Block the action entirely
The approach helped employees better understand risky data-sharing behavior while giving the security team visibility into unsanctioned AI usage.
2. Departing Employees Exfiltrating Client Lists
ORION also began flagging another pattern: employees preparing to leave the company and sending client lists to personal email accounts.
The detections helped formalize collaboration between security and HR. HR now alerts security when employees are departing, while the security team shares what ORION is detecting, including large file transfers and uploads to personal email and cloud storage platforms.
The result is a formal insider risk workflow that did not previously exist at the brokerage.
3. Shadow SaaS And Vendor Risk
ORION also surfaced the use of unsanctioned SaaS applications to store and transfer data. Tools like Box, DocuSign, and Adobe Sign were already in use across the brokerage’s various businesses without having gone through formal vendor risk review.
Now, when ORION identifies data flowing to an unsanctioned application, it is flagged for the brokerage’s third-party risk management process. “ORION has really helped our third-party vendor risk management program,” the CISO says.
Protect your data the moment it moves.
Give us 30 minutes to show you how ORION identifies sensitive data, understands context, and prevents data loss with 95% fewer false positives.
Productivity Gains: Reclaiming 2 Full-Time Roles
For the company, one of the clearest measures of ORION’s impact has been operational efficiency.
Legacy DLP was as much a staffing problem as a technology problem. “I literally had to have up to two dedicated folks looking through all the alerts and saying, ‘that’s real, that’s not real,’” says the CISO. “It was a full-time job before.”
With ORION Security, that changed dramatically.
“Now I have one team member who is the SME for ORION. He’s like, ‘I love this thing.’ He logs in every day and looks to see what it tells us to focus on next. It’s not a full-time job anymore. It’s maybe a few hours a day.”
Using ORION and Microsoft Purview Together
The brokerage uses ORION Security and Microsoft Purview as complementary platforms, with each handling what it does best.
ORION manages real-time visibility and control over data movement, identifying where sensitive data is going, who is moving it, and stopping it when necessary, across every platform and application regardless of operating system or cloud environment.
Purview handles data retention and compliance enforcement, using the classifications ORION produces to automatically apply policies at scale.
The goal is a complementary architecture where each tool plays to its strengths, giving the company the coverage and accuracy it needs to meet expanding state and federal compliance requirements.
Why ORION Worked Where Other DLP Tools Failed
The CISO is direct about what makes ORION Security different: it doesn’t require security teams to already know what they’re looking for.
Traditional DLP tools operate on rigid rules and pattern matching. But real-world data is messy. A nine-digit number might be a Social Security number, or it might be a customer reference number. Context matters, and legacy DLP systems struggle to understand it.
ORION’s AI-native approach dramatically reduced false positives while improving visibility into how data actually moved across the organization.
The platform’s agent-based architecture also proved critical in the company’s highly fragmented environment, where acquired businesses still relied on different operating systems, cloud platforms, and security stacks.The agent is “platform agnostic,” says the CISO.
For the brokerage, ORION’s DLP is increasingly important as state-level data regulations continue to expand. Knowing where sensitive data lives, and ensuring it is retained only as long as necessary, is quickly becoming a legal requirement rather than simply a security best practice. ORION Security has become foundational to that effort.
“Before ORION, I hated DLP,” says the CISO. “My message to other CISOs is that you can solve this pain point tomorrow. What are you waiting for?”
