Forcepoint DLP Endpoint — Data in Use: USB, Print, Clipboard & Screen Capture

① What 'data in use' means on the endpoint

DLP protects data in three states: in motion (leaving over email, web or cloud), at rest (stored in shares, databases and laptops), and in use — the live actions a person takes on their own device. The reason data in use needs its own agent is simple: copying a file to a USB stick, printing it, or pasting account numbers into a chat window never crosses the network gateway in a way a proxy can inspect. Only software on the device can see it.

That software is Forcepoint DLP Endpoint, delivered as the Forcepoint One Endpoint agent. It runs on Windows and macOS, monitors local data activity, controls data in use, and also performs endpoint Discovery on data at rest. Crucially, it works on and off the corporate network, because it holds its own policy engine and a cached set of fingerprints.

② Channel-by-channel control — and the action you take

The agent watches a set of data-in-use channels. Removable media monitors or prevents copying files (or parts of files) to USB drives, CD/DVD burners and Android/WPD phones — and can encrypt-to-USB with a profile key or a user password so data only leaves protected. Print covers drivers that print to a physical device — not print-to-file or print-to-PDF, and it cannot read document metadata. Endpoint Application analyses clipboard cut/copy/paste and other in-app handling; apps are either built-in (hard to evade) or custom (matched by exe/name/URL, which a user could rename to dodge).

Screen capture and the action plan

Screen captures are not analysed for content — the agent can only block-and-audit, permit-and-audit, or permit the capture (and macOS 11 cannot block it at all). Every channel gets an action plan: block, permit, confirm (prompt the user for justification), encrypt with an admin profile key, or encrypt with a user-supplied password. Note macOS does not support the clipboard/application channel at all.

③ Offline enforcement and endpoint Discovery

The headline feature is offline enforcement. The agent carries a local (secondary) fingerprint repository so detection runs on the device itself; it only re-syncs from the management server when its fingerprints go stale. The repository stores partial hashes only, never the original data, and admins set a maximum cache size in MB.

When the machine is disconnected, incidents are stored and queued locally, then synced to the endpoint server — and on to the Security Manager — the moment it reconnects. The same agent also runs endpoint Discovery: it scans the laptop or desktop for sensitive data at rest, can remediate findings, and exposes last/next scan status in endpoint status. So one agent covers data in use and data at rest on the device.

④ Reporting and operations — proving it from the console

Every endpoint event becomes an incident in the Forcepoint Security Manager — with the user, the channel, the matched content and the action taken (blocked, encrypted, confirmed). Analysts triage from the incident queue, exactly as they do for network and web events, so a USB block and an email block sit in the same place.

Endpoint Status and the sync 'X'

To check fleet health, go to Data ▸ Main ▸ Status ▸ Endpoint Status, which lists every registered endpoint. An 'X' flags an endpoint whose policy or profile version is not synchronized — the single most useful read when a user reports 'the new rule isn't applying'. On deployment, agents and policy-engine machines need a direct connection to the management server, and each endpoint registers with an endpoint server.