The one data leak DLP can't stop — and how FortiMail Workspace Security's dynamic watermark makes it attributable

There's a class of data leak that virtually no DLP product on the market can prevent, no matter how much you spend on it: an employee opens sensitive information on their laptop, pulls out their personal mobile phone, and takes a photograph of the screen. The DLP doesn't see it. The EDR doesn't see it. CASB doesn't see it. The information leaves the building on a device the enterprise doesn't control, and by the time anyone realises the leak has happened, it's on WhatsApp, on Telegram, in a competitor's inbox, on a public forum. There is exactly one class of defence that survives this scenario — and it's not prevention, it's attribution. This post is about how FortiMail Workspace Security (the productised form of what used to be Perception Point) does it, why the "photograph the screen" attack is now Indian enterprise's biggest under-defended data-leak vector, and what implementing this deployment shape actually looks like.

The frameThe DLP blindspot that nobody wants to talk about

Every mature enterprise in India by now has some layer of DLP. It might be Microsoft Purview if you're an M365 shop, Symantec DLP if you inherited it, Netskope's cloud DLP, FortiDLP for Fortinet fabric customers, or homegrown CASB rules built on top of Microsoft Defender for Cloud Apps. All of these do something useful. All of them share the same fundamental limitation: they can only stop data movement through channels the enterprise controls. Upload to Dropbox? Blocked. Email an attachment to a personal Gmail? Blocked or quarantined. Copy-paste into an external app? Sometimes catchable. USB port write? MDM/EDR handles it. Print? Print-management catches it.

None of them stop this: the user has their phone in their hand, they aim it at their screen, they take a photograph. The photograph goes to Google Photos, then to WhatsApp, then anywhere. The enterprise has no visibility. The DLP records nothing because the user never triggered any of the classical exfiltration signals. Insider-threat detection based on behavioural analytics sometimes flags the pattern ("this user spent an unusual amount of time on document X"), but that's after the fact and doesn't prove the photograph was actually taken.

What FortiMail Workspace Security doesPerception Point's watermark, now in the Fortinet portfolio

Fortinet acquired Perception Point in December 2024, and per the current Fortinet product page has rebranded the platform as FortiMail Workspace Security. Fortinet's own description of the product line covers four modules: FortiMail Cloud SaaS (email), Browser Security, Collaboration Security, and managed 24×7 incident response. The module relevant to this discussion is Browser Security — what Perception Point historically called Advanced Browser Security. It's the module that ships the watermarking capability documented in Perception Point's March 2023 release note on browser-centric DLP.

The mechanism, per Perception Point's own documentation and the current Fortinet product-page language: a lightweight browser extension (per Perception Point, deployable "in Chrome, Edge, Safari, and any other Chromium-based browser," with a Firefox extension listed on Mozilla's addons store) or an equivalent agent sits on the endpoint. When the user opens a page flagged as containing sensitive content — either because the URL matches a sensitive category, the page contains data patterns matching a DLP rule, or an admin has flagged the site — the extension injects an overlay layer into the rendered content. That overlay is a semi-transparent watermark. Per Perception Point's release note, the default watermark string includes a "Confidential – Don't share" label along with the viewing user's identity and the access timestamp. Dynamic watermarks of this kind — the general category, of which Perception Point's implementation is one — are engineered specifically to persist through screen capture and are typically legible when a screen is photographed by a camera; that survives-camera-capture property is what makes the class of control interesting for the leak vector this post is about.

The clever part isn't the technology — semi-transparent overlay watermarks are old news. The clever part is the positioning. This is deployed as a control that changes the calculus of the insider leak. Every employee knows that any screen they view has their identity baked into the pixels. If a leak happens and the leaked material is a photograph of a screen, forensic analysis can read the watermark and identify the leaker by name and by the exact minute they viewed the content. This shifts the psychology of "should I photograph this and sell it" from "risk of getting caught: low" to "risk of getting caught: almost certain." That's a much stronger deterrent than any DLP alert.

How the watermark actually worksWhat's documented, and the honest gaps

The deployment surface that's clearly documented — both in Perception Point's product materials and on the current Fortinet product page — is the browser extension: available for Chrome, Edge, Safari, "any other Chromium-based browser" (Perception Point's phrasing), and Firefox (Mozilla addons store). The extension injects a DOM-level overlay on top of the rendered page content when the user opens a URL or SaaS view that matches a sensitivity policy (URL category, content pattern, or admin-flagged app). The overlay contains, by default, a "Confidential – Don't share" label along with the viewing user's identity and access timestamp — that composition is straight out of the Perception Point release note.

Beyond the browser extension, Perception Point's own product descriptions and third-party summaries use the phrase "browser extension or agent." An agent-based deployment shape does exist as a category; the exact scope — which operating systems, which applications, what admin controls — isn't detailed in the public product page in a way we can cite here. If your evaluation depends on covering content that isn't rendered in a browser (native Outlook desktop, native Office apps, custom Windows apps), that's an explicit question to ask the Fortinet SE at scoping; don't assume the browser extension covers it.

Two structural dependencies of the control — worth understanding upfront

Dependency one: the extension has to be running for the watermark to be present. If the extension is deployed via enterprise browser policy (Chrome Enterprise, Edge for Business, Managed Apple Devices, etc.), the user cannot easily uninstall or disable it. The specific tamper-detection alerting behaviour and console-side telemetry are product-detail items you should ask the SE about; don't assume the specific mechanics without a demo.

Dependency two: if the user can view the sensitive content on a non-managed device, the extension isn't there and the watermark doesn't apply. This is the real coverage boundary. Mitigation is at the identity layer — require managed-device attestation on conditional-access rules for any application flagged as sensitive. That's an identity-team decision, not a FortiMail Workspace Security capability, but it's a prerequisite for the control to be meaningful.

Where this really mattersSectors and use cases where "attribution" is the missing control

Deployment realityWhat rolling this out actually involves

Honest trade-offsWhat this control doesn't do and where you shouldn't over-rely

1. It's a deterrent, not a preventive control

The single most important honest framing: watermarking does not stop leaks. It makes them attributable after the fact. This is enormously valuable — the risk calculus for a would-be leaker shifts dramatically when they know their identity is baked into any photograph — but it's the wrong control if what you need is "stop the data from ever leaving the environment." For that, you still need traditional DLP, CASB, and the whole prevention layer. Watermarking is the last-mile addition to that stack for the photograph-of-screen class of leak specifically.

2. Coverage gaps if device management isn't in place

The watermark only applies where the extension or agent runs. If your sensitive web app is accessible from any device without a managed-device check, the leaker's workaround is trivial: access it from an unmanaged device, no watermark, photograph freely. The prerequisite is conditional access requiring device attestation for the applications you're protecting. Talk to your identity team about wiring this into your M365 Conditional Access, Okta device-trust, or equivalent.

3. UX cost — real but manageable

Employees notice the watermark. Some will complain that it's distracting or affects readability, especially on data-dense dashboards. Tuning the opacity and pattern helps, but expect an adjustment period. Watermarking should be reserved for the applications where the security value justifies the UX cost — not slapped across every internal tool by default. Choose the ~10-20 most sensitive apps in your estate; leave the rest alone.

4. Non-visual data can't be watermarked

API data (JSON responses, CSV downloads) doesn't render visually and can't carry a watermark. If your leak vector is "user downloads the CSV then emails it out," that's traditional DLP territory. If your leak vector is "user views the dashboard on-screen, photographs it," that's watermarking territory. Know which one you're defending against.

5. Legal / employment-law nuances in India

Employee monitoring — which is what watermarking effectively is at a technical level — has legal implications in India. The Information Technology Act plus the Prevention of Sexual Harassment Act plus various labour-law provisions create a matrix of consent, notification, and proportionality requirements. Any watermarking deployment should be paired with updated employee handbook language and consent language in employment agreements, cleared with employment counsel. Don't skip this step; a legal challenge can invalidate the forensic-attribution value of the control.

6. This is one control in a broader insider-risk program

Watermarking works best as part of a broader insider-risk-management program that also includes behavioural analytics (Microsoft Purview Insider Risk Management, or FortiInsight), privileged-access controls, session monitoring, and HR-led awareness programs. Deploying watermarking in isolation gets you the attribution capability but not the early-warning signal that a leak is likely. Both matter.

Where Ogma fitsHonest, brief, not the whole point of the article

Ogma is a Fortinet authorised partner in India for the FortiMail Workspace Security product line, including the watermarking and Advanced Browser Security capabilities. Where we tend to add real value is at the deployment-design layer: helping enterprises decide which specific applications to enable watermarking on (the 10-20 that justify the UX cost), tuning the opacity and pattern so it's captured by phone cameras without frustrating employees, and stitching the forensic-playbook process together with the customer's HR, legal, and IR teams so the attribution capability actually gets used when a leak surfaces. The technology is straightforward once you understand it. The organisational and legal wrap-around is where a partner earns their fee.

Common questionsFAQ

ReferencesSources