Email and Web Egress

Email remains the highest-volume route for data leaving organisations, and the best understood. Web upload is broader and harder. Both are where most programmes start, correctly.

Email: what to watch

Attachments to personal accounts. The classic pattern and the most common incident type. Someone sending work to their own webmail address to continue at home, before a holiday, or before leaving.

Detecting it is straightforward: outbound mail where the recipient domain is a consumer mail provider and the sender's surname appears in the recipient address is a high-precision signal.

Forwarding rules. An auto-forward to an external address is one of the few unambiguous indicators available. It is also a standard post-compromise action by attackers, so it serves both categories. Alert on creation of any external forwarding rule, every time.

Bulk send. One message with a large attachment to many external recipients, or many messages in a short window.

Misdirected mail. The wrong recipient with a similar name. Enormously common, rarely malicious, and the case where a pre-send warning is worth more than any detection.

Volume against baseline. A person who normally sends two external attachments a week sending forty.

Email: what generates noise

Legitimate external correspondence with attachments, which is most of what a commercial organisation does. Distribution lists. Automated reports. Newsletters. Anything from a service account.

The precision comes from combining signals: sensitive content plus external recipient plus unusual volume plus consumer domain. Any one alone is noise.

Web upload: the visibility problem

Almost all web traffic is encrypted. Without terminating TLS on your network, you can see the destination and the volume, and nothing about the content.

That gives you something — a large upload to a personal cloud storage domain is meaningful even without inspecting it — and it does not give you content inspection.

TLS inspection is the trade. It restores visibility and introduces real costs: performance, breakage of applications that pin certificates, and a significant privacy question, since it means decrypting employees' traffic including anything personal they do on a work device.

Where inspection is used, exclusions matter: banking, health, legal, anything where interception of personal traffic is disproportionate or unlawful. Configure them deliberately, and document the reasoning.

Where inspection is not used, endpoint-based detection is the substitute — the agent sees the file before it is encrypted for transmission.

What to watch on web

Uploads to personal cloud storage. Category-based blocking or alerting on consumer file services.

Volume to any single destination. Large outbound transfers to an unfamiliar domain, regardless of content.

Paste to external sites. Underappreciated. Source code and configuration pasted into a public snippet service or an AI assistant is a real and growing route, and it is invisible without endpoint or inspection coverage.

Newly registered domains as destinations for uploads.

The AI assistant question

Employees pasting proprietary material into external language models is now a significant egress route in most organisations, and one that policies written before 2023 do not address.

Treat it as a channel: decide what is permitted, provide a sanctioned alternative if you want the productivity, and instrument the unsanctioned ones. Blocking without an alternative produces the usual outcome — the activity moves to a personal device where you cannot see it at all.

The intervention that works

For all of these, the pre-action warning outperforms post-hoc detection.

Catching a misdirected email after it has been sent gives you an incident to manage. Catching it half a second before gives you a non-event, which is worth considerably more and costs the organisation nothing.