Small-footprint endpoint data loss prevention

An endpoint data loss prevention system, comprising:

• a monitor, executing on an endpoint, configured to detect data egress requests from the endpoint to uncontrolled destinations, wherein each data egress request comprises an associated file;
• a local metadata store on the endpoint having stored therein sensitivity metadata, wherein:
• the sensitivity metadata classifies a sensitivity of a respective file and is generated by a cloud-based content sensitivity scanner using deep inspection of the respective file and stored in a cloud-based metadata store, and
• the local metadata store is synchronized with the cloud-based metadata store periodically;
• an endpoint policy enforcer, executing on the endpoint, configured to:
• receive an indication of the data egress requests from the monitor,
• in response to each data egress request, obtain the sensitivity metadata for the associated file of the data egress request, and
• enforce data loss prevention policies on the data egress requests based on the sensitivity metadata;
• and
• an anchor pattern scanner, executing on the endpoint, configured to:
• in response to scan requests associated with unscanned files, classifying the unscanned file as sensitive or non-sensitive based on an anchor pattern scan,
• in response to the unscanned file being classified as non-sensitive, transmit a non-sensitive indication to the endpoint policy enforcer as the sensitivity metadata, and
• in response to the unscanned file being classified as sensitive:
• transmit the unscanned file to the cloud-based content sensitivity scanner;
• receive the sensitivity metadata for the unscanned file from the cloud-based content sensitivity scanner;
• and
• transmit the sensitivity metadata provided by the cloud-based content sensitivity scanner to the endpoint policy enforcer.