Also known as: exfil · data theft
Data exfiltration is the unauthorised transfer of data out of an organisation's environment by an attacker, typically the final objective of an intrusion.
Attackers commonly disguise exfiltration as normal traffic — cloud storage uploads, DNS queries, or encrypted sessions to reputable domains — precisely because those channels are rarely blocked and blend into legitimate volume.
Detection focuses on volume anomalies, unusual destinations, and access patterns inconsistent with a user's role. Egress filtering is effective but operationally demanding, since it requires knowing what outbound traffic is legitimate.
Double Extortion
Double extortion is a ransomware tactic in which attackers steal a copy of an organisation's data before encrypting it, so that refusing to pay risks both operational disruption and public release of the stolen information.
Ransomware
Ransomware is malicious software that denies an organisation access to its own data — historically by encrypting it — and demands payment in exchange for restoring access or withholding publication of stolen data.
Dwell Time
Dwell time is the length of time an attacker remains undetected inside a compromised environment, measured from initial intrusion to detection.
Data Loss Prevention
Data loss prevention (DLP) refers to tools and policies that detect and block sensitive information from leaving an organisation through channels such as email, cloud uploads, or removable media.
Lateral Movement
Lateral movement is the process by which an attacker who has compromised one system moves through a network to reach additional systems, typically hunting for higher-value data or credentials.