1. A method comprising: capturing first network data, first host data, first process data, and first user data corresponding to a first flow that includes protected electronic information, the first network data captured by a first sensor of a first endpoint of a network, a second sensor of a second endpoint of the network, and a third sensor of a networking device along a data path corresponding to the first flow; analyzing the first network data, the first host data, the first process data, and the first user data to determine a policy applicable to the first flow; and updating policy data based on an expected network action for the first flow and an actual network action for the first flow.