Endpoint data loss prevention

A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming one or more processors to perform steps of:

• authenticating one or more devices with a cloud-based system using device Identification (ID) information;
• establishing a Hypertext Transfer Protocol Secure (HTTPS) connection to an authenticated device and receiving, for an authenticated device via the HTTPS connection, device-specific Data Loss Prevention (DLP) configurations stored in bidirectional mapping structures associating engines with dictionaries and dictionaries with engines, wherein the DLP configurations define how preventing exfiltration via one or more channels configured as outlets of sensitive data is performed for the one or more devices, the channels comprising endpoint exfiltration outlets operable for exfiltration via data duplication and distribution;
• monitoring traffic of the one or more devices;
• and
• scanning the traffic of the one or more devices using the DLP configurations for the one or more devices, wherein the scanning includes performing text extraction, tokenizing the extracted text by segmenting the text into numeric, alphanumeric, and non-alphanumeric tokens based on delimiter characters, matching the tokens to predefined and custom dictionaries using hash-based lookups and pattern-matching, generating a dictionary score for each dictionary based on matched tokens and dictionary-specific weighting or confidence rules, and evaluating Boolean engine expressions comprising logical operators applied to the dictionary scores to determine whether any DLP engines are triggered, wherein each DLP engine correlates results from multiple dictionaries to identify whether the traffic contains content indicative of sensitive or policy-restricted information, and, responsive to identifying, causing performance of at least one DLP action including blocking the traffic or generating a notification associated with the traffic.