Methods and systems for Data Leak Prevention (DLP) in an enterprise network are provided. According to one embodiment a data leak protection method is provided. A network device receives information regarding a watermark filtering rule, including a sensitivity level and an action to be applied to files observed by the network device matching the watermark filtering rule. The network device scans a file attempted to be passed through the network device by locating a watermark embedded within the file and comparing a sensitivity level associated with the watermark to the sensitivity level of the watermark filtering rule. If the sensitivity levels match, then the network device performs the action specified by the watermark filtering rule.