Topic starter
02/08/2026 12:08 pm
TL;DR: Intentional data exfiltration over email remains difficult to detect, with KnowBe4 reporting that 94% of organisations have seen data loss and exfiltration in Microsoft 365 and 91% suffered significant fallout. Static DLP and audit-log review alone are not enough when users deliberately bypass safeguards, making behaviour-aware monitoring the practical control gap.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “CISO Strategy Guide: Data Exfiltration Over Email”.
By the numbers:
- 94% of organisations report experiencing data loss and exfiltration within their Microsoft 365 environment.
- 91% of organisations suffered significant fallout as a result.
- 94% of organisations rely solely on static email DLP rules.
Key questions
Q: What fails when static DLP is the main control for email exfiltration?
A: Static DLP fails when users deliberately route sensitive information around predefined rules, because content matching cannot reliably detect intent, policy evasion, or behaviour that looks normal in a trusted mailbox.
Q: Why does email exfiltration remain difficult to stop in Microsoft 365?
A: Microsoft 365 email is a trusted business channel, so malicious or policy-breaking activity can look normal.
Q: What are the signs that outbound email monitoring is too weak?
A: Common signs include heavy dependence on static DLP rules, manual audit-log review, and limited visibility into destination changes or abnormal send behaviour.
Practitioner guidance
- Deploy behaviour-based outbound email detection Monitor for unusual send frequency, destination changes, new personal-mail targets, and repeated policy bypass patterns across Microsoft 365.
- Reduce reliance on static DLP rules alone Use DLP as one layer, but add controls that understand user context and anomalous communication behaviour.
- Use audit logs for investigations, not primary prevention Preserve logs for forensics and case reconstruction, but do not treat manual log review as your main exfiltration control.
Bottom line: Intentional email exfiltration exposes a control gap that content-based DLP alone cannot close.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:12 pm
Static DLP is a content-control, not an intent-control. That distinction matters because intentional exfiltration over email is fundamentally about user behaviour, not just sensitive strings in a message body. If a control only understands what is written, it will miss how legitimate accounts are used to defeat governance. Practitioners should treat this as a failure of detection model design, not merely a tuning problem.
A question worth separating out:
Q: Who is accountable when users bypass email safeguards to leak data?
A: Accountability should sit across security operations, identity governance, and data protection, because the failure crosses control domains. Email exfiltration is not just a messaging issue or just a DLP issue. Governance needs clear ownership for behaviour-based detection, outbound policy enforcement, and incident escalation when legitimate identities are used to move data out of bounds.
👉 Read our full editorial: Data exfiltration over email is outpacing static DLP controls