CG3 - Browser Defender: LLM DLP Alerts

The LLM DLP Alerts page in Browser Defender shows administrators when an employee pastes sensitive data — personal information, financial data, or credentials — into conversational artificial intelligence tools (LLM, Large Language Model) such as ChatGPT, Claude, or Gemini. Detection (DLP, Data Loss Prevention) occurs in the browser: the text is never blocked and is never visible to administrators (see below). To access it, open Browser Defender from the sidebar menu and select LLM DLP Alerts. It requires a Browser Defender plan that includes this feature, the Platform Administrator role, and activation in Setup (see below).

This page allows you to:

• Get an overview, for your entire company and over a chosen period, of how many times — and with what severity — employees paste sensitive data into AI tools.
• Investigate a single alert, or a user's history, to decide whether intervention is needed.
• Adjust your company policy (protection mode and level, see below) based on your acceptable risk.

This page is not intended for: activating the feature (Setup > Preferences > Advanced Settings), analyzing browsing, download, or password reuse alerts (pages Browsing Alerts, Dangerous Downloads, Password Reuse), or getting an overview of the extension (page Dashboard, whose DLP alerts counter is just a summary).

The period selector sets the reporting window for the entire page: Last week, Last month (default), Last 3 months, or two date fields always visible for a custom range.

Lists each alert with columns Date, User (name and email), Level, LLM (the AI tool involved), and Data type. Search filters by name or email; Filter restricts by Level, Data Type, or LLM (the complete list of data categories is available by opening this filter on the page); clicking the header sorts by Date, User, or Level. Export downloads the filtered rows as CSV: Date, Email, First Name, Last Name, Domain, LLM, Danger Score (the internal numeric value from which the Level column label is derived), Level, Data Types.

One row per user, with columns User (name and email), Total Alerts, and Last Alert Date; sortable by any column.

NOTE: the Export of this tab has different columns from those on screen — Email, First Name, Last Name, Total Alerts, LLMs, Data Types — without Last Alert Date but with detail of LLM and data types per user.

Each alert has one of three severity levels: Low, Medium, or High. In the summary card and in the chip shown in the Alert Log, the highest level appears as Critical; in the Filter menu and in CSV export the same level appears instead as High: it is the same severity band, shown with two different labels depending on the location on the page.

In Setup > Preferences > Advanced Settings, under "LLM DLP":

When an employee pastes text into a monitored AI tool, the extension analyzes it in the browser — comparing it against known patterns of sensitive data, without sending it to external services — and calculates a risk level, with no perceptible delay.

NOTE: pasting is never blocked — the text always reaches the AI tool, regardless of the severity detected: the feature detects and reports, it does not prevent. Only the classification reaches the backend (severity, data type, tool), never the pasted text: only in Alert mode can the employee choose to share it via a dedicated feedback control, and even then it does not appear on this page or in any other administrative view: text voluntarily shared is accessible exclusively to the LibraCyber team for alert verification.