Patent ID: 8544060

Claim:
A computer-implemented method, comprising: detecting, by an endpoint data loss prevention (DLP) system running on a client computing device, that a local application has accessed a document on the client computing device; determining that the document contains sensitive data according to one or more DLP polices of the endpoint DLP system; determining that a combination of the local application and a type of the document is not included in a whitelist of the DLP policies; capturing at least one of one or more screenshots, and video of one or more operations that the application performs on the document; sending the captured at least one of the one or more screenshots, and the video to an enforcement server associated with the endpoint DLP system; and receiving one or more updated DLP policies from the enforcement server, the one or more updated DLP policies comprising changes based on the captured at least one of the one or more screenshots or the video; wherein the one or more updated DLP policies cause the endpoint DLP system to at least one of blacklist the combination of the application and document type, restrict access to the document, encrypt the document, or move the document to a different location.