DLP - or equivalent alerting/blocking

Justin_W — Fri, 11 Sep 2026 15:28:47 GMT

Hey all.

I've seen headlines on the built-in DLP setting previously and even dabbled a bit in the pre-made templates.

But I recently was looking to add some additional safety/security into our environment. I thought I was going to find what I wanted in custom DLP rules, but upon investigation, it looks like none of the things I am looking for are available there.

Are you using any custom DLP rules?

Here's what I was hoping to implement:

1.) Alert/quarantine when an email is sent to more than X amount of people (it looks like best I could find was alerting to number of emails sent in a 24 hour period). The idea being that it would help with compromised accounts sending spam.

2.) Alert/Block X number (or percentage) of Drive files downloaded in a short period of time. Again, to minimize potential damage from a compromised account.

3.) Alert upon bulk actions like - mass permissions changes, mass deletes, mass changes.

It's still surprising to me that there's this huge Gemini push and all these features, but still a massive gap between that and functional, practical, and integrated security workflows with AI.

Having just dealt with a phishing email/account compromise it because very clear that the process for investigation, mitigation, and remediation is still very disjointed, time consuming, and labor intensive process.

I suspect there may be some other ways to get the results I want - but I also expect them to be "workarounds" and compromises vs. great solutions.

What are you using (if anything)?

Re: DLP - or equivalent alerting/blocking

zdanenyc — Fri, 11 Sep 2026 16:07:41 GMT

Hello!

We have a bunch in place but one we are considering is limiting the amount of recipients of an email through Quarantine. Feel free to reach out on the side as I don't want to expose many of our security policies in a "public" forum.

Re: DLP - or equivalent alerting/blocking

Kim_Nilsson — Tue, 15 Sep 2026 10:04:41 GMT

In Gmail Compliance you can block sending of emails with more than X receipients.

But you have to build the rule yourself in regex.

^[^@]*(\@[^"]*){51,}$

topic Re: DLP - or equivalent alerting/blocking in Peer-Peer Topics

DLP - or equivalent alerting/blocking

Re: DLP - or equivalent alerting/blocking

Re: DLP - or equivalent alerting/blocking