Coinbase shows why DLP must detect behavior, not just content

At a glance

What this is: This is Nightfall’s analysis of Coinbase’s insider-driven breach and the argument that DLP must monitor behavior, not just sensitive content.

Why it matters: It matters because identity, access, and data teams need controls that distinguish legitimate access from suspicious movement across corporate, personal, and AI tools.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

👉 Read Nightfall’s analysis of Coinbase’s $400 million insider breach and DLP blind spots

Context

Data loss prevention fails when it treats all authorised access as safe and all unauthorised access as suspicious. In practice, the most damaging exfiltration often happens through legitimate accounts, personal cloud apps, AI tools, and physical channels that look ordinary until the behavior is correlated.

Coinbase’s breach is a clear example of why the security problem is no longer just content detection. The real governance gap is identity context, because teams need to know who is using the data, from where, with which account, and whether that pattern fits the role.

For identity and data security programmes, this is not an edge case. It reflects how insider risk, AI-assisted exfiltration, and shadow data movement now converge across IAM, DLP, and investigation workflows.

Key questions

Q: What fails when DLP only checks for sensitive content patterns?

A: Content-only DLP misses the most common insider-risk pattern, where authorised users move data through legitimate workflows that become suspicious only when viewed in sequence. Teams need identity context, session correlation, and destination awareness to detect misuse across personal cloud, AI tools, and physical channels.

Q: Why do personal accounts and AI tools increase insider exfiltration risk?

A: Personal accounts and AI tools create exit paths that often look like normal work activity. A user can paste data into a draft, upload a file for later, or use an assistant to rewrite content without triggering a classic exfiltration rule. That is why monitoring must extend beyond corporate systems.

Q: How do security teams tell legitimate access from suspicious behavior?

A: They compare the user’s current actions with role-based baselines and account history. A support agent viewing records during work hours is expected, but the same person using a personal account, switching browsers, or printing far more data than peers is a materially different signal.

Q: Who is accountable when insider data movement bypasses policy?

A: Accountability usually sits across security, identity, and data governance teams because the failure is cross-domain. IAM owns access scope, PAM owns elevated privilege, and data security owns classification and enforcement. If any one of those is missing, the organisation leaves a gap that insiders can exploit.

Technical breakdown

Why pattern-based DLP misses insider exfiltration

Traditional DLP is built to recognise known sensitive patterns such as PII, PCI, or secrets. That works when the question is whether content matches a rule, but it breaks when a legitimate user handles data in an inappropriate way. Insider exfiltration often uses permitted access, then moves data into personal email, cloud storage, AI tools, or print queues. The control failure is not detection of the data itself. It is the absence of contextual correlation across identity, device, session, and destination.

Practical implication: teams need correlation rules that tie content events to user identity, account type, and destination context.

Identity context turns benign access into a risk signal

Identity context means the security stack understands the relationship between a user, their role, their account, and their normal working patterns. That makes it possible to distinguish a support agent accessing records during a shift from the same agent opening those records from a personal account after hours. This is the analytical layer that transforms raw events into evidence of misuse. Without it, DLP sees isolated actions; with it, teams can identify behavioral drift and suspicious sequencing across sessions.

Practical implication: enrich DLP and investigation workflows with identity attributes, role baselines, and account separation.

AI tools and physical channels expand the exfiltration surface

Modern exfiltration does not stay inside one browser or one data path. Employees can paste information into AI assistants, move files into personal cloud apps, or print and copy data to USB media. Each channel may look normal in isolation, which is why unified monitoring matters. The technical challenge is to correlate digital and physical movement with user behavior over time. That is especially important when the same sensitive information appears across multiple tools rather than leaving as a single obvious export.

Practical implication: include AI apps, personal cloud, USB, and printing in the same detection and investigation model.

Threat narrative

Attacker objective: The objective was to extract valuable customer and confidential data while avoiding the appearance of obvious exfiltration.

1. Entry occurred through legitimate customer service access, where insiders could view customer records as part of normal work.
2. Escalation happened when those users moved the same information into personal accounts, AI tools, or physical transfer channels that traditional DLP did not flag.
3. Impact was large-scale customer data exposure and a breach cost estimated at $400 million, with investigation complexity increased by the lack of behavioral context.

NHI Mgmt Group analysis

Behavioral DLP is now an identity problem as much as a data problem. Pattern matching alone cannot distinguish normal access from misuse when the same person can move between corporate accounts, personal cloud services, and AI tools. The control gap is contextual trust, not content classification. For security programmes, the lesson is that DLP must be tied to identity, session, and destination awareness.

Identity context is the missing layer in insider-risk governance. Teams need to know not only what data exists, but who touched it, under what account, and whether the sequence of actions fits the role. That is where IAM and DLP intersect. Once employees can handle sensitive data across multiple accounts and tools, governance must move from static permission review to continuous behavioral correlation.

Shadow AI and personal cloud services have become exfiltration endpoints. Sensitive data can leave through ChatGPT, personal Gmail, Dropbox, browser drafts, or print queues without ever looking like a bulk export. That creates a governance gap for both human identity and NHI programmes, because the same blind spots that hide insider misuse also hide agent-mediated data movement. Practitioners should treat sanctioned and unsanctioned tools as one data-control surface.

Behavioral anomaly detection needs to be operationalised, not bolted on. Many organisations have telemetry, but they do not have a decision model that turns it into an investigation path. The result is alert volume without triage confidence. For identity and security leaders, the practical takeaway is to align DLP, UEBA, and IAM signals into one review workflow so suspicious combinations of access, account switching, and destination changes are visible before data leaves the environment.

What this signals

Behavioral telemetry is becoming the deciding control for insider-risk programmes. Static content rules will keep missing the cases that matter most, especially when users move through personal accounts, browser sessions, and AI tools. The programme shift is toward sequence-based detection, where one benign action is not the signal but a chain of actions is.

Identity teams should treat personal cloud and AI tools as governed data paths. If those services can carry sensitive information out of the organisation, they belong in the same control plane as sanctioned repositories. That does not mean blocking everything, but it does mean policy, logging, and review need to follow the data wherever the identity can take it.

The next maturity jump is not more alerts, but better correlation between DLP, IAM, and user-behavior analytics. The programmes that win will be the ones that can show why a session is unusual, not just that it touched sensitive data.

For practitioners

• Map authorised data paths by role Document which records, files, and systems each role can legitimately access, then define the account types and tools that should be in scope for monitoring, including personal email, cloud storage, and AI assistants.
• Correlate identity with destination behavior Join DLP events to identity attributes such as role, device, browser, and account boundary so that access from a personal account or unmanaged tool generates a higher-fidelity review case.
• Include physical exfiltration channels in policy Add USB use, printing, and screen-based transfer paths to the same monitoring and escalation process used for digital exports, because insiders often switch channels when content-based controls are weak.
• Separate corporate and personal sessions Force stronger session differentiation between managed work accounts and personal accounts, and alert when the same user touches sensitive records across both contexts in a short sequence.
• Tune investigations for sequence, not just volume Review combinations such as record access, cloud upload, browser switching, and printing within a single timeline, because the pattern often matters more than any isolated event.

Key takeaways

• Insider exfiltration often looks legitimate until identity context exposes the behavior behind it.
• Coinbase illustrates that the highest-risk data movement now crosses personal accounts, AI tools, and physical channels as part of one workflow.
• Security teams should correlate content, identity, and destination rather than relying on pattern matching alone.

Key terms

• Behavioral DLP: Behavioral DLP is a form of data protection that uses user and device activity patterns to judge risk, not just file content. It helps teams spot bulk transfers, shadow IT usage, and unusual sharing events that suggest intentional or accidental data exposure.
• Identity context: The entitlement, ownership, and purpose information that explains why an action occurred and whether it was expected. For security operations, identity context turns raw alerts into decisions by showing which human or non-human identity acted and what it was allowed to do.
• Insider Exfiltration: Insider exfiltration is the movement of sensitive information by someone who already has legitimate or lingering access to the environment. The risk is not the login itself, but the way access, timing, and destination combine into a pattern that looks normal until context is added.
• Session-Level Correlation: Session-level correlation links identity events across logs and tools into one continuous access story. This is critical when an attacker uses valid credentials, because isolated events can look harmless while the full sequence reveals compromise, privilege abuse, or lateral movement.

What's in the full article

Nightfall's full report covers the operational detail this post intentionally leaves for the source:

• Monitoring logic for personal Gmail, Dropbox, OneDrive, and AI tools across employee workflows
• Correlation examples showing how browser switching, printing, and cloud uploads are combined into one investigation
• Nyx workflow detail for triaging noisy behavior events and surfacing high-confidence insider-risk cases
• Practical demos of identity-aware visibility across corporate and personal sessions

👉 The full Nightfall report shows how behavioral monitoring, identity context, and AI-assisted triage work together.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps identity and security practitioners build the control foundations needed for modern access and behavior governance.