Jazz's accelerator win landed a context-based DLP agent inside Falcon Foundry

Somewhere in the console there is a policy set to monitor instead of block, because it once stopped a finance analyst from mailing a spreadsheet and the ticket landed on someone senior. Teams call that tuning, and what it actually does is keep the queue quiet. Rule-based DLP spent decades producing alerts security teams could not act on ^[2], and the exception list is how the people on shift survived it.

The re-architecture now being sold replaces pattern matching with context classification ^[1]. Jazz chief executive Ido Livneh told theCUBE the company built "a context-first, business-first investigator" that reads not only what is happening to data flows but why, including intent ^[5]. For whoever owns the rollout, that changes the shape of the work rather than removing it. A regex explains itself: when it fires, you can read the rule aloud to the employee whose file it stopped. A model's finding is a judgment about motive, and the appeal is an argument with a conclusion. Those conversations go to HR and legal, and they go through the same person who tuned the policy.

The route to the buyer is the part worth studying. Amazon security chief CJ Moses said judging the accelerator let the sponsors vet thousands of startups against gaps in their own stacks, instead of flying small teams out to meet a few dozen founders at a time ^[6]. CrowdStrike's Daniel Bernard framed the openness as commercial reasoning: security is not a winner-take-all market, and a vendor promising to replace everything else is probably not telling the truth, so you let the customer choose ^[11]. The sponsor gets a screened category entrant it never has to buy. The startup gets distribution. Both quotes came from a broadcast at CrowdStrike's own Fal.Con 2026, where theCUBE was a paid media partner ^[14], so read the growth figures as vendor-supplied. Divide them and the picture is early: pipeline expanding roughly 3.3 times faster than closed revenue ^[15], which is what inbound looks like before it converts.

Moses also argued that exposure time is now the metric that matters, on the grounds that the AI in use today is the worst anyone will ever use ^[13]. The supporting number is CrowdStrike's own: average eCrime breakout time down to 29 minutes, with the fastest observed intrusion at 27 seconds ^[12], about a sixty-fourth of the average ^[16]. That clock belongs to a crimeware operator racing a SOC, a different clock than the one on a departing salesperson syncing a customer list, which is the case DLP usually gets funded to cover. When the renewal deck merges the two, separate them again.

Here is the sort that makes the decision yours. Take last quarter's DLP alerts and put each into one of four boxes: blocked and correct, blocked and wrong (a ticket exists), alerted and actioned, alerted and closed with no action. Boxes one and three justify the license. Box four justifies the triage tier, and box four is precisely what a context-first classifier claims to shrink. If box four holds most of the volume, the bigger number under renegotiation is staffing, and the license price is the smaller half of the conversation.