Best Document Screening Tools for Defense Contractors: What to Look For

Disclosure. Strike Labs builds Strike Gate, one of the tools reviewed here. We have a commercial interest in this market. We tried to describe every product, including ours, by what it is built to do and where it falls short. Capability claims for other vendors come from their public documentation, linked below; we have not independently benchmarked any product's detection accuracy. If we got something wrong, tell us and we will correct it.

Most defense contractors handle several kinds of information at once: commercial and proprietary data, government-furnished information, CUI, export-controlled technical data, and for some, classified material. Each carries different handling and release rules. No single product covers all of it.

Before comparing products, separate three jobs that are often blurred together:

1. Detection — finding content or markings that suggest sensitive information.
2. Labeling — applying and managing classification or sensitivity labels consistently.
3. Enforcement — actually blocking or controlling unauthorized sharing, printing, or transfer.

A tool that does one of these well may do the others poorly or not at all. Know which job you are buying for.

Read this first: no tool makes a system safe for classified work

Every product below runs on an information system. Whether that system may process classified information is decided by its authorization, not by the software installed on it. For cleared contractors, classified processing happens only on systems authorized under the NISP (32 CFR Part 117).

That has two practical consequences:

• Scanning a document on an unauthorized machine does not make it safe to handle there. If a file might be classified, opening it on a commercial laptop or uploading it to a cloud service can itself be a spill. Follow your FSO's procedures, not a tool's result.
• A marking scanner reports what is written on the page. It cannot tell you whether unmarked content is classified, or whether existing markings are correct. Only an authorized classifier, working from the applicable classification guide, can do that (32 CFR 2001.21–22).

The realistic role for these tools on the unclassified side is a safety net: catching documents that carry markings someone missed, flagging CUI before external release, and enforcing CUI handling in approved environments. Treat a clean scan as "no recognized markings found," never as "releasable."

The tools

Listed from broadest scope to narrowest. Order is not a ranking.

Microsoft Purview — enterprise information protection

Best fit: organizations already running Microsoft 365, especially GCC or GCC High tenants handling CUI.

Microsoft Purview provides sensitivity labels, data loss prevention (DLP), auto-labeling, and policy enforcement across Exchange, SharePoint, OneDrive, Teams, and managed endpoints. Labels can drive encryption and sharing restrictions, and Purview features are offered in Microsoft's GCC, GCC High, and DoD clouds.

Strengths

• Central policy management and reporting across the Microsoft estate.
• Labels that carry protection (encryption, access control) with the file.
• Endpoint DLP can block copy to USB, print, and browser upload on Windows and macOS.
• Available in the US government clouds many contractors already use for CUI.

Limitations

• Licensing is complex. Basic DLP is in E3-tier plans; auto-labeling, Teams chat DLP, and endpoint DLP generally require E5, E5 Compliance (now the Purview Suite), or add-ons (Microsoft licensing guidance).
• US classification and CUI marking schemes are not built in; you design the label taxonomy and detection rules yourself or with a partner.
• Strongest inside Microsoft services; coverage elsewhere takes extra work.

Fortra Data Classification (formerly Titus and Boldon James) — labeling and protective marking

Best fit: organizations that need users to classify and visibly mark documents and email as part of normal work.

Fortra acquired Titus and Boldon James in 2020. Both are long-established classification and protective-marking products with customers in military and government. Today they ship as Data Classification Suite and Classifier Suite, which apply visual and metadata labels to documents and email.

Strengths

• Purpose-built for user-driven classification and visual marking (headers, footers, banners) in Office and email.
• Deep heritage in government protective-marking schemes.
• Labels feed downstream DLP, archiving, and governance tools.

Limitations

• An enterprise deployment: needs a classification policy, administration, and user training.
• Focused on applying labels at creation; it is not primarily a tool for screening inbound or legacy files.
• Ask specifically how US CAPCO-style and CUI markings are configured for your environment.

Janusnet Janusseal — classification for defense and government

Best fit: organizations that need users to apply government and defense classification labels to documents and email, with those labels available to downstream controls.

Janusnet is an Australian vendor whose Janusseal suite classifies documents and email. Janusnet lists US CNSI and CUI among its supported classification standards. Janusseal can add visible markings and embedded metadata. Janusnet says email gateways can examine classified messages and block, quarantine, automatically encrypt, or allow them according to organizational policy; embedded metadata can also feed downstream access-control and security integrations. Thales North America selected Janusseal after a competitive pilot (Thales announcement).

Strengths

• Supports government and defense classification schemes, including US CNSI and CUI.
• Applies visible classification markings and metadata to documents and email.
• Integrates with downstream controls, including access-control, DLP, and encryption systems.

Limitations

• Enforcement depends on the configured email gateway, integrations, and organizational policy; verify which actions are controlled in your deployment.
• Confirm the required scheme, clients, and file types with Janusnet for the specific product and configuration.

Google Sensitive Data Protection — programmable inspection in the cloud

Best fit: engineering teams building automated inspection into Google Cloud data pipelines.

Sensitive Data Protection (formerly Cloud DLP) inspects, classifies, and de-identifies data through an API. It ships with many built-in detectors, and teams can add custom dictionary and regular-expression detectors.

Strengths

• Programmable and scalable for large datasets.
• Custom detectors could approximate marking patterns.
• De-identification and masking built in.

Limitations

• Built-in detectors target personal and financial data, not government markings; you would build and test marking rules yourself.
• A cloud service: confirm your data, region, and authorization boundary before sending anything government-related.
• A developer service, not an end-user release-review tool.

GitGuardian — secrets in code

Best fit: software teams worried about API keys, credentials, and tokens leaking through repositories and pipelines.

GitGuardian detects secrets in source code, CI/CD pipelines, and developer workstations, and manages remediation. A self-hosted edition supports air-gapped installation.

Strengths

• Specialized secrets detection with remediation workflows.
• IDE, git hook, and CLI integrations.
• Self-hosted and air-gap options for restricted networks.

Limitations

• Solves a different problem: credentials, not document markings.
• Not a CUI or classified-document screening tool, and not general DLP.

Strike Gate — focused marking inspection

Best fit: individuals and small teams that want a quick, local check for recognizable classification and CUI markings before sharing a file.

Strike Gate scans PDF and Word files for classification banners, portion markings, and CUI indicators. It runs locally rather than sending files to a server, and comes as a web scanner, Office add-in, browser extension, CLI, and MCP server for AI-agent workflows. Pricing is per scan credit rather than per seat.

Strengths

• Narrow focus on US government markings, which the broader tools leave you to configure.
• Local processing; files are not uploaded for scanning.
• Low setup and no enterprise contract for a single user or small team.

Limitations

• Detects markings only. It cannot find unmarked sensitive content or judge whether markings are correct.
• No central administration, organization-wide policy enforcement, or DLP. In supported Outlook clients, the add-in can temporarily block an email send when the pre-send scan flags findings or attachments for manual review. The user can override the block; if scanning errors, the send proceeds. This is a review checkpoint, not a decision that a message is unauthorized. It does not block sharing, printing, copying to USB, uploads, or code commits.
• A young product without the deployment history of the vendors above.
• Limited file-type coverage compared with enterprise platforms.
• Offline behavior depends on the deployment; verify it in yours.

If you need centrally managed, organization-wide enforcement, Strike Gate is not that tool. Its limited Outlook send block is a user-level review step, not a substitute for enterprise policy controls.

Side by side

	Primary job	US gov marking support	Labeling	Enforcement / DLP	Where it runs	Typical buyer
Microsoft Purview	Enterprise labeling + DLP	Configurable; you build it	Yes	Yes (scope depends on license)	Microsoft 365 cloud incl. GCC High/DoD; endpoints	IT/security team
Fortra Data Classification	User-driven labeling and marking	Long government heritage; confirm US schemes	Yes, core	Via integrated DLP tools	On-prem and cloud	Enterprise security/records
Janusseal	Email and document classification	Supports US CNSI and CUI; verify required scheme	Yes, core	Partial; email gateways can act on labels, other controls depend on integrations and policy	Desktop, Microsoft 365, web, and mobile options	Defense contractor security
Google SDP	Programmatic inspection	Custom rules you write	No	No (inspect and de-identify)	Google Cloud	Data/engineering team
GitGuardian	Secrets in code	Not applicable	No	Pre-commit and CI blocking for secrets	SaaS or self-hosted	DevSecOps
Strike Gate	Marking detection before release	Core focus, out of the box	No	Limited Outlook send block (user-overridable; scan errors fail open); no other DLP enforcement.	Locally on the user's device	Individual or small team

This compares documented scope, not tested accuracy. Capabilities vary by edition, license, and configuration. Verify current features with each vendor.

How to choose

Start with five questions:

1. What are we protecting? Classified information, CUI, export-controlled data, personal data, proprietary data, and credentials need different controls. The CUI Registry defines CUI categories and markings.
2. Where does it live? A GCC High tenant, a standalone workstation, a development repository, and a cloud data platform each point to different tools.
3. Do we need detection, labeling, or enforcement? Outlook can pause a flagged send for review, but Strike Gate does not enforce other transfers or decide whether information is authorized for release.
4. Who will run it? Enterprise labeling and DLP need dedicated administrators. A focused scanner does not, but it also does far less.
5. What is the approved environment? Match the deployment to the information's safeguarding and authorization requirements before any real data touches it.

Most mature programs layer tools: enterprise DLP for policy, a labeling product for consistent marking, a secrets scanner in the development pipeline, and possibly a focused marking check before external release. These complement each other; they do not compete.

How to test a vendor

Do not buy from a feature list. Ask every vendor, including us, to run your workflow on synthetic test documents — never real government information.

Build a test set that includes:

• Correctly marked documents (banners, portion marks, CUI designation blocks).
• Common errors: missing portion marks, outdated markings, markings in headers, footers, comments, and embedded images.
• Clean documents that should not trigger alerts.
• Every file type you actually use.

Then measure:

• Missed detections and false positives on that set.
• Network behavior: does any content leave the machine? Watch traffic during a scan.
• Effort: setup time, administration load, and what users actually see.
• Fit: integration with your existing systems and authorization boundary.

The right tool solves a clearly defined requirement and proves it inside your approved environment.

Corrections

Vendors change products often. If any description here is outdated or inaccurate, email <john@strikelabs.io> and we will update it and note the change.

Strike Gate flags patterns for human review. It does not make classification decisions or authorize handling. Follow your organization's approved procedures.