ITsMine Expert & Managed Data Protection Consultant

What is ITsMine?

ITsMine provides Managed Data Protection, usually shortened to MDP, and the company positions its approach under the banner Beyond DLP. To understand what that claims to solve, it helps to be blunt about how conventional data loss prevention behaves in practice. Classic DLP wants an agent on every endpoint, a classification programme that tells it which content matters, and a rule set that decides what to allow and what to block at the boundary. Each of those three is a project in its own right, and each of them is where DLP programmes stall. The classification effort is genuinely large and it is never finished, because the estate keeps producing new data faster than anyone can label the old. The rules produce false positives, and every false positive that stops someone doing legitimate work generates an exception request. Exceptions accumulate. Eventually the policy has so many holes in it that it is technically enabled and practically meaningless, which is the state I find far more often than an outright failed deployment.

The ITsMine pitch is a different shape. It is agentless, which removes the packaging, deployment, exclusion and endpoint-team negotiation that consumes the first several months of a traditional rollout. More importantly, the protection is described as attached to the data itself rather than enforced at a boundary, with the explicit intention that it continues to work after the data has already left the organisation. Detection and response are oriented around the data and its movement rather than around the device the data happened to be sitting on when it moved. That framing is not just marketing positioning. It maps to how the risk has actually shifted, because in a world of software-as-a-service, personal cloud storage, contractors and shared links, the perimeter you would need to block at is no longer a place you control.

The second problem ITsMine addresses directly is encryption-less ransomware: attacks that steal data and extort with it, without encrypting anything. This deserves explaining properly because it broke a widely held assumption. For years, the answer to ransomware was resilience. Segment the network, protect the backups, rehearse the restore, and you could recover without paying. Exfiltration-only extortion removes that escape route. Nothing is encrypted, so a clean restore is available and completely beside the point, because the leverage is the copy the attacker already holds and the regulatory exposure that comes with it. Detection is the harder half of the problem: a great deal of ransomware tooling watches for encryption behaviour, mass renames, volume shadow copy deletion, and an attack that never encrypts produces none of those signals. Controls focused on encryption behaviour can miss this class of incident entirely, which is why data movement, rather than device behaviour, has become the thing worth instrumenting.

Now the honest part, because a vendor page that only lists strengths is not worth reading. No data protection platform removes the need to know what data you hold and where it lives. Agentless deployment lowers the barrier to getting started, and that is a real advantage, but it does not eliminate the governance work: data ownership, retention decisions, and periodic access review are organisational decisions, not product features, and nobody can outsource them to a console. There is a related dependency that gets skipped in evaluations. Any control oriented around data leaving the organisation still depends on identity and access management being sane in the first place. If standing access is over-provisioned, if leavers keep their group memberships, and if every department shares one privileged account, then a data protection platform will diligently detect a large volume of movement that should never have been possible in the first place. That is a finding worth having, but it is a symptom, and treating the tool as the cure is how organisations end up with an expensive alerting problem.

Why ITsMine for UAE Organisations?

Data protection in this market is a legal obligation before it is a security preference. The federal PDPL creates duties around how personal data is handled and what must happen when it is compromised, including assessment and notification. Entities inside ADGM and DIFC operate under their own data protection regimes with their own notification obligations, which is a detail that catches out groups running one security function across both a mainland entity and a free zone entity. Alongside those, the NESA information assurance standards include data protection controls, the CBUAE requirements apply to financial institutions, and DESC applies to entities in scope in Dubai. None of these are satisfied by owning a product. They are satisfied by being able to demonstrate what you did.

Here is the concrete version of that, and it is the argument for a data-centric control in one sentence. After an incident, the questions are what data left, whose it was, and what you did about it. Those are data questions. Device-centric controls answer them poorly, because knowing that an endpoint was compromised, isolated and rebuilt tells you nothing about which records were copied off it beforehand. An organisation whose entire evidence trail is organised around endpoints ends up reconstructing the data story forensically, under a notification clock, from logs that were never designed to answer that question. The organisations that handle these incidents calmly are the ones that instrumented data movement before they needed to, and that is a decision made in a quiet quarter rather than during the event.

The regional practicalities favour a low-friction deployment model too. Most UAE environments I work in are mixed and distributed: head office plus branches, a substantial contractor and outsourced-service population, cloud services adopted by individual business units, and an endpoint estate that already carries several agents each with its own exclusion list and its own owner arguing about performance. In that setting, an agentless approach genuinely lowers the barrier to getting a first phase live, because it sidesteps the negotiation that stops most endpoint projects. The trade-off remains the one stated above: the deployment gets easier, the governance does not. If you also need file-level classification and labelling as part of the same programme, that is a different tool category and worth looking at alongside, whether that is Microsoft Purview inside a Microsoft 365 estate or a dedicated classification product. For the broader picture of how this fits with the rest of the stack, see my cybersecurity consulting services.