Per-file DLP misses exfiltration when sequence reveals theft

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Artemis Security's research: Per-file DLP missed a theft pattern because the decisive signal only emerged across the download-to-upload sequence.

Why it matters: It matters because IAM and security teams need user-baselined sequence detection when legitimate access, managed devices, and approved file verdicts can still conceal data theft.

By the numbers:

• 63 confidential financial archives were downloaded from Google Workspace before being uploaded to Discord.
• Artemis Security says 41 files were pulled in a 12-minute window from a sensitive SaaS.

Context

Sequence-aware data loss prevention is the problem space here. A control can see each file transfer as permitted and still miss the fact that the same account assembled a coherent set of confidential records and moved them to a personal destination in one chain.

The identity question is not whether the user had access, but whether the behaviour matched that user’s established pattern. For IAM, NHI, and security operations teams, the lesson is that access legitimacy and exfiltration legitimacy are different questions.

This case is typical of modern SaaS exfiltration: the access path is normal, the destination is ordinary web infrastructure, and the theft only becomes visible when event sequence, volume, and baseline are analysed together.

Key questions

Q: What breaks when DLP is only tuned for file-based exfiltration?

A: File-based DLP misses the most important MCP risk, which is sensitive information moving inside tool calls and synthesized responses rather than attachments or downloads. When the data never looks like a traditional file, pattern matching alone cannot tell whether the agent is exposing regulated or strategic information.

Q: Why do managed devices and valid access not prove a transfer is safe?

A: They prove the session is authenticated, not that the data movement is trustworthy. An authorised user on a managed endpoint can still assemble a bulk export and send it to a personal destination. Security teams need behavioural and destination context to distinguish normal work from covert removal.

Q: How should security teams detect suspicious file movement from SaaS platforms?

A: Look for bursts of sensitive downloads followed quickly by uploads to destinations the account has never used before. Compare the activity to the user’s own baseline for volume, destination, and timing, and investigate coherent record sets rather than isolated file events. The sequence is the signal.

Q: When should teams treat DLP allow verdicts as a risk signal?

A: Treat allow verdicts as risk signals whenever the surrounding activity includes bulk download, first-time external destination use, or a rapid handoff from corporate SaaS to personal storage or messaging. Allowed content still matters when the pattern shows aggregation, not single-file policy compliance.

Technical breakdown

Why per-file verdicts miss exfiltration chains

Per-file DLP evaluates each object in isolation, usually asking whether a specific file is allowed to move from one point to another. That model breaks when an attacker or insider uses legitimate access to assemble many permissible transfers into one theft sequence. The important signal is not the file verdict itself, but the relationship between the source burst, the timing, and the destination shift. In this case, every archive could be individually permitted while the aggregate behaviour still represented a coherent data removal event. Security teams need to understand that “allowed” can mean only that a single control check passed, not that the overall movement was benign.

Practical implication: Treat file-level allow decisions as input to sequence analysis, not as final proof of safety.

How user baselines expose suspicious destination changes

Behavioural baselining compares an account’s current action to its own history rather than to a generic threshold. That matters because a customer-support employee may legitimately access confidential files, yet never use a personal Discord account as an exfiltration path. First-ever destination use, abrupt changes in transfer volume, and a coherent multi-year record set are all behavioural markers that only appear when telemetry is correlated over time. A static rule may miss low-and-slow theft or generate noise on normal work patterns. A user baseline turns the question from “was each action permitted?” to “does this chain make sense for this account?”

Practical implication: Baseline destinations, not just file counts, so a first-time personal upload channel becomes visible.

Why managed devices and corporate access do not equal trust

A managed endpoint and valid corporate credentials tell you the session is authenticated, not that the resulting behaviour is trustworthy. This is a classic governance gap in data security: controls that assume the device or login context is sufficient can fail when the actor is using legitimate access to move sensitive data off-platform. The sequence here combined managed-device access, corporate SaaS downloads, and external uploads, which is exactly why the control boundary has to include destination context and behavioural scoring. Trust should be based on observed activity patterns, not on the fact that the session began inside the perimeter.

Practical implication: Add destination and behaviour context to device trust decisions before accepting a session as low risk.

Threat narrative

Attacker objective: Remove a complete set of confidential financial records from the organisation without triggering a file-by-file prevention control.

1. Entry occurred through legitimate access on a managed device, where the account could reach confidential files in corporate Google Workspace without triggering a block.
2. The account then downloaded 63 confidential financial archives in a short burst, creating a bulk transfer pattern that the per-file controls allowed.
3. Within minutes, the same account uploaded the same archive set to a personal Discord account, turning normal-looking file handling into data exfiltration.
4. The impact was the removal of a coherent three-year financial record set from corporate control while the controls still logged each transfer as allowed.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Sequence is the real exfiltration unit, not the file. Per-file DLP models assume each object can be judged independently, but theft often emerges only when downloads, timing, and destination changes are evaluated together. That is why a control can be technically accurate and operationally blind at the same time. Practitioners should treat sequence context as the security event, not the single transfer.

Behavioural baselines belong in data-governance, not just detection tuning. The decisive signal in this case was not unusual access rights, but unusual behaviour relative to the account’s own history. A first-time personal destination and a large jump over prior transfer volume are identity signals that conventional content controls do not capture. The implication is that exfiltration governance must measure normality at the account level, not only at the file or policy level.

Managed access can still produce unmanaged outcomes. This case shows that a managed device and authorised SaaS access do not prevent theft when the transfer path itself is legitimate. That creates a governance blind spot where trust is inferred from session legitimacy instead of observed data movement. The practitioner conclusion is that access trust and transfer trust cannot be collapsed into one control decision.

Context-aware DLP is becoming a baseline requirement for SaaS environments. As more sensitive work happens inside collaboration and storage platforms, exfiltration control has to look at source, destination, sequence, and account history together. Artemis Security’s reconstruction shows why prevention and detection need to share telemetry rather than operate as separate verdict engines. Teams should assume that isolated file decisions will miss real theft patterns.

Identity blast radius is now a data-movement problem. Once an account can move a coherent record set from corporate SaaS to a personal destination, the practical question is how far one legitimate session can carry sensitive data before detection catches up. That is a governance issue as much as a technical one, because the control boundary is the account’s behavioural envelope. Practitioners should narrow that blast radius by making movement patterns part of access evaluation.

What this signals

Sequence-aware monitoring is now part of identity-aware data protection. Teams that rely on isolated file verdicts will continue to miss exfiltration patterns that only appear across a chain of legitimate actions. The practical shift is to score the account’s movement pattern, not just the object leaving the platform.

First-time destination use is a high-value control signal. When an account that normally handles support work suddenly sends sensitive archives to a personal messaging destination, the control problem is behavioural, not content-based. IAM and security operations should surface that change in the same workflow used for unusual access.

Perimeter assumptions fail when the same authorised session can both retrieve and remove a coherent record set without tripping a block. That is why detection logic needs to understand source, destination, and sequence together.

For practitioners

• Correlate download bursts with destination changes Alert when a single account moves a sensitive file set from corporate SaaS to a personal, messaging, or webmail destination within one sequence, even if every file verdict is allowed.
• Baseline account-specific transfer behaviour Track first-ever destination use, prior maximum transfer volume, and the typical shape of a user’s file movement so that a sudden multi-file export stands out immediately.
• Treat managed-device sessions as conditional trust Combine device posture with behavioural scoring and destination context before treating a session as low risk, because a managed endpoint can still carry out exfiltration.
• Review DLP allow events as telemetry Use allowed verdicts to feed investigation rules for bursty downloads, coherent record sets, and rapid uploads, rather than interpreting the verdict as a clean bill of health.

Key takeaways

• The core failure was not unauthorized access but the inability of per-file controls to interpret a coordinated exfiltration sequence.
• Artemis Security reconstructed a transfer chain involving 63 confidential financial archives, showing that volume, destination change, and baseline deviation matter more than isolated file verdicts.
• Teams need behavioural baselines and sequence-aware detection to catch legitimate-looking access that still produces theft.

Key terms

• Sequence-aware DLP: Data loss prevention that evaluates transfers as a chain of related actions rather than isolated file events. It looks for timing, destination changes, and account baseline deviation so that individually permitted steps can still be recognised as exfiltration when the overall sequence reveals theft.
• Behavior Baseline: A record of normal activity for a non-human identity, including typical consumers, resources, and actions over time. Baselines help security teams detect when an identity is being used in an unusual way and provide the context needed to enforce least privilege safely in dynamic environments.
• Exfiltration sequence: The ordered set of events that turns ordinary file access into data theft, such as bulk download followed by upload to an external destination. The sequence matters because each step may appear legitimate on its own while the combined pattern reveals intent and impact.
• Allowed verdict: A control decision that permits a transfer or action, often because the single event does not violate policy. For defenders, an allowed verdict is not evidence of safety when the surrounding behaviour shows aggregation, destination switching, or other indicators of covert data removal.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.