Achieving Fine-Grained Control for Data and AI on the Endpoint feat. Cresta Security Engineer

The most sensitive work in any organization now happens on the endpoint, and traditional DLP can’t keep up with it. In this webinar hosted by TechStrong, Michael Roberts, Security Engineer at Cresta, and Or Guz, VP of Customer Success at Bold Security, sit down for a practitioner deep dive on endpoint data loss prevention in the age of AI. They cover why static data classification and tagging break down at scale, how to attribute activity when no person is at the keyboard, what everyday enforcement gets wrong, and why blunt blocking eventually pushes teams to weaken or disable it. The through line: context about the data, the user, and the destination is what separates real risk from routine work, and it’s what lets you stop data loss without stopping the business. Topics covered: How AI changed data security, trust boundaries, and endpoint risk Shadow AI: unapproved AI tools, personal accounts, CLIs, and MCP servers on employee machines The new egress channels: copy and paste, clipboard activity, browser uploads, terminal commands, AI agents, and API calls to model providers Why regex-based data classification, tagging, and allow lists go stale at enterprise scale Alert fatigue, false positives, and the cost of alerts with no context behind them Anatomy of a data incident investigation: gathering evidence, chaining it, and acting on it Which context matters most: user role, department, peer behavior, and statistical deviation from normal Attribution for agentic workflows when there is no human at the keyboard Prompt injection, rogue MCP servers, and agents acting on instructions the user never gave Data lineage on the endpoint: where a file came from, what the user did with it, and where it went Monitoring vs. blocking: when to enforce, when to log, and the middle ground of user coaching and redirection Everyday cases enforcement gets wrong: source code, approved vendor documents, legitimate external sharing Over-tuning detections and how it hides real exfiltration Security vs. productivity tradeoffs and defining risk acceptance Endpoint agent performance, CPU and memory overhead, and running small AI models locally Where to start: identify the data you care about, learn real operational workflows, keep logging, and test continuously Watch if you are at all interested in endpoint DLP, data loss prevention, insider risk management, AI usage control, AI governance, shadow AI, data classification, endpoint security, data exfiltration, insider threat, SOC alert triage, MCP security, AI agent security, Bold Security, Cresta