Network visibility gaps let data exfiltration evade detection

At a glance

What this is: This is an analysis of why exfiltration is often missed until after data has left and how network-centric detection aims to surface it earlier.

Why it matters: It matters because identity, cloud, and network teams need evidence that reveals outbound abuse before it becomes a reportable breach or extortion event.

Context

Data exfiltration is the point at which stolen information leaves an environment and becomes hard to recover. The control gap is usually not entry detection but exit visibility, because outbound traffic often blends with routine protocol use and goes unnoticed until the damage is already public.

For identity and access practitioners, that gap matters because compromised credentials, privileged service accounts, and API-driven workflows can all be used to move data out of an environment without tripping traditional perimeter or intrusion controls. In practice, this makes egress monitoring and forensic evidence central to breach containment, not just incident response.

The article frames the problem as a visibility failure rather than a single-tool failure, which is typical of exfiltration cases in mature environments.

Key questions

Q: What breaks when exfiltration is only monitored at the perimeter?

A: Perimeter-only monitoring misses the protocol details and internal context that reveal abnormal outbound movement. Exfiltration commonly hides inside DNS, SMB, HTTP/S and ICMP traffic, so teams need behaviour-aware egress visibility and correlated evidence to distinguish legitimate transfers from theft. Without that, investigation starts after data loss is already complete.

Q: Why do trusted protocols make data exfiltration harder to detect?

A: Trusted protocols are noisy because they carry legitimate business traffic all day. Attackers exploit that familiarity by blending stolen data into ordinary DNS queries, file shares, web uploads or encrypted sessions. The risk rises when teams rely on known signatures alone and do not compare transfers against normal host or peer-group behaviour.

Q: How do security teams know if exfiltration controls are actually working?

A: Look for evidence that bulk file access, compression, and outbound staging are detected early and correlated with privileged sessions. If teams only see the breach after a leak site post, the control failed. Effective monitoring should surface unusual data movement before attackers can weaponise it.

Q: When should organisations prioritise egress visibility over more intrusion alerts?

A: They should prioritise egress visibility when the main concern is theft, extortion or regulated data loss rather than early intrusion discovery. Once an attacker is inside, the decisive question becomes whether outbound movement can be seen and proved, because that determines containment, disclosure and negotiation decisions.

Technical breakdown

Why exfiltration hides in trusted protocols

Exfiltration works because attackers prefer channels that already look normal to network and security tooling. DNS, SMB, HTTP/S and ICMP are all legitimate protocols, so malicious transfers can be buried inside subdomains, file-share traffic, web uploads or control-plane chatter. The technical problem is not whether the packet is encrypted or malformed, but whether the transfer is unusual for that host, user, peer group or time window. That is why simple signature logic often misses the behavior until the data is already gone.

Practical implication: monitor outbound behaviour by protocol, peer group and volume, not just by known indicators of compromise.

How anomaly detection changes exfiltration visibility

Unsupervised anomaly detection models learn a baseline of normal outbound behaviour and then flag transfers that diverge from it. In this article, that means looking for unusually large outbound uploads rather than waiting for a known malware signature. The control value comes from running detection close to the data source, where the system can compare a transfer against local behavior patterns and surface evidence early enough to justify action. This is especially useful when the transfer itself is novel but the pattern of abuse is familiar.

Practical implication: place behavioral egress detection at the network layer where novel transfer patterns can be scored before data loss is complete.

Why layered network evidence matters for response

Exfiltration is difficult to prove from a single alert because investigators need the before, during and after context around the transfer. Correlated logs, connection identifiers, file identifiers, encrypted traffic insight and cloud sensor data help establish what moved, how it moved and whether the movement was authorized. That evidence turns a suspicion into a defensible case for containment, disclosure, legal review or ransom refusal. Without it, teams tend to rely on inference, which is a weak basis for executive decisions.

Practical implication: preserve correlated network evidence so response teams can prove scope, not just suspect it.

Threat narrative

Attacker objective: To extract valuable data quietly enough to preserve leverage, monetise it, or use it for coercion.

1. Entry commonly starts when an attacker gains a foothold through compromised access or a low-noise initial access path and then waits for a transfer opportunity.
2. Credentialed or trusted channels are then abused to stage and move data over DNS, SMB, HTTP/S or ICMP, which helps the activity blend into normal traffic.
3. The objective is to remove sensitive information from the environment so the attacker can monetise theft, enable extortion or support espionage.
4. Once the data is out, the damage shifts from prevention to proof, disclosure and containment because recovery options narrow sharply.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
• 230M AWS environment compromise: 230M AWS environments compromised via exposed .env files with cloud credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Exfiltration is a governance problem before it is a detection problem: once data reaches the egress boundary, the security decision has already shifted from prevention to evidence handling. That makes network visibility a control plane for containment, disclosure and executive decision-making, not just an operations concern. Practitioners should treat outbound visibility as part of breach governance, not a niche SOC requirement.

Network evidence becomes the decisive control when attackers hide in normal protocols: DNS, SMB, HTTP/S and ICMP are not suspicious by default, which is why exfiltration often outruns signature-based tooling. The practical lesson is that the security model has to distinguish legitimate protocol use from abusive transfer behavior, especially when encryption reduces payload inspection. Teams should anchor this work in behavioural detection and forensic correlation.

Data exfiltration is the failure mode that exposes blind spots across identity, cloud and endpoint control: compromised credentials, service accounts and trusted integrations can all become transfer paths if outbound behaviour is not observed. That creates a named concept worth tracking: egress visibility debt, the accumulated gap between what an organisation can detect inside the network and what it can prove is leaving it. Practitioners should reduce that debt before an incident forces the issue.

Agentic triage changes the operating model, but only if the underlying evidence is trustworthy: automated investigation can accelerate summarisation and correlation, yet it still depends on complete network context to avoid confident but weak conclusions. The implication for identity and security teams is clear: automation should compress investigation, not replace the evidence chain that makes response defensible.

Layered detection is now a resilience requirement, not a product preference: supervised models, anomaly engines, encrypted-traffic insight and cloud sensors each cover different parts of the same exfiltration problem. The field is moving toward evidence-rich control design because single-mode detection routinely fails against adaptive adversaries. Practitioners should organise controls around proof, scope and timing, not just alert volume.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Data Exfiltration Guide

What this signals

Data exfiltration exposes a control gap that many programmes still underinvest in: organisations often tune for intrusion and ignore the outbound phase where the breach becomes real. For identity teams, that means compromised service accounts, delegated access and legitimate integrations need the same scrutiny as external attack paths. A programme that cannot explain egress behaviour cannot claim to understand its own blast radius.

Egress visibility debt is now a useful way to describe the gap between traffic volume and traffic understanding. The more an environment depends on encrypted transport, cloud storage and internal automation, the more difficult it becomes to prove whether a transfer is legitimate. Teams should treat this as a governance issue because the question is not only whether data moved, but whether the organisation can defend the decision it will need to make after the fact.

The operational signal is simple: if your SOC can detect an unusual login faster than an unusual outbound transfer, your detection stack is misaligned with breach economics. That misalignment is especially dangerous where service accounts and shared credentials can move data without a human sitting in the loop.

For practitioners

• Map outbound visibility by protocol Inventory where DNS, SMB, HTTP/S and ICMP traffic are monitored end to end, then identify which paths lack behavioural review or flow-level logging.
• Baseline normal outbound transfer patterns Establish peer-group and host-level transfer baselines so unusually large uploads or odd destination changes stand out against local behaviour.
• Correlate network evidence before response decisions Preserve connection identifiers, file identifiers and pre- and post-transfer context so investigators can prove what left, how it left and whether it was authorized.
• Test exfiltration scenarios against SIEM and SOAR workflows Verify that alerts, context logs and enrichment data flow into incident response tooling quickly enough to support containment, disclosure and executive review.

Key takeaways

• Exfiltration is often missed because attackers hide theft inside normal-looking network behaviour rather than exotic malware.
• Evidence-rich network telemetry matters because response teams need to prove what left the environment before executives make irreversible decisions.
• Programmes that can see outbound behaviour across DNS, SMB, HTTP/S and ICMP are better positioned to contain loss, support disclosure and challenge ransom leverage.

Key terms

• Data Exfiltration: Data Exfiltration is the unauthorised transfer of data out of an environment to an attacker-controlled location. It is often the end stage of intrusion, using cloud sync, email, APIs, removable media, or encrypted tunnels. Defenders monitor unusual volume, destinations, file access patterns, and identity misuse to stop it early.
• Behavior Baseline: A record of normal activity for a non-human identity, including typical consumers, resources, and actions over time. Baselines help security teams detect when an identity is being used in an unusual way and provide the context needed to enforce least privilege safely in dynamic environments.
• Peer-Group Modeling: Peer-group modeling compares an entity's activity against similar users or devices rather than against a global average. This improves detection quality by reducing false positives and by surfacing behavior that is abnormal for a specific role, function or environment.
• Egress Visibility: Egress visibility is the ability to observe and explain data leaving an environment across protocols, destinations and transfer paths. It is foundational to breach response because teams cannot defend containment, disclosure or ransom decisions if they cannot prove what exited.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners who need to connect identity controls to broader security outcomes across the programme.