Today, we’re introducing Memories to Cyera Omni DLP. It captures the knowledge your analysts build through everyday alert review and puts it to work on future investigations. The expertise that used to live in people's heads starts living in the system.
Every DLP team carries knowledge that no tool has ever been built to capture. An analyst triaging an alert knows an external vendor is an approved destination for supply chain contracts and contact PII. The engineering team’s Claude Code usage is sanctioned for software development. They close the ticket. The next time that same pattern fires, a different analyst explains it again. The same decision being made twice. In a busy SOC, that’s institutional knowledge your team has spent weeks building, but is lost every time it's needed. Even when the knowledge stays, nobody has the time - or the expertise - to translate it into a policy change. And when an analyst moves on, that hard-earned knowledge goes with them too.
What Memories does
Every alert in Omni DLP is evaluated against three inputs: your policies, the alert's specific context, and any relevant Memories. When an analyst marks a false positive and explains why, Memories captures that judgment - tied to the user, department, or destination that made it relevant. Each memory is context for Omni DLP's triage agent, applied only when a future alert matches those same conditions. The next time a matching alert fires, it's already there.
What makes this work is precision: Omni DLP retrieves only the memories relevant to that alert - not everything the system knows about your environment. Handing an AI model ten pages of instructions causes it to lose focus; targeted retrieval keeps analysis sharp. The quality of the explanation determines what's retrievable: a clear rationale - "this vendor is an approved legal partner for contract review" - can generate a memory from a single feedback entry. Vague feedback requires more signals. Every judgment your team captures adds to it.
How teams are using Memories
Teams use it for two things: clearing known-safe behaviors and raising the bar on what's critical.
The most common starting point is approved-behavior exemptions. A legal team member regularly sends contracts to outside counsel. Every time, it's a false positive. An analyst explains that this destination is an approved partner, and Memories ties that judgment to that user and destination. Future alerts on that pattern resolve without re-triage. The analyst's call is now part of the system's working knowledge, not just a closed ticket.
The same logic scales to the team level. When a product engineering team is approved to use Claude for software development, a department-level memory captures that. Alerts from that team stop consuming analyst time. The same action from someone in finance still fires - because the same behavior can be approved or suspicious depending on who's doing it, and Memories reflects that distinction.
Not every memory is about suppression. Teams also use org-wide memories to sharpen how the AI weighs risk. A memory that instructs the triage agent to treat any exposure of core intellectual property as high or critical applies to every alert, regardless of user or destination. This is risk posture made explicit.
Getting started
Memories is now generally available in Cyera Omni DLP. Visit the Cyera Console to see everything your team has captured. Analysts with alert actions permissions can review and delete memories at any time. Explore the documentation to get started.
Get your AI Security Assessment
.svg)