.png)
The Challenge: Invisible Data Flows in a SaaS-First Organization
UserTesting, a leading customer insight company that helps organizations understand customer perspectives to make better decisions, faced a modern security dilemma. Mike Deonarain, UserTesting’s Director of Security Operations, inherited a DLP strategy that was fundamentally broken for how employees actually worked.
"We didn't have a lot of coverage across our entire suite of applications. Primarily the DLP solution was focused on devices, and looking for anything coming and leaving the device. But especially in our industry, for SaaS and where tech is headed in general, more and more people are operating directly in web-based apps and tools," says Mike.
Legacy endpoint DLP couldn't see data moving between SaaS applications. When employees worked in Google Drive, shared documents via browser, or pasted content into AI tools, that activity was completely invisible to security operations.
The Remediation Crisis
Even when the previous DLP solution detected issues, the response was broken:
- Security analysts had to manually coordinate with employees days or weeks after incidents
- Employees didn't remember details of violations that occurred days earlier
- Alert fatigue and false positives overwhelmed the security team
The AI Acceleration Problem
As AI tools proliferated across the organization, UserTesting's security blind spots expanded exponentially. Employees adopted ChatGPT and other AI platforms faster than IT could evaluate them, creating new data exfiltration pathways that traditional DLP couldn't monitor.
The Solution: One DLP Platform for the Entire Modern Security Stack
Nightfall provides UserTesting with the first DLP solution purpose-built for SaaS-native organizations. They protect sensitive data across Google Workspace, endpoints, AI tools, and collaboration platforms from Nightfall’s single unified platform.
Real-Time Google Workspace Protection Without the Noise
The Risk: Google Drive was UserTesting's primary work environment and their highest-risk data exfiltration vector. Previous solutions either missed violations entirely or generated excessive false positives.
Nightfall's Protection: Native Google Drive integration provides real-time scanning with intelligent rule tuning that minimizes false positives while maximizing detection accuracy. Within 24 hours of deployment, UserTesting gained immediate visibility into previously unmonitored SaaS activity.
The Impact: "Securing data in Google Drive is critical for us. That's where we see the most amount of traffic. It was really nice to see that we had immediate visibility into our SaaS and AI activities. By integrating Nightfall, it was a few minutes to an hour before we started getting data we could act on," says Mike.
Automated User-Driven Remediation Through Slack
The Problem: Traditional DLP forced security teams to chase down employees days after violations occurred. By then, details were forgotten and remediation was inefficient.
Nightfall's Approach: Slack-native integration delivers instant, contextual alerts directly to employees the moment a violation occurs with one-click remediation options and clear guidance on approved alternatives. The transformation was dramatic: remediation rates skyrocketed to 97% by empowering employees to fix issues themselves in real-time.
The Impact: "We configured Nightfall to follow our rules and send automatic Slack messages. We're meeting people where they are, giving them a reason as to why their activity was flagged, along with recommendations and the ability to remediate directly from Slack. That's a huge improvement over what we had before Nightfall. Previously, we were relying on our analysts to remediate either manually or by coordinating with stakeholders," says Mike.
Preventing AI Data Leakage Before It Happens
The Risk: Employees were adopting AI tools like ChatGPT faster than the security team could vet and approve tools for safe use. This potentially could expose sensitive customer and corporate data before security could establish controls.
Nightfall's Advantage: Pre-submission scanning to detect file uploads, clipboard paste in AI prompts before they're sent to external platforms, blocking violations while providing immediate user education. UserTesting achieved zero-delay prevention of AI data exposure across ChatGPT and other AI platforms, with violations caught and remediated in real-time rather than days later.
The Impact: "We're capturing violations before they occur because Nightfall scans prior to someone submitting a prompt to ChatGPT. We're not slowing down employees. We're giving them real-time feedback on how they should be prompting these tools so they can work effectively and securely," says Mike.
Enterprise-Grade Email Encryption Made Simple
The Risk: Google Workspace lacks native email encryption capabilities, leaving sensitive data vulnerable when transmitted externally.
Nightfall's Solution: Email encryption controls embedded within the Gmail interface requires zero end-user training or process changes. Additionally, Nightfall can scan all outgoing emails for sensitive data or corporate IP and automatically quarantine, block or encrypt these emails. Automatic encryption of sensitive emails now protects UserTesting's customer and corporate data without disrupting employee workflows or requiring technical expertise. Recipients can access encrypted emails via a frictionless secure reader experience.
The Impact: "The email encryption is really nice. Google doesn't offer this, which is shocking to me. The fact that Nightfall can do it in such an easy way and secure is huge for us," says Mike.
The Results: Security Operations That Scale With Business Speed
Deployment Measured in Hours, Not Months
Expected deployment timeline: 30-60 days. Actual deployment: Less than 48 hours for endpoint protection.
"The SaaS app deployments have been really straightforward. We expected 30-60 days for deployment, and it was actually less than half of that, which pleasantly surprised us," says Mike. "If you are a smaller company or you're just looking to achieve key things, you could probably deploy all of Nightfall's suite within a day if you really wanted to. It's that easy to configure and integrate."
One Platform Replaces Multiple Fragmented Tools
UserTesting consolidated their entire DLP strategy into Nightfall, eliminating the complexity and gaps created by multiple point solutions while protecting 150+ employees across six critical integrations: endpoint (Windows and macOS), AI apps, Google Drive, Gmail, Slack, and Github.
"Previously, we used to have multiple solutions to accomplish our DLP strategy. Now we have one solution that can cover all of our DLP—whether that's SaaS, AI, collaboration tools, or endpoint exfiltration. We didn't have a solution that was able to do the entirety of all those things as well as Nightfall does," says Mike.
Accuracy That Eliminates Alert Fatigue
With proper tuning and CSM guidance, UserTesting reduced noise, increased actionable findings, and maintained comprehensive coverage. Nightfall’s intuitive design meant the UserTesting security teams could build effective rules without extensive training or operational burden.
"I don't have to spend a ton of time learning how a tool works to get value from it. Nightfall is really intuitive and able to provide accurate, high-value detections without a ton of operational burden," says Mike.
Security Through User Empowerment
Instead of creating security bottlenecks, Nightfall turned employees into the first line of defense through real-time education and self-service remediation.
"Our biggest security vulnerability stems from our user base doing something they intentionally or unintentionally shouldn't be doing. With Nightfall, we're able to build rules that align with our policies, and it alerts employees so they're getting real-time feedback based on the way they're working. It's helping them understand what actions are against our company policy, so the next time they do something like that, they remember," says Mike.
Why This Matters for Modern SaaS Organizations
UserTesting proved that modern DLP doesn't have to choose between security and productivity. By deploying Nightfall's unified platform, they achieved:
- 97% automated remediation rate
- Less than 48-hour deployment across critical systems
- 800+ employees protected across six enterprise applications
- 24-hour visibility into previously unmonitored SaaS and AI, Email, and endpoint activity
- A comprehensive DLP solution replacing multiple fragmented tools
UserTesting chose the only DLP solution built for how employees actually work and that protects sensitive data across Google Workspace, endpoints, AI tools, and collaboration platforms within a single, intuitive platform.
.png)
