Monitor Dog

Verizon's annual Data Breach Investigations Report (DBIR) is based on real breach data, which is why it tends to surface uncomfortable numbers. The 2026 edition is no exception. Attackers are moving faster, entry points are becoming more practical, and attacks against people are shifting into the work channels employees already trust.

Security investigations usually begin with logs. Teams reconstruct what happened by checking who downloaded which files, where data was sent, and which processes were executed. Incidents involving someone photographing a monitor with a smartphone start differently. In many cases, the logs you would expect to review simply do not exist.

A significant share of enterprise security budgets goes toward DLP solutions. Yet organizations with DLP in place still experience data breaches. This article breaks down what traditional DLP solutions actually cover, why AI-powered screen security takes a fundamentally different approach, and how the two can work together.

Many organizations recognize the need for screen security but struggle to know where to start. A 50-person startup and a 5,000-person enterprise cannot follow the same deployment playbook. The right approach depends on organizational size, industry, and risk profile.

In October 2025, police raided LG Display's factory in Paju, Gyeonggi Province. What investigators found on a suspect's phone told the whole story: hundreds of photographs of internal process specifications and engineering designs, taken with a personal smartphone. The company's DLP solution had not triggered a single alert.

As remote work becomes the norm, the spaces beyond the security team's control have expanded dramatically. An employee's home, a coffee shop, a coworking space — none of these offer the same physical security as an office. And right in the middle of these spaces, a monitor displaying company secrets stays on.

What if someone is quietly filming an employee's monitor with a smartphone while they are working hard? Firewalls and encryption are powerless against this threat. This is Visual Hacking.

A call center agent pulls up a customer's account number, national ID, and loan history — all on screen — while taking an inbound call. A smartphone sits on the desk beside the monitor. At that moment, no DLP alert fires. Call centers and financial institutions handle the most concentrated volumes of customer personal data, yet they often carry the most structurally vulnerable screen security posture.

Many organizations that receive penalties for data protection violations did not intentionally leak information. They are sanctioned for failing to implement the technical measures required to prevent personal data displayed on screens from being seen by unauthorized individuals. The law demands more than outcomes — it scrutinizes process, and screen security is part of that process.

Security incidents are not the exclusive domain of outside attackers. According to research by IBM and the Ponemon Institute, the average cost of an insider-related incident exceeds $16 million per event — and more than half of all insider incidents stem from simple negligence rather than malicious intent. For CISOs, insider threats remain one of the most difficult challenges to address: too strict and you stifle productivity, too lenient and exposure can happen anywhere without warning.

Data Loss Prevention has been a cornerstone of enterprise security for decades. Yet reports of data leaks at organizations with DLP in place continue to surface. This article takes a technical look at what traditional DLP actually protects against — and where its blind spots begin.

Organizations can deploy DLP, disable USB ports, and monitor every email attachment — and still be vulnerable to a form of data exfiltration that bypasses all of it. An employee raising their smartphone and photographing a monitor screen, sometimes called visual hacking, leaves no digital footprint, produces no network traffic, and triggers no security alerts.