Data exfiltration over email is outpacing static DLP controls

At a glance

What this is: Knowbe4 says intentional email-based exfiltration is widely missed because static DLP and audit-log review do not reliably detect users who deliberately bypass safeguards.

Why it matters: This matters because IAM, email security, and data protection teams need controls that account for intent, not just policy violations or log review after the fact.

By the numbers:

• 94% of organisations report experiencing data loss and exfiltration within their Microsoft 365 environment.
• 91% of organisations suffered significant fallout as a result.
• 94% of organisations rely solely on static email DLP rules.
• 51% of organisations rely on reviewing audit logs to detect potential breaches.

Context

Data exfiltration over email is a governance problem as much as a control problem. When people intentionally bypass approved channels, the issue is not simply whether a rule exists, but whether the organisation can detect behaviour that is meant to evade that rule. In Microsoft 365 environments, that becomes an identity and access question as well as a data-loss question, because the abuse comes from legitimate users working inside trusted systems.

Static DLP assumes the right policy boundary will be visible at send time, while audit-log review assumes suspicious action will be obvious after the fact. Neither assumption holds well when a user deliberately routes sensitive information to personal email or other uncontrolled destinations. That makes this a practical case for behaviour-aware monitoring, stronger governance over outbound email flows, and tighter alignment between email security and identity controls.

Key questions

Q: What fails when static DLP is the main control for email exfiltration?

A: Static DLP fails when users deliberately route sensitive information around predefined rules, because content matching cannot reliably detect intent, policy evasion, or behaviour that looks normal in a trusted mailbox. In practice, that means organisations need controls that watch destination patterns, user behaviour, and repeated bypass attempts, not just keyword or label matches.

Q: Why does email exfiltration remain difficult to stop in Microsoft 365?

A: Microsoft 365 email is a trusted business channel, so malicious or policy-breaking activity can look normal. If teams only monitor content labels or keywords, they miss the user behaviour that reveals intent. The problem is compounded when access governance, mail controls, and SOC monitoring operate separately.

Q: What are the signs that outbound email monitoring is too weak?

A: Common signs include heavy dependence on static DLP rules, manual audit-log review, and limited visibility into destination changes or abnormal send behaviour. If the programme only learns about exfiltration after investigation begins, detection is happening too late. The monitoring layer should surface policy evasion before the data leaves the environment.

Q: Who is accountable when users bypass email safeguards to leak data?

A: Accountability should sit across security operations, identity governance, and data protection, because the failure crosses control domains. Email exfiltration is not just a messaging issue or just a DLP issue. Governance needs clear ownership for behaviour-based detection, outbound policy enforcement, and incident escalation when legitimate identities are used to move data out of bounds.

Technical breakdown

Why static DLP misses intentional email exfiltration

Static DLP works by matching content, destinations, labels, or patterns against predefined rules. That works reasonably well for accidental leakage, but intentional exfiltration is adaptive: users can rephrase content, split data across messages, move material into attachments, or use benign-looking personal accounts. The control gap is not just weak policy design. It is that rule-based inspection sees the message, not the user’s intent or the surrounding behaviour that signals abuse. In Microsoft 365, this creates blind spots where legitimate authentication masks malicious use of a legitimate channel.

Practical implication: pair content rules with behaviour-based detection for unusual send patterns, destination changes, and repeated policy bypass attempts.

Why audit logs are a weak after-the-fact control

Audit logs record events, but they do not by themselves explain whether a message represented normal work or deliberate exfiltration. Security teams often use log review as a compensating control when detection is thin, yet that approach is slow, manual, and dependent on someone knowing what to look for. Logs also fragment the story across email, identity, and data events, so the analyst has to reconstruct intent from incomplete evidence. That is useful for investigation, but poor for prevention.

Practical implication: treat audit logs as investigation evidence, not the primary detection mechanism for outbound data theft.

Behaviour-aware monitoring closes the trust gap

Behaviour-aware monitoring looks for deviations in how users normally send, share, and route information. In this context, the important signal is not only what was sent, but whether a user is shifting from ordinary communication into a pattern consistent with concealment, policy evasion, or unusual exfiltration paths. That approach is especially relevant in identity-centric environments because trusted accounts can be used in untrusted ways. The control focus moves from static message inspection to continuous assessment of user behaviour and outbound trust boundaries.

Practical implication: build detections around anomalous sending behaviour and outbound trust shifts, not content inspection alone.

Threat narrative

Attacker objective: The objective is to move sensitive information out of the organisation through a trusted communication channel without triggering effective prevention or timely detection.

1. Entry occurs through a legitimate Microsoft 365 user account used inside a trusted email workflow.
2. The user bypasses internal safeguards by sending sensitive material to a personal email account or another uncontrolled destination.
3. Exfiltration succeeds because static DLP and log review do not reliably distinguish deliberate rule-breaking from ordinary use.
4. Impact is data loss and downstream fallout that the organisation may only recognise after the information has already left its control.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Static DLP is a content-control, not an intent-control. That distinction matters because intentional exfiltration over email is fundamentally about user behaviour, not just sensitive strings in a message body. If a control only understands what is written, it will miss how legitimate accounts are used to defeat governance. Practitioners should treat this as a failure of detection model design, not merely a tuning problem.

Microsoft 365 creates a high-trust exfiltration path when identity is normal but behaviour is not. Email abuse is harder to spot when the sender is authenticated, authorised, and operating inside standard collaboration workflows. That is why the intersection of identity and data security matters here: trusted user identity can become the delivery mechanism for untrusted data movement. Security teams should shift from channel trust to behaviour trust.

Audit review is necessary for investigation, but insufficient as a primary defence. The article’s 51% figure shows how often organisations still depend on retrospective review, yet retrospective review cannot stop an exfiltration event in progress. That creates a detection-response latency problem that favours the insider or compromised account. The practical conclusion is that outbound monitoring must operate at send time, not only after an incident.

Behaviour-aware monitoring is the right named concept for this gap. It means looking for patterns that reveal policy evasion, destination drift, and repeated abnormal sending activity. That concept is broader than DLP because it connects content, identity, and usage context into one governance view. Practitioners should frame email exfiltration as a behavioural abuse problem that static policy alone cannot close.

What this signals

Behaviour-aware email defence is becoming the practical control boundary. The key lesson is that organisations cannot rely on content rules to catch deliberate misuse of trusted communication channels. They need a programme that correlates outbound behaviour, identity context, and destination risk so that legitimate accounts do not become exfiltration cover.

Email exfiltration is an identity problem when the sender is authorised but the action is not. That means security teams should stop treating outbound mail solely as a DLP domain and start treating it as a trust and governance problem. In practice, the control shift is from static inspection to continuous assessment of what a user is doing with a valid identity.

For practitioners

• Deploy behaviour-based outbound email detection Monitor for unusual send frequency, destination changes, new personal-mail targets, and repeated policy bypass patterns across Microsoft 365.
• Reduce reliance on static DLP rules alone Use DLP as one layer, but add controls that understand user context and anomalous communication behaviour.
• Use audit logs for investigations, not primary prevention Preserve logs for forensics and case reconstruction, but do not treat manual log review as your main exfiltration control.
• Align email controls with identity governance Correlate outbound email activity with account risk, privilege scope, and unusual sign-in behaviour so legitimate identity does not mask abuse.

Key takeaways

• Intentional email exfiltration exposes a control gap that content-based DLP alone cannot close.
• Knowbe4 says 94% of organisations have seen data loss and exfiltration in Microsoft 365, and 91% suffered significant fallout.
• The strongest response is behaviour-aware monitoring tied to identity and outbound trust signals, not retrospective log review.

Key terms

• Behaviour-Aware Monitoring: Behaviour-aware monitoring is the practice of detecting suspicious activity by comparing actions to normal user patterns, not just to static rules. In email exfiltration cases, it helps identify policy evasion, unusual destinations, and repeated attempts to move data out of controlled channels.
• Static DLP: Static DLP is a rule-based approach to data loss prevention that checks messages or files against predefined patterns, labels, or conditions. It is effective for known content patterns but often struggles when context, permissions, or business relationships determine whether disclosure is actually acceptable.
• Outbound Trust Boundary: An outbound trust boundary is the point where a system leaves passive observation and begins initiating network actions based on input it does not fully trust. For scanners and verification services, this boundary determines whether live checks are governed and constrained or left open to abuse.
• Detection-Response Latency: The elapsed time between identifying a security issue and executing a bounded, auditable fix. In data security programmes, long latency means exposure persists after discovery, which undermines the value of detection and weakens compliance evidence.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It helps security and identity teams strengthen governance across human identities, machine identities, and delegated access patterns.