1. A method for analyzing data transmitted through a virtual network, the method comprising: under control of a virtual network comprising a substrate network associated with an overlay network, the substrate network comprising a plurality of physical computing nodes, the overlay network at least partially simulated by the substrate network, receiving a data loss prevention (DLP) policy customizable by a user of the virtual network, the DLP policy specifying context criteria and content criteria, the context criteria comprising information about organizational structure or services of the user of the virtual network; configuring the virtual network based at least in part on the DLP policy, wherein the configuring comprises associating the information about the organizational structure or services of the virtual network user with at least one of the substrate network and the overlay network; receiving a network flow transmitted via the virtual network, the network flow comprising information related to the information about the organizational structure or services of the virtual network user; analyzing the network flow to detect a first subset of the network flow that includes matches to at least one of the context criteria; analyzing the first subset of the network flow to detect a second subset of the network flow that includes matches to at least one of the content criteria; and performing an action on at least a portion of the second subset of the network flow.