One method for developing a data loss prevention model includes receiving, at a processing device, an event record corresponding to an operation performed on a computing device. The event record includes an event type and event data. The method also includes transforming, using the processing device, the event type to an event number corresponding to the event type. The method includes transforming, using the processing device, the event data to a numerical representation of the event data. The method includes associating an indication of whether the event type and the event data correspond to a data loss event with the event number and the numerical representation. The method also includes determining the data loss prevention model using the indication, the event number, and the numerical representation.