What is data exfiltration?

Moving data out of an organisation without authorisation. It is the act itself, which is what makes it the one stage in a theft that can be observed while it is still happening.

How would I know if someone was stealing our data?

By the shape of the transfer rather than its content: an internal host sending far more than it receives, to a destination the organisation has never used, at a time nobody is working, in a volume that does not match what that machine normally does. Any one of those is weak on its own and the combination is not.

Is this the same as DLP?

No, and they answer different questions. DLP inspects CONTENT against policy and asks whether this particular data is allowed to leave, which means encryption, an unmanaged device or an unusual format can all defeat it. This asks whether the shape of the transfer makes sense, which stays visible when the content does not.

What is the difference between a data breach and data exfiltration?

Exfiltration is the act of taking the data. A breach is the outcome and the legal event you may have to declare. The gap between them is usually months, and it is the gap detection exists to close.

What is the difference between a data leak and data theft?

A leak normally implies exposure with no attacker actively taking anything - a misconfigured bucket, a public repository, a mistaken recipient. Theft implies somebody deliberately moving it. Both lose the data; only one has an adversary who will come back.

Can you detect exfiltration if the traffic is encrypted?

Yes, because the measurement is not of the content. How much went out versus came back, to where, how often, for how long and at what hour are all visible on an encrypted connection. The ratio between bytes sent and bytes received is one of the clearest single discriminators there is.

What about data going to a legitimate cloud service?

That is the common case and the hard one, because traffic to a well-known provider is usually permitted and rarely questioned. The signal is not the destination's reputation but whether THIS host has ever sent THAT volume THERE before.

Can you tell the difference between an attacker and an employee taking files?

Not from the network alone, and no honest tool claims otherwise. What the network shows is that an unusual volume went to an unusual place from a specific machine at a specific time. Who was at the keyboard, and whether they were authorised, is an investigation that starts from that evidence.

What counts as an unusual destination?

One this organisation has no history with. A first contact is not suspicious by itself - every destination is new once - which is why it carries weight only alongside the volume, the direction and the timing.

What do we get when something fires?

The internal host, the destination, how much moved in each direction, when it started and how long it ran. That is enough to decide whether to isolate the machine and which data owner needs to be in the room.

How to Tell If Someone Is Stealing Your Data

How would you know if someone was stealing your information?

It is an uncomfortable question because for most organisations the honest answer is that they would not, until somebody outside told them. Theft has to travel, and travelling is something you can watch.

MITRE ATT&CK techniques covered: T1048 Exfiltration Over Alternative Protocol · T1567 Exfiltration Over Web Service · T1041 Exfiltration Over C2 Channel · T1020 Automated Exfiltration

Data exfiltration, data breach, data leak, DLP: which is which

Data exfiltration is the act of moving data out of an organisation without authorisation. It is the step, not the aftermath, and it is the only one of these four terms that describes something observable while it is happening.

The other three get used interchangeably with it and mean different things:

A data breach is the outcome and the legal event. It is what you declare to a regulator, usually well after the exfiltration that caused it.
A data leak normally implies exposure without an attacker actively taking anything - a misconfigured bucket, a public repository, an email to the wrong recipient.
DLP, data loss prevention, is a product category that inspects CONTENT against policy, usually on endpoints and in email. It is the closest neighbour and the most common substitution, so it is worth being precise about what it does and does not cover.

Stealing data is a network event

Customer records, contracts, drawings, process recipes, source code, pricing, board papers. None of it is useful to an attacker while it sits on your file server. To have value it has to be moved somewhere they control, and that movement is observable.

This is why the absence of network detection is so expensive after the fact. Without a record of what left, an investigation cannot answer the only questions anybody will ask you: what was taken, how much, and where did it go.

What we look for

Destinations with no history. A host that has never spoken to a given service suddenly sending it a lot.
Volume asymmetry. An internal machine that normally downloads starting to upload, which is a shape change rather than a threshold breach.
Encoded and tunnelled transfers. Data smuggled inside DNS or ICMP to bypass web filtering entirely.
Unsanctioned cloud storage. Uploads to consumer file-sharing and sync services that were never approved for company data.
Source code and documents sent to AI assistants. Increasingly the single largest unmanaged outbound flow in an enterprise, and almost never malicious in intent, which is exactly why nobody is watching it.
Staging behaviour. Large internal collection into one host before anything leaves, which is often the earliest visible moment.

Shadow AI is the new exfiltration path, and it is not an attack

The uncomfortable modern case is not an intruder. It is a capable employee, under deadline, pasting a customer list or a repository into whatever assistant works best. No malware, no intrusion, nothing for an endpoint tool to flag, and your data is now outside your control.

We report which hosts reach which AI services, what volume went, and whether it looks like documents or code. The output is a governance conversation, not an accusation, and we deliberately frame it that way.

What a finding tells you

A verdict with no substance behind it wastes your time. Every finding is built to answer the practical questions: which host and which user context, how many bytes in each direction, what the destination actually is, what else that host touched around the same time, and what to do next. If we cannot say what left, we say that instead of implying we can.