Hi. I work for a small business with about 10-15 remote workers and 3 servers and at least 5 VM. We are wanting to implement DLP and and run vulnerability assessment and penetration tests. We currently have Office 365 and I just found Microsoft Purview while I was investigating ways we could approach (and accomplish) implementation of DLP and VAPT. Would Microsoft Purview be something that could help us do this?
I will suggest that Purview has a lot of power if your data is primarily on OneDrive and Sharepoint or you plan on moving there.
I've used on-prem based DLP solutions and they add a lot of complexity to DLP and data protection architectures.
Likely you'll always have an on-prem component to any DLP solution but once your data is in the cloud DLP is a very powerful tool that no company should do without.
Licensing is also a big decider.
Once your organization is serious about DLP it can make the difference to move to an E5 license.
If this is a factor then you have to broaden your perspective and understand the big list of security tools you get with E5. The interesting thing about going E5 with a small business is it's likely a simple calculation of cost! eg. $50 x users (per month).