Vertex Financial: a DLP program the business has learned to override

Start from the sample, not from the knob

• 46 of 50 sampled incidents are internal account references or test cards. That is a fidelity problem, and raising the built-in SIT confidence to High would also suppress genuine 16-digit cards, so it is the wrong first move.

Changes, in order

1. Exact data matching (EDM) against the actual card/account vault. This is the only change that separates Vertex's real numbers from look-alike internal references, and it removes most of the noise by construction. It depends on a clean, hashed source table and a refresh cadence - get that commitment from the data owner first.
2. Instance counting and proximity on the residual built-in rule: require a plausible count in a single document or message, and use the SIT's supporting evidence (keywords such as card, expiry, CVV) so a bare number alone no longer trips.
3. Split the rule by direction. Internal-to-internal sharing gets a policy tip or audit-only treatment; external sharing keeps the block. Nothing about PCI protection is lost because the exposure is outbound.
4. Run the new rule in simulation over real traffic for two weeks before enforcing, and compare match volume against the current baseline.

What to avoid

• Adding blanket exceptions for the finance document libraries. That hides the problem and leaves the real card data unprotected. Target the pattern, not the location.

Diagnosis

• Override is doing two jobs at once: a genuine business exception path and an escape hatch from a noisy rule. While 92% of incidents are false positives, users are behaving rationally - the fix is the rule first, the override second.

Redesign

• Remove override entirely on the external-sharing path for items that carry the PCI label or an EDM match. Block means block for the highest-risk case; provide a documented exception route through the service desk instead.
• Keep override on the lower-severity paths, but require a justification and add a link to the policy tip that explains what a valid justification contains. Vague text is the symptom of an unexplained control.
• Configure alerts on override events with aggregation and a threshold (for example, more than three overrides by one user in 24 hours), so repeat overriders surface as an investigation rather than a queue of one-offs.
• Use Activity explorer and the alert list to identify the top ten overriders by volume and coach them; if a group overrides weekly for a legitimate reason, that is a rule defect, not user behaviour.

Measure

• Track override rate per rule before and after. A useful target is under 10% of incidents overridden with a substantive justification; anything above that means the rule still does not match how the business works.

What is wrong

• The rule blocks a channel (USB) for everyone rather than blocking sensitive content leaving through any channel. That is a perimeter control wearing a DLP rule's clothes, and it will always generate exceptions because most USB writes are benign.

Fix

1. Scope the rule with a content condition - PCI EDM matches or the Confidential-Finance label - so writing unrelated files to removable storage is unaffected.
2. Use endpoint DLP device control settings to treat the approved encrypted drives as known good where device identification is available, and pair that with an allow-list of restricted app groups so approved sync tools are not caught.
3. Run the retuned rule in audit-only mode for two weeks and review volume by user and by content type before enforcing. This also gives you the numbers to answer the executives.
4. Publish a self-service exception form with a defined turnaround, so the 1,100 tickets become a short, auditable list rather than a queue.

Do not do

• Simply excluding the Finance group from the rule. That leaves the exact content the program exists to protect unmonitored at the point of highest risk.

Report to leadership

• Track blocked sensitive copies versus total USB writes. The first number should be small and real; the second shows the rule is no longer a tax on normal work.