Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: A customer-support account on a managed device downloaded 63 confidential financial archives from Google Workspace and uploaded them to Discord, while per-file DLP allowed every transfer because it could not interpret the sequence, according to Artemis Security. The case proves exfiltration detection must rank user-baselined behaviour and destination changes, not isolated file verdicts.
NHIMG editorial — based on content published by Artemis Security: sequence-based exfiltration from Google Workspace to Discord
By the numbers:
- The account downloaded 63 confidential financial archives before uploading them to a personal Discord account.
- The detection point fired on 41 files in a 12-minute window from a sensitive SaaS.
Questions worth separating out
Q: How should security teams detect exfiltration when every file transfer is individually allowed?
A: Correlate the full sequence, not the per-file verdict.
Q: Why do authorised users still create serious data-loss risk in managed environments?
A: Because authorisation to access data is not the same as authorisation to remove it in bulk.
Q: What breaks when security teams rely only on DLP alerts?
A: Alert-only DLP creates a reactive model that identifies exposure after data has already spread.
Practitioner guidance
- Correlate download-to-upload sequences Link SaaS audit logs, endpoint telemetry, and browser events so bulk downloads followed by personal or messaging uploads are scored as one exfiltration chain.
- Baseline external destination behaviour per account Track first-ever use of destinations such as Discord, personal cloud, and webmail, then alert when an identity reaches a new external channel with sensitive data.
- Detect coherent record-set movement Flag transfers where related archives, invoices, or source trees leave together in a short window because collection shape often indicates deliberate exfiltration.
What's in the full article
Artemis Security's full analysis covers the operational detail this post intentionally leaves for the source:
- The exact detection logic used to score the 41-file download burst and tie it to exfiltration
- The step-by-step reconstruction of the download-to-Discord chain across endpoint, browser, and SaaS telemetry
- The account-baseline comparisons that made first-ever Discord activity visible as a risk signal
- The triage sequence for separating allowed DLP verdicts from genuine theft indicators
👉 Read Artemis Security's analysis of sequence-based exfiltration from Google Workspace to Discord →
Per-file DLP allowed the theft: what should teams detect instead?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/08/2026 6:11 pm
Per-file allow decisions are not exfiltration controls. This case worked because the control plane judged each file independently and never evaluated the sequence as a theft event. That is a governance failure, not a tuning issue. Organisations that rely on file verdicts without behavioural correlation are assuming that malicious intent will appear in a single object rather than across an access pattern, which is rarely true in insider-style theft. The implication is that exfiltration detection has to be sequence-aware, not verdict-aware.
A few things that frame the scale:
- From our research: Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities. according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, which shows how identity boundaries fail when access is delegated across systems.
A question worth separating out:
Q: Who should own response when a support account moves confidential archives to a personal channel?
A: Identity, endpoint, and insider-risk teams should share ownership because the event spans access, device trust, and data movement. The response should focus on containment of the account, review of the destination channel, and validation of whether the session was deliberate or compromised.
👉 Read our full editorial: Per-file DLP misses exfiltration when sequence reveals theft
