Data leakage is accidental exposure of sensitive information, often caused by misconfiguration or human error. A data breach is unauthorized access to confidential data, regardless of whether anything is removed. Data exfiltration is intentional copying or transfer of data to an attacker-controlled destination. The distinction matters because each requires a different detection and response strategy.
Why This Matters for Security Teams
Confusing data leakage, data breach, and data exfiltration leads to the wrong control response. Leakage usually points to preventable exposure, such as an open bucket or over-shared file. Breach is about unauthorized access, even if the data never leaves. Exfiltration is the attacker’s end goal: moving data out to a destination they control. That distinction changes whether the priority is configuration hardening, access investigation, or containment.
This matters even more when secrets are involved, because leaked credentials can become the fastest path to a breach and then exfiltration. NHIMG’s Guide to the Secret Sprawl Challenge shows how distributed secrets create avoidable exposure points, while the 52 NHI Breaches Report illustrates how identity compromise often precedes broader data loss. In practice, many security teams discover the difference only after an alert has already moved from misconfiguration to account abuse.
How It Works in Practice
Operationally, the three terms map to different stages of incident handling. A leakage event is often discovered through scanning, DLP, or cloud posture checks and may be fixed by removing public exposure, revoking a shared link, or rotating a secret. A breach requires investigation to determine whether access was authorized, how the actor entered, and what systems or identities were touched. Exfiltration demands proof of outbound movement, such as unusual downloads, compression activity, encrypted tunnels, or API-based transfers to external infrastructure.
The cleanest response model is to separate exposure, access, and movement:
- Leakage: identify what became visible, to whom, and for how long.
- Breach: validate whether an unauthorized identity accessed data or systems.
- Exfiltration: trace where data went, what volume moved, and whether it can be recovered or contained.
NIST control guidance in NIST SP 800-53 Rev 5 Security and Privacy Controls helps teams map these stages to monitoring, access control, and incident response. For current threat patterns, the ENISA Threat Landscape remains a useful reference for how attackers combine stolen credentials, cloud abuse, and automated collection. NHIMG’s DeepSeek breach coverage shows how exposed data, exposed secrets, and unauthorised access can overlap in the same event. These controls tend to break down when cloud storage, source control, and SaaS sharing are all governed separately because investigators cannot reconstruct a single chain of exposure and movement.
Common Variations and Edge Cases
Tighter terminology often improves incident precision, but it also increases the burden on analysts who must classify fast-moving events under incomplete evidence. In practice, the same incident can begin as leakage and end as exfiltration, so teams should avoid treating the labels as mutually exclusive.
There is no universal standard for this yet, but current guidance suggests using the following distinctions:
- Leakage without confirmed access is a disclosure problem, not yet a confirmed breach.
- Breach without proven removal still requires containment because access alone can enable later exfiltration.
- Exfiltration may occur through legitimate tools, so “allowed traffic” does not mean “safe traffic.”
One common edge case is sensitive data copied into approved collaboration tools. That can be leakage if permissions were too broad, but it becomes a breach if an unauthorized party could read it, and exfiltration if an attacker later downloads it from that platform. The same logic applies to NHI-related incidents, where stolen API keys or service tokens may turn a simple exposure into a fast-moving compromise. NHIMG’s Ultimate Guide to NHIs — Why NHI Security Matters Now and the LLMjacking report both show how quickly exposed credentials can become attacker-controlled access. The practical takeaway is simple: classify by exposure, then validate access, then confirm movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 | Monitoring helps distinguish leakage, breach, and exfiltration in live incidents. |
| NIST SP 800-63 | IAL2 | Identity assurance matters when confirming whether access was authorized. |
| OWASP Non-Human Identity Top 10 | NHI-01 | Exposed non-human identities often turn leakage into breach and exfiltration. |
| NIST AI RMF | MAP 1.1 | Risk mapping supports classifying incidents by exposure, access, and movement. |
| NIST Zero Trust (SP 800-207) | AC-2 | Zero trust limits blast radius when leaked credentials or breached accounts are used. |
Instrument telemetry so exposure, unauthorized access, and outbound transfer are separately detectable.
Related resources from NHI Mgmt Group
- What is the difference between preventing AI data leakage and detecting it after the fact?
- What is the difference between endpoint DLP and network DLP for stopping data exfiltration?
- What is the difference between blocking data exfiltration and detecting it after the fact?
- What is the difference between source control leakage and SharePoint secret exposure?
