Bold Security Unveils Intent Engine to Bring User Behavior Analysis to DLP

New capability combines on-device AI data classification with data lineage, behavior analysis, and anomaly detection to identify risky data flows while reducing false positives

NEW YORK, Nov. 12, 2026 /PRNewswire/ -- Bold Security, the AI-powered data loss prevention (DLP) company, today unveiled Intent Engine, a new capability that helps companies understand how employees use sensitive information and stop it from getting into the wrong hands. Bold runs AI directly on employees' devices to identify and protect sensitive company data. Its new Intent Engine goes further, tracking how people use and move information to determine whether their actions pose a security risk. This allows companies to catch everything from deliberate data theft to accidental leaks, without overwhelming security teams with false alarms.

Existing DLP tools rely heavily on regex rules and predefined policies, generating false positives while missing sensitive data that employees have renamed, compressed, or otherwise disguised. They often lack visibility into what people are doing with data as it moves between files, applications, and destinations. Separate insider risk tools can identify unusual behavior, but an action that falls outside someone's normal routine does not necessarily pose a security risk. An employee using a new application for the first time, for example, may trigger an anomaly without putting any sensitive information at risk. Security teams need to understand what data is involved, how it is being used, and whether the activity serves a legitimate business purpose before determining whether an incident requires attention.

Bold addresses these problems through AI that runs directly on the endpoint. Its Data Classification Engine uses small language models to understand sensitive information based on meaning and context. The new Intent Engine builds on that capability by tracking how data moves, identifying attempts to disguise sensitive information, and analyzing user activity against established behavioral patterns. It evaluates these signals alongside data sensitivity, business context, and the potential consequences of an action to determine whether an activity presents a meaningful risk, whether it results from legitimate work, employee negligence, or deliberate misuse.

"DLP has always struggled to distinguish between someone doing their job and someone putting sensitive data at risk," said Nati Hazut, Co-Founder and CEO of Bold Security. "An employee can do something unusual without creating a security problem, while another employee can follow a familiar workflow that exposes confidential information. AI gives us the ability to understand the data and the circumstances surrounding an action, so security teams can focus on activity that actually matters. Intent Engine brings that context together in a single DLP solution."

Intent Engine introduces three capabilities that work together with Bold's existing on-device AI data classification technology.

• Endpoint-native data lineage tracks sensitive information from the moment it appears on a device through subsequent local actions, including downloads, copies, renaming, compression, uploads, and pasting. This gives DLP visibility into where data originated, how it changed, and where it went. By preserving the history of information as it moves between files and applications, Bold can recognize sensitive data even when someone changes its format or appearance.
• Behavior analysis and obfuscation detection identify actions that may conceal sensitive information, including files renamed with misleading extensions, screenshots presented as personal photos, Base64 encoding, compressed archives, and changes to sensitivity labels. Intent Engine evaluates these activities in the context of the underlying data and surrounding workflow, helping security teams identify potential attempts to evade controls without assuming every unusual action is malicious.
• Anomaly detection and user context compare activity against behavioral baselines for individual users, departments, and the organization. Intent Engine considers job responsibilities, data sensitivity, destinations, transfer volumes, timing, and legitimate business workflows to assess whether an action creates risk. An employee transferring a large amount of information as part of an authorized project may pose little concern, while a small transfer of confidential data to an unauthorized destination may warrant investigation. This allows Bold to identify potentially harmful activity even when it falls within normal behavioral patterns or remains below traditional DLP thresholds.

Together, these capabilities allow Bold to assess risk based on the data involved, the actions taken, and the context in which they occur. A user might accidentally expose sensitive information through an otherwise routine workflow, while another might deliberately disguise confidential data before transferring it outside the organization. Intent Engine helps identify both scenarios without treating every deviation from normal behavior as evidence of malicious intent. Security teams can review incidents with the relevant data classification, file history, user context, and explanation of the risk, rather than piecing together evidence from separate DLP and insider risk management systems.

"An unusual action doesn't necessarily mean someone is stealing data, and a routine action doesn't mean the data is safe," said Hadar Krasner, Co-Founder and Chief Product Officer of Bold Security. "Someone might deliberately try to hide sensitive information, accidentally send it somewhere they shouldn't, or simply use a new tool to get their work done. Those situations carry very different levels of risk. Intent Engine looks at the data, the behavior, and the business context together so security teams can understand what actually requires their attention."

Intent Engine is integrated into Bold's existing DLP platform, allowing organizations to add insider risk detection without introducing another endpoint agent or separate security tool.

For more information, visit bold.security.

About Bold Security

Bold is real-time data security for the modern endpoint. Bold runs AI directly on the device to classify data by meaning and context, identify risk in how people and AI interact with it, and prevent data from leaving in the moment, without data ever leaving the device. Bold works from day one with zero configuration, no tuning, and coverage for any data, not only the patterns regex can catch. Learn more at bold.security.

CONTACT: Ignacio Ramirez, [email protected]

SOURCE Bold Security