Topic starter
02/08/2026 12:08 pm
TL;DR: Intentional email exfiltration stays hard to catch, with 94% of organisations seeing data loss and exfiltration in Microsoft 365 and 91% suffering significant fallout, according to Knowbe4. Behaviour-aware monitoring is the practical next layer when static DLP and audit-log review miss deliberate bypasses.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “CISO Strategy Guide: Data Exfiltration Over Email”.
By the numbers:
- 94% of organisations report experiencing data loss and exfiltration within their Microsoft 365 environment.
- 91% of organisations suffered significant fallout as a result.
- 94% of organisations rely solely on static email DLP rules.
Key questions
Q: Why does email exfiltration remain difficult to stop in Microsoft 365?
A: Microsoft 365 email is a trusted business channel, so malicious or policy-breaking activity can look normal.
Q: What are the signs that outbound email monitoring is too weak?
A: Common signs include heavy dependence on static DLP rules, manual audit-log review, and limited visibility into destination changes or abnormal send behaviour.
Q: What fails when static DLP is the main control for email exfiltration?
A: Static DLP fails when users deliberately route sensitive information around predefined rules, because content matching cannot reliably detect intent, policy evasion, or behaviour that looks normal in a trusted mailbox.
Practitioner guidance
- Deploy behaviour-based outbound email detection Monitor for unusual send frequency, destination changes, new personal-mail targets, and repeated policy bypass patterns across Microsoft 365.
- Reduce reliance on static DLP rules alone Use DLP as one layer, but add controls that understand user context and anomalous communication behaviour.
- Use audit logs for investigations, not primary prevention Preserve logs for forensics and case reconstruction, but do not treat manual log review as your main exfiltration control.
Bottom line: Intentional email exfiltration exposes a control gap that content-based DLP alone cannot close.
Glossary terms: Behaviour-Aware Monitoring, Static DLP, Outbound Trust Boundary, Detection-Response Latency
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:12 pm
Static DLP is a content-control, not an intent-control. That distinction matters because intentional exfiltration over email is fundamentally about user behaviour, not just sensitive strings in a message body. If a control only understands what is written, it will miss how legitimate accounts are used to defeat governance. Practitioners should treat this as a failure of detection model design, not merely a tuning problem.
A question worth separating out:
Q: Who is accountable when users bypass email safeguards to leak data?
A: Accountability should sit across security operations, identity governance, and data protection, because the failure crosses control domains. Email exfiltration is not just a messaging issue or just a DLP issue. Governance needs clear ownership for behaviour-based detection, outbound policy enforcement, and incident escalation when legitimate identities are used to move data out of bounds.
👉 Read our full editorial: Email exfiltration needs behaviour-aware monitoring, not static DLP
This post was modified 2 days ago by NHI Mgmt Group