Data exfiltration

Getting data out is a distinct stage with its own signals.

Unusual volumes, unfamiliar destinations, transfers at odd hours, archives appearing where none normally do. It is one of the last stages and therefore one of the last chances to intervene before the damage is irreversible, which is why outbound monitoring earns its place even in organisations that are confident about the perimeter.