Techniques are disclosed relating to detecting data leaks using targeted scanning. For example, in various embodiments, a scanner module may monitor communications between a user device and a server system, where the user device requests access to a resource provided via the server system. The scanner module may perform various data loss prevention operations to detect the leaking of sensitive data associated with an organization. For example, the scanner module may perform an initial scan of the resource to capture an initial version of the resource at an establishment of a connection between the user device and the server system. The scanner module may perform a subsequent scan that captures a subsequent version of the resource. Based on the initial and subsequent versions of the resource, the scanner module may determine whether any data loss prevention rules have been violated and, if so, initiate one or more corrective actions.