Patent ID: 8800031

Claim:
A method for detecting changes to security classifications of artifacts in a data loss prevention (DLP) system, the DLP system including a DLP policy that identifies one or more classifications and an enforcement rule associated with a classification, comprising: configuring, according to the DLP policy, an artifact state machine that defines a set of artifact security classification states and associated transitions among the artifact security classification states; classifying content of an artifact into a security classification identified in the DLP policy; determining, in association with a DLP component executing on a hardware element and using the set of artifact security classification states and their associated transitions as defined in the artifact state machine, whether a change in the security classification of the artifact has occurred, the change indicative of an attempt to subvert the enforcement rule defined by the DLP policy; and if a change in the classification of the artifact has occurred, generating a notification of the change in the security classification.