We have had DLP Web Prevent, Network Monitor, and Email Prevent running for about 2 years now and I was hoping to be able to introduce VML into our environment by now, but I haven't been able to identify the minimum number of documents needed to use this feature. I've tweaked the DLP policies relentlessly in all this time. We have far fewer False Positives now, but we do have a lot of Business Use incidents that I'd like to reduce my interaction with them as much as possible, and start notifying or even blocking the real security incidents.
Does anyone here have any advice or experience with VML? Have you had to use the Data Insight feature to identify enough samples of good and bad documents?