Feature
|
miniOrange
|
Trellix DLP
|
| Product Type |
- Standalone, purpose-built DLP platform. Covers Email DLP, Endpoint DLP, and Cloud DLP as an integrated suite, with no dependency on another product.
|
- A legacy endpoint/network security suite built on the former McAfee Enterprise architecture. Sold as separate modules — DLP Endpoint Complete, Device Control, Network Prevent/Monitor, and Discover — bundled together under the broader Trellix security portfolio rather than a single purpose-built DLP product.
|
| Plan Accessibility |
- All DLP features are included across plans without forced upgrades.
|
- Modules are sold individually or in bundles at custom, quote-based pricing (a mix of subscription and perpetual licensing). Trellix does not publish tiered plans, so full DLP coverage typically means purchasing multiple SKUs rather than one included package.
|
| Deployment Options |
- Single unified solution with flexible deployment across Cloud, On-Premise, and Hybrid environments, covering both Email DLP and Endpoint DLP in one product.
|
- Endpoint DLP is available on-premises or via SaaS, but is centrally managed through a separate ePolicy Orchestrator (ePO) server that customers must stand up and maintain. Cloud/email DLP is extended through a partner integration with Skyhigh Security CASB rather than being native to the core product.
|
| Scalability |
- Supports enterprise-scale environments with flexible, cost-effective pricing.
|
- Built for large enterprise environments already invested in the Trellix/ePO ecosystem.
|
| Email DLP |
- Scans outbound emails, attachments, and email body content in real time. Natively integrates with Gmail, Outlook, Zoho Mail, and Exchange to enforce DLP policies before emails leave the organisation.
|
- Monitors Outlook email at the endpoint as part of DLP Endpoint Complete, plus gateway-level email inspection via Network DLP Prevent/Monitor. Native cloud/Office 365 inline email scanning is not built in — it requires a separate Skyhigh Security CASB integration (Sky Gateway) layered on top.
|
| Endpoint DLP |
- Dedicated Endpoint DLP covering USB drives, Bluetooth, external HDDs, Printers, network devices, and web uploads with OCR support. Supports Windows, macOS, and Linux.
|
- DLP Endpoint Complete plus Trellix Device Control cover removable storage, printers, clipboard, and screen capture, with content-aware and OCR-based inspection (Windows). Coverage is strongest on Windows; macOS support has expanded recently but user reviews note clipboard and print protections still lag Windows, and there is no dedicated Linux DLP client.
|
| Cloud & Web App Control |
- Blocks file uploads to unapproved platforms. HTTP traffic monitoring with allow/block domain policies and time-based access controls.
|
- Blocks browser-based uploads (Chrome, Edge, Safari) and tracks sensitive data moving to cloud storage such as AWS S3, Azure Blob, Google Cloud Storage, and Dropbox. Deeper CASB-style control over sanctioned/unsanctioned SaaS apps requires the separate Skyhigh Security integration.
|
| Agentless Protection |
- Email DLP is fully agentless, hence no agent is required on user devices.
|
- Agent-based only. Endpoint DLP requires the Trellix DLP client on every device, managed centrally through ePO; no agentless deployment mode is offered.
|
| Personal Email Access Control |
- Restricts access to personal email accounts (Gmail, Yahoo) on corporate endpoints.
|
- Not documented as a dedicated capability in Trellix DLP data sheets.
|
| Windows |
- Full Windows support across all Endpoint DLP features.
|
- Broad Windows support — Windows 7 through Windows 11 and Server 2012 through 2025 — with ARM/Snapdragon device support added in 2025.
|
| macOS |
- Full macOS support, device control, file monitoring, and policy enforcement.
|
- macOS Mojave through Ventura are supported, with recent additions for Outlook email, AirDrop, clipboard, and browser-upload protection. Limited macOS coverage — such as clipboard and print protection — is more limited than on Windows.
|
| Linux |
- Linux is listed as a supported OS for Endpoint DLP.
|
- No dedicated Linux endpoint DLP client is documented in Trellix's DLP data sheets.
|
| Mobile Device Support |
- Extends DLP policies to iOS and Android via MDM integration.
|
- No native mobile content-DLP. Trellix Mobile Security is a separate Mobile Threat Defense product that assesses device risk (via Intune Conditional Access) rather than enforcing DLP policy on iOS/Android.
|
| Remote Lock |
- Administrators can instantly lock endpoint devices remotely.
|
- Not part of Trellix DLP; remote lock would require a separate MDM/EMM product.
|
| Remote Wipe |
- Securely erases sensitive data from lost, stolen, or decommissioned devices remotely.
|
- Not a native DLP capability. Selective/remote wipe is only available for mobile devices through the separate Trellix Mobile Security integration with Microsoft Intune.
|
| Geo-Tracking |
- Real-time device location tracking from the admin console, combined with remote lock/wipe.
|
- No geo-location or device tracking features are documented for Trellix DLP.
|
| Device Remote Access |
- Administrators remotely access endpoints to diagnose issues and enforce policies without physical access.
|
- Policy management and diagnostics run through the central ePO console, but no dedicated remote-access/diagnostic tool is documented as part of DLP itself.
|
| USB & Removable Media Control |
- Monitor, audit, and log every data transfer from removable storage. Device blocklisting and temporary policy relaxation.
|
- Trellix Device Control blocks, monitors, or makes read-only removable storage, USB, Bluetooth, and CD/DVD devices, with content-aware rules for Windows and macOS.
|
| Advanced Device Control |
- Granular control of USB, printers, external HDDs, and network devices with blocklisting.
|
- Device Control blocks unauthorized device installation and software, and governs printers, clipboard, and screen capture; sold as a standalone add-on or bundled into DLP Endpoint Complete.
|
| Employee Activity Monitoring |
- Comprehensive monitoring, AD session tracking, login monitoring, unusual session capture, and camera/screenshot policies.
|
- Real-time monitoring and event detection with automated end-user coaching and "request justification" prompts when a policy is triggered. Dedicated AD session tracking or login-level monitoring is not called out as a distinct feature.
|
| Screenshot & Camera Policies |
- Policies can restrict screenshots and screen recording to help prevent sensitive information from being shared visually.
|
- Print-screen/screen-capture control is supported as part of endpoint device policies; a dedicated camera-blocking policy is not documented.
|
| Login Monitoring |
- Tracks login activity across endpoints to detect suspicious behaviour.
|
- General incident and event monitoring is available through the ePO console, but dedicated login-level monitoring is not documented as a distinct capability.
|
| Data Discovery & Classification |
- Identifies and classifies sensitive data on endpoints and applies security policies automatically.
|
- A strength of the platform: discovers and classifies data at rest across files, folders, drives, and network storage, supporting 300–400+ content types with standard templates (PII, PHI, PCI) plus custom IP rules, and recognition of Microsoft Azure Information Protection labels.
|
| Insider Threat Detection |
- Identifies unusual email and device patterns indicating insider threats. Real-time alerts on suspicious activity.
|
- Insider-risk signals come through DLP incident/event analytics, end-user coaching, and justification workflows rather than a separately branded insider-threat-detection module.
|
| OCR / Image DLP |
- Uses Optical Character Recognition (OCR) to detect sensitive text within images and enforce data protection policies on image content.
|
- OCR on Windows endpoints (added 2025) extracts text from images, screenshots, PDFs, and scanned documents, with support for most Western and Asian languages.
|
| File Upload Restrictions |
- Prevents upload of unauthorised file types and content classification (PDF, DOCX, XLSX, ZIP, EXE) to unapproved platforms.
|
- Blocks browser-based file and text uploads (including to GenAI/web-chat interfaces) on Windows, and blocks uploads through Chrome, Edge, and Safari on macOS.
|
| Email Platform Integration |
- Direct native integration with Gmail, Microsoft Outlook, and Exchange for real-time outbound email scanning.
|
- Native Outlook monitoring at the endpoint; broader corporate email platforms (Gmail, Zoho Mail) are not listed, and real-time Office 365 inline scanning depends on the separate Skyhigh CASB integration.
|
| IAM Integration |
- Native Identity and Access Management (IAM) integration, miniOrange's own IAM platform provides single-vendor security.
|
- No native IAM platform; identity is handled through Active Directory, with support for reading Azure Information Protection labels.
|
| CASB Integration |
- Cloud Access Security Broker (CASB) integration provides cloud data visibility across SaaS applications.
|
- Available, but only through a separate Skyhigh Security CASB/SSE product and integration — not built into core Trellix DLP.
|
| MDM Integration |
- Mobile Device Management (MDM) integration extends DLP policies to mobile and BYOD devices.
|
- No native MDM module. Mobile risk telemetry and conditional access are delivered via the separate Trellix Mobile Security product integrated with Microsoft Intune.
|
| Active Directory (AD) |
- Active Directory integration for both Email DLP and Endpoint DLP, enabling user-based policy enforcement.
|
- Active Directory integration is supported for identity-based policy enforcement across endpoint DLP.
|
| Unified Security Platform |
- DLP + IAM + CASB + MDM on a single miniOrange platform, one vendor for complete coverage.
|
- DLP, Device Control, CASB (via Skyhigh), and mobile (via Trellix Mobile Security/Intune) are separate products that share the broader Trellix ecosystem and ePO console rather than one natively unified platform.
|
| Regulatory Frameworks |
- Supports compliance requirements for GDPR, HIPAA, ISO, PCI DSS, and RBI regulations.
|
- Ships with pre-built policy templates for GDPR, HIPAA, PCI-DSS, SOX, NIST, ISO 27001, and SOC 2.
|
| Audit Logs & Reporting |
- Comprehensive audit logs for email and endpoint events. Real-time alerts and compliance-ready dashboards.
|
- Built-in incident management, reporting, auditing, and forensics through the central ePO console, with out-of-the-box compliance reporting.
|
| Role-Based Access Control |
- Granular RBAC for dashboards across Email and Endpoint DLP. Custom roles and module-level permissions.
|
- ePO supports separation-of-duties style access control for policy management; granular, module-level RBAC comparable to miniOrange's is not separately detailed in Trellix documentation.
|
| Healthcare |
- Patient records and sensitive healthcare information are protected across email and endpoint channels, helping organisations meet healthcare data security and privacy requirements.
|
- Out-of-the-box HIPAA policy templates and PHI content classification help protect patient data across endpoints, though Trellix does not publish healthcare-specific case studies to the same depth.
|
| BFSI / Finance |
- Financial data and cardholder information are secured with controls aligned to industry and banking regulatory standards, including PCI DSS and RBI requirements.
|
- PCI-DSS policy templates and PII/PCI content classification support financial data protection, aligned to general compliance frameworks rather than region-specific standards like RBI.
|
| Manufacturing |
- Prevents blueprints, designs, and R&D documents from being emailed or transferred externally.
|
- Custom classification rules can protect intellectual property such as designs and R&D documents from being copied, printed, or transferred via endpoint or removable media channels.
|
| Remote Workforce |
- Cloud email and endpoint policies for distributed teams. Supports corporate-managed and BYOD devices via MDM.
|
- Endpoint policies extend to remote Windows and macOS devices; BYOD/mobile coverage depends on the separate Trellix Mobile Security integration rather than a native MDM capability.
|
| IT & Technology |
- Detects code fragments shared via email; prevents code cloning or exfiltration from development machines.
|
- Content-aware endpoint rules and browser-upload blocking can help prevent unauthorised code or IP transfer from development endpoints, though code-specific detection is not separately documented.
|
| Education |
- Protects student and staff data from accidental email disclosure and unauthorised endpoint transfers.
|
- PII classification templates and endpoint controls can be applied to protect student and staff data, though Trellix does not publish education-specific use cases.
|
| 24/7 Support |
- 24×7 global technical support is included across all support plans.
|
- 24/7 support exists as a paid tier (e.g., Gold/Business Support and the Trellix Thrive customer-success program) rather than being included by default with every purchase.
|
| Deployment & Onboarding |
- Fast deployment with guided onboarding included as part of the setup services. Consultation and implementation assistance are provided for all customers.
|
- Deployment requires standing up and maintaining an ePO management server. User reviews note initial setup and policy configuration "can take time and requires proper understanding."
|
| Admin Dashboard Customisation |
- Fully customisable admin dashboard with white-label branding options and configurable widgets.
|
- Administration is centralised through the ePO console; white-label branding or separate dashboard customisation is not documented as an available option.
|
