1. A method for data loss prevention (DLP) in an endpoint machine having an operating system that has been instrumented with at least one application programming interface (API) hook to provide first information about an event upon invocation of the API hook, comprising: receiving context information generated as an end user interacts with an application executing on the endpoint machine, the context information being distinct from the first information; and upon invocation of the API hook, using the received context information together with the first information to determine whether an action associated with the application involves sensitive data.