1. A method comprising: processing a flow of packets with a data loss prevention sensor using a signature set; diverting any packet that matches at least one signature to an alert database; receiving an alert validity attribute into the alert database; quantifying for each signature contained in the signature set an effect on the change in the number of alerts from its removal; determining with an analytics module whether any signature has a ratio of valid to false positive alerts less than a first threshold; and when at least one signature has the ratio less than the threshold identifying and removing with an adjustment module at least one signature having a ratio less than the first threshold where the signature is removed from the signature set, and repeating quantifying and determining; the method further comprising: annotating at least one signature in the signature set with a signature weighting; including in the metadata for any alert the signature's signature weighting; and removing from quantifying any signature having its signature weighting above a value threshold.