Data Exfiltration
Data exfiltration is the unauthorized transfer of data from systems inside an organization to a destination outside its control, whether by an external attacker or an insider.
Exfiltration Is the Stage That Creates the Liability
An intruder with access has a security incident. An intruder who moved data out has a data breach with notification obligations, regulatory exposure and, for public companies, a materiality question under the SEC cyber disclosure rule. Quantification treats the two differently for that reason, since the loss distributions attached to them are not the same.
The Channels Keep Multiplying
Early exfiltration used file transfers and email attachments. Current activity runs through cloud storage synchronization, API calls to services the organization already allows, DNS tunneling, collaboration platforms and, increasingly, submissions to AI tools that leave no file behind. Each new sanctioned channel is a new route out, and controls built around the previous generation inspect the wrong traffic.
Double Extortion Made It the Objective
Ransomware groups adopted exfiltration before encryption, because stolen data gives leverage over victims who restore cleanly from backup. The practical consequence is that a recoverable incident and a reportable one are now the same incident. Backup quality stopped determining whether a notification obligation exists.
Detection Depends on Watching the Exits
Egress monitoring, volume baselining per user and destination reputation all help, and all degrade as more legitimate traffic flows to external services. Insider cases are hardest, since the access is authorized and only the destination is wrong, which is why mean time to detect runs longer for insider exfiltration than for external intrusion. The AI channel specifically is covered under AI data leakage.
Related Terms
Turn Cyber Risk Into Financial Exposure the Board Can Act On
Security leaders are being asked to defend budgets, prioritize controls, and report cyber risk in the same terms as every other enterprise risk. Kovrr's CRQ Platform models loss scenarios, benchmarks control performance, and gives the C-suite a defensible view of where cyber sits on the balance sheet.
