1. A method for data loss prevention (DLP) in an endpoint machine having an operating system that has been instrumented with at least one application programming interface (API) hook, comprising: receiving context information generated as an end user interacts with an application executing on the endpoint machine; and upon invocation of the hook, using the received context information to determine whether an action associated with the application involves sensitive data.