Resources · POC guide
A vendor’s demo data cannot tell you whether a DLP platform is right for you. This guide helps you evaluate GuardStance, or any data security product, on your own workflows.
Plan Your GuardStance POCA proof of concept should demonstrate how a security product behaves in the workflows that matter to your organization.
With GuardStance, you test against your own document templates, database schemas, and AI workflows—measuring detection accuracy, false-positive rates, endpoint performance, and incident explainability firsthand.
Start with what is most critical or leaks most often.
Who sends this data, with which tool, and where?
Five to ten cases you can call legitimate or risky.
Security alone does not produce realistic results.
One virtual machine (8 vCPU, 16 GB RAM, 250 GB disk), directory access and test endpoints.
Criteria written after the POC make the result meaningless.
No. Synthetic ID numbers and IBANs that pass checksum validation, with your real document templates, give realistic results.
Always test flows that should be allowed. Projects fail on false blocks more often than on misses.
| No. | Scenario | Channel | Expected behavior |
|---|---|---|---|
| 1 | Customer list uploaded to a personal AI account | AI, web | Block, and tell the user why |
| 2 | The same list uploaded to the corporate AI account | AI, web | Allow and record |
| 3 | Source code file copied to a USB drive | Endpoint | Block or warn, as your team decides |
| 4 | Confidential contract sent through personal webmail | Web, email | Block and record the incident |
| 5 | Access key pasted into an AI tool | AI, clipboard | Block |
| 6 | CAD file or formula uploaded to personal cloud storage | Cloud, web | Block and record the incident |
| 7 | Confidential document sent through an unlabeled copy | Endpoint, web | Caught by fingerprinting |
| 8 | Part of sensitive content leaves by copy and paste | AI, web, clipboard | Caught by content analysis |
| 9 | Financial report sent to an approved stakeholder | Allow, with no false block | |
| 10 | User with unusually heavy file activity | Insider risk | Visibility and an incident with context |
| 11 | Scanned document with a list of national ID numbers | Endpoint, discovery | Caught by OCR |
| 12 | File with personal data on an open network share | Discovery | Reported as an overexposed file |
Agree the targets before you start. Your organization sets them.
| Criterion | How it is measured | How to phrase the target |
|---|---|---|
| Detection accuracy | Share of prepared risky samples caught | Risky samples caught at the rate you set |
| False positives | False blocks and warnings on legitimate flows | Maximum acceptable false alarms |
| False negatives | Risky samples that slipped through | Acceptable misses for the critical data type |
| Context awareness | Corporate and personal accounts told apart | A clear difference between scenarios 1 and 2 |
| Explainability | One screen answers who, what, where, which policy and why | Yes or no |
| Performance | Endpoint CPU and memory, and user feedback | Agent stays under its CPU cap, with no complaints |
| Policy speed | Time for a rule change to reach endpoints | Measured in your POC environment |
Correct detection, false alarm or missed incident.
Too broad a rule, a missing exception or a wrong signal?
Tuning should be fixable together, during the POC.
What matters is how well the improvement loop works.
| Topic | Question |
|---|---|
| Location | Where is data detected: on the endpoint, on the network or in the cloud? |
| Recognition | Only number patterns, or also validated identifiers and unstructured assets? |
| AI | Which services, which account distinction, at content level or only by domain? |
| Off the network | Does protection continue for people working from home or on the move? |
| Explanation | Does the incident record say who, what, where, which policy and why? |
| Storage | Where are logs and sensitive data kept, for how long, and who can read them? |
Score each line from 1 to 5 with your stakeholders. The weights are a suggestion.
| Dimension | Weight (out of 100) |
|---|---|
| Detection quality, the balance of false positives and negatives | 25 |
| Coverage of AI and context scenarios | 20 |
| Analyst and operations experience | 15 |
| User experience and performance impact | 15 |
| Architectural transparency and where data stays | 10 |
| Deployment fit | 10 |
| Total cost of ownership | 5 |
Lock in your target data types, real business workflows, and measurable success criteria.
Deploy the appliance, index sample schemas or templates, and configure policies.
Run allow, warn, mask, and block scenarios across endpoints, web, email, and AI.
Compare catch rates, false positives, endpoint resource usage, and analyst explainability against your targets.
