A financial services firm discovers that employees are exfiltrating sensitive client records by copying files to USB drives and by pasting data into personal webmail accessed over HTTPS from company laptops. The existing DLP deployment consists solely of a network-based inspection appliance at the internet egress gateway that decrypts and scans outbound traffic. The security architect is asked to close the identified gaps while minimizing additional decryption infrastructure. Which design change most directly addresses BOTH exfiltration vectors?