Topic starter
25/08/2026 6:10 pm
TL;DR: A customer-support account on a managed device downloaded 63 confidential financial archives from Google Workspace and uploaded them to Discord, while per-file DLP allowed every transfer because it could not interpret the sequence, according to Artemis Security. The case proves exfiltration detection must rank user-baselined behaviour and destination changes, not isolated file verdicts.
Editorial analysis by NHI Mgmt Group, based on content published by Artemis Security: “51x Over Baseline: Catching the Exfiltration Every Control Approved”.
By the numbers:
- 63 confidential financial archives were downloaded from Google Workspace before being uploaded to Discord.
- Artemis Security says 41 files were pulled in a 12-minute window from a sensitive SaaS.
Key questions
Q: What breaks when DLP is only tuned for file-based exfiltration?
A: File-based DLP misses the most important MCP risk, which is sensitive information moving inside tool calls and synthesized responses rather than attachments or downloads.
Q: Why do managed devices and valid access not prove a transfer is safe?
A: They prove the session is authenticated, not that the data movement is trustworthy.
Q: How should security teams detect suspicious file movement from SaaS platforms?
A: Look for bursts of sensitive downloads followed quickly by uploads to destinations the account has never used before.
Practitioner guidance
- Correlate download bursts with destination changes Alert when a single account moves a sensitive file set from corporate SaaS to a personal, messaging, or webmail destination within one sequence, even if every file verdict is allowed.
- Baseline account-specific transfer behaviour Track first-ever destination use, prior maximum transfer volume, and the typical shape of a user’s file movement so that a sudden multi-file export stands out immediately.
- Treat managed-device sessions as conditional trust Combine device posture with behavioural scoring and destination context before treating a session as low risk, because a managed endpoint can still carry out exfiltration.
Bottom line: The core failure was not unauthorized access but the inability of per-file controls to interpret a coordinated exfiltration sequence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
Sequence is the real exfiltration unit, not the file. Per-file DLP models assume each object can be judged independently, but theft often emerges only when downloads, timing, and destination changes are evaluated together. That is why a control can be technically accurate and operationally blind at the same time. Practitioners should treat sequence context as the security event, not the single transfer.
A question worth separating out:
Q: When should teams treat DLP allow verdicts as a risk signal?
A: Treat allow verdicts as risk signals whenever the surrounding activity includes bulk download, first-time external destination use, or a rapid handoff from corporate SaaS to personal storage or messaging. Allowed content still matters when the pattern shows aggregation, not single-file policy compliance.
👉 Read our full editorial: Per-file DLP misses exfiltration when sequence reveals theft