Where Data Actually Leaves

Programmes are frequently designed around the channel that is easiest to monitor rather than the one carrying the most data. It is worth mapping the real picture first.

The channels, roughly by volume

Email. Still the largest by volume of incidents in most organisations, and the most observable. Attachments to personal addresses, forwarding rules, mistaken recipients. Well covered by tooling and the place to start.

Cloud storage and SaaS. Personal accounts on consumer file services, and sharing links on corporate ones. Increasingly the largest actual route, and frequently the least instrumented — a shared link with no expiry is an exit that leaves almost no trace at the network layer.

Web upload. Any site accepting a file. Broad, and reduced to a subset of paths once you can inspect encrypted traffic. Without that inspection, largely invisible.

Removable media. USB drives, external disks. Lower volume than it was, still significant, and well covered by endpoint agents. The control is straightforward — block, or allow only encrypted enterprise devices.

Collaboration platforms. Chat and workspace tools with file sharing and external guest access. Under-monitored relative to how much moves through them.

Printing. Overlooked, and a genuine route for documents. Volume of pages is a usable signal.

Personal devices. Corporate mail on a personal phone, a synced folder on a home laptop. Frequently outside the agent's reach entirely.

Source control. Pushing to a personal repository. High-impact where the intellectual property is code.

The channels nobody instruments

Worth stating plainly, because programmes are sometimes sold as though they were covered:

Photographing a screen. No control observes this. Session-recording tools do not stop it and neither does anything else.

Retyping. Slow, effective for small volumes, invisible.

Physical documents. Once printed, outside every digital control.

Memory. A departing salesperson does not need to export the customer list to remember the twenty accounts that matter.

The point is not that these make monitoring pointless. It is that a programme claiming to prevent data loss is claiming something untrue, and executives who believe it will be surprised.

Mapping your own

The exercise is a half-day and almost nobody does it.

List where sensitive data lives. Systems, not folders.

For each, list how data can leave it. Export function, API, print, screen, sync, share link.

For each route, note whether you can see it. Fully, partially, or not at all.

The output is uncomfortable and useful. Most organisations discover several high-volume routes with no visibility, and several well-instrumented routes carrying almost nothing.

Where to instrument first

Email, because volume, observability and the frequency of honest mistakes are all high.

Cloud sharing, because it is where the modern volume actually is and where the trace is thinnest.

Removable media, because the control is cheap and the signal is unambiguous.

Bulk export from systems of record, because the highest-consequence movements start with someone downloading a large extract, and that is visible at the application layer without inspecting a single byte of content.

That last one is the most under-used detection available. Application logs showing who exported what, in what volume, are frequently already being collected and never examined.

The proportionality point

Every channel you monitor has a privacy cost and a maintenance cost. Instrumenting everything is neither achievable nor defensible.

Monitor the routes where the data you have defined as sensitive can actually leave, in proportion to the consequence. Write down the reasoning. You will be asked to justify it, by employees, by a works council, or by a regulator.