A Conversation With Jonathan Kreiner

Summary

Jonathan Kreiner of Orion Security describes the company’s approach to data loss prevention (DLP): using AI agents to assess whether a data movement is appropriate in its business context, rather than relying primarily on fixed rules or anomaly detection.

Technology and product approach

• Context-based decisions: Orion considers several kinds of context together:
  • The user or AI agent’s role, department, and organizational relationships.
  • The data’s classification, including whether it is structured or unstructured.
  • The data’s origin, destination, and history across systems.

Kreiner argues that unusual activity alone is a weak signal: employees often perform new but legitimate actions, so anomaly detection should be one input among several.

• Data lineage without file containers: Rather than attaching a container to a file, Orion collects events such as downloads, uploads, renames, copy-pastes, and archiving, then connects them into a data-history graph. The goal is to track the information itself, even when it is copied, transformed, or moved in ways that break file-based tracking.

• Broad telemetry and integrations: The platform can collect activity through endpoint sensors, a browser extension, SaaS integrations, and connections to email infrastructure. It can also use business data from sources such as an identity provider or Salesforce to enrich its understanding. Kreiner says Orion offers dozens of integrations and supports custom connections, including webhooks.

• AI-based DLP versus traditional systems: The speakers describe rule-based DLP as difficult to maintain at scale. Broad rules can create false positives, while narrow rules can miss incidents; organizations can also fall behind as they add policies and channels. Orion’s stated aim is to evaluate data movements across the environments it observes without requiring customers to write a rule for every scenario.

• Deployment and scale: Kreiner says customers can receive alerts from the first day of a proof of concept, without the learning period associated with some UEBA approaches, because the system uses available activity and organizational context. He describes Orion as an “EDR for data,” with most processing performed in the cloud to reduce endpoint workload. He also cites monitoring tens of thousands of endpoints at an early enterprise customer as a company success.

• Investigations and integrations with other tools: Orion offers a web application, API access, and MCP connectivity. Its data history and graphs can support investigations in other security products—for example, determining what data a malware process accessed or exported. The host also discusses using integrations to retrieve answers in tools such as Slack or Claude.

Reviews, guides, and resources mentioned

• Orion’s website offers an interactive DLP threat model.
• The company says it has resources for testing DLP tools against newer threat types and scenarios.
• The interview does not include a hands-on product review or step-by-step tutorial.

Broader analysis

The speakers discuss AI services as a renewed driver for DLP adoption. Restricting employees to approved AI tools may not be sufficient if they can still use personal accounts to upload organizational data. They argue that AI-related data leakage highlights the broader need to understand and protect data movement throughout an organization.

Kreiner says Orion began with DLP because it considers the problem especially difficult and sees the resulting data context as potentially useful for other security applications.

Main speakers

• Jonathan Kreiner — Orion Security; explains the company’s DLP approach and product.
• Daniel — Host of Unsupervised Learning; asks questions and offers commentary based on his experience with security and DLP.