At a glance
Trellix was formed in January 2022 from the merger of McAfee Enterprise and FireEye, both acquired by Symphony Technology Group (STG Partners) in 2021. STG acquired McAfee Enterprise for $4 billion and FireEye for $1.2 billion, merging the two into Trellix under a "XDR" (extended detection and response) brand. The DLP capability within Trellix derives primarily from McAfee's DLP Prevent, DLP Discover, and DLP Monitor products — among the oldest enterprise DLP implementations in the market.
What Trellix DLP actually is
Trellix DLP is the McAfee Enterprise DLP product portfolio operating under the Trellix brand. The core architecture — network inspection appliances, endpoint agents, and a centralised management console — dates from the mid-2000s. The product functions as designed for organisations whose data environments have not materially changed since deployment. For organisations moving to cloud, SaaS, and modern collaboration platforms, the architecture has fundamental gaps that cannot be bridged by configuration.
Trellix's stated strategic focus is XDR (extended detection and response) — the DLP product line is not a strategic priority. Product investment has been directed toward the XDR platform; DLP maintenance has been handled with minimal new development.
Capability and health assessment
The honest assessment: Trellix DLP is a product in maintenance mode under PE ownership with no clear strategic path to cloud-native capability. VendorAudit scores it at Cap 58 / Health 50 — the lowest combined score of any actively marketed vendor in our coverage. The customer base is primarily legacy enterprises that have not yet migrated, held in place by switching cost and operational inertia rather than product quality.
STG Partners has no disclosed exit timeline for Trellix. The most likely scenarios are: continued PE harvesting, a sale to a strategic acquirer (unlikely given the product state), or a continued decline in commercial viability. For buyers on Trellix DLP, the question is not whether to migrate but when and to what.
Migration and exit
Trellix DLP migrations follow similar patterns to Symantec: policy translation complexity, endpoint agent replacement, and network inspection reconfiguration. The specific migration path depends on your environment: M365-centric organisations should evaluate Microsoft Purview DLP; cloud-native organisations should evaluate Cyera Omni DLP; organisations needing access governance alongside DLP should evaluate Varonis. Budget 6–12 months for a complex enterprise migration and include professional services for policy translation.