This is a hypothetical scenario. The organisation, the people and the events are illustrative, not a description of any real customer or incident.
Background
Imagine an organisation grappling with insider risk. Like most organisations, it finds that the great majority of undesirable activity by employees is inadvertent or comes from a lack of awareness, not malice. Its leadership has watched high-profile data breaches involving insiders at other organisations and doesn’t want to be next.
The organisation has a familiar mix of problems:
- Repeated policy breaches: employees working around security controls, usually to get the job done, often without realising the risk.
- Confidential information leakage: sensitive company data exposed inadvertently or negligently, for example by sending it to personal accounts.
- Phishing susceptibility: a significant number of employees clicking on phishing emails, showing gaps in their understanding of digital threats.
- Traditional measures falling short: annual compliance training and security reminders, with no demonstrable reduction in risk.
Recognising this, the executive team decides it needs better visibility into how sensitive data actually moves in its Microsoft 365 environment, and puts ShadowSight Data Leakage Prevention in place.
The incident
Now imagine an employee emails a document titled “family recipes” to their personal Gmail account. On its own, that looks harmless; people send personal files to themselves all the time. But the attachment is unusually large, and sending files to a personal address is out of pattern for this person and their role.
An analyst reviewing the alert finds that the document is more than a recipe collection. The first pages hold recipes, but later sections contain embedded spreadsheets of sales figures and customer details.
The incident in detail
Part 1: Detection of unusual activity
- Event trigger: ShadowSight’s behavioural detection layer, which sits on top of Microsoft 365 activity, flags an email to a personal Gmail account carrying an attachment titled “family recipes”.
- Why it stands out: A keyword or label rule wouldn’t catch it; the file name is innocent. What stands out is the behaviour: data moving to personal email in a way that doesn’t fit the person’s normal work. This is exactly the kind of insider data loss that looks like ordinary activity and that native Microsoft 365 DLP rules miss.
Part 2: Validation before anyone is accused
- Analyst review: Before the alert reaches the organisation, an analyst validates it. If it had been a genuine family recipe, the alert would stop there and nobody would be troubled.
- What the review finds: Here, the analyst confirms that the document contains confidential sales figures and customer information, and passes a validated alert to the organisation with what was found.
Part 3: Responding fairly
- Following the organisation’s own process: The organisation’s managers, HR and legal teams decide what happens next, as they would for any other workplace matter.
- The conversation: In our imagined case, the employee explains that they meant to use the information in a future role with a competitor. In another version of the same story, the conversation might reveal a careless mistake, which calls for a reminder and some guidance rather than discipline. Either way, the data is contained before it does damage.
What this scenario shows
- Behaviour, not file names: Data loss is often disguised as, or simply looks like, ordinary work. Detection based on how data moves catches what simple rules miss.
- Validation protects people as well as data: Every alert is checked by analysts (ShadowSight’s, your own team, or both) before it reaches you, so innocent activity doesn’t turn into an accusation.
- Early intervention: Spotting data heading to a personal account lets an organisation act before the person has left and the information is gone.
- Knowing where sensitive data lives: ShadowSight Data Risk discovers and classifies sensitive data across SharePoint, OneDrive, Exchange email and Windows file servers, and shows who can reach it. Knowing that sales and customer data sits where many people can reach it is the first step to reducing the exposure.
- A healthier security culture: Most people respond well to timely, specific guidance. When data movement is visible and handled fairly, risky habits fade.
Risk mitigation
In a scenario like this, ShadowSight helps by:
- detecting data moving out of Microsoft 365 in ways that don’t fit normal work, such as to personal email or AI tools
- validating every alert with analysts before it reaches the organisation
- giving the organisation the context to respond early and proportionately
- showing where sensitive data is stored and who can reach it, so systemic exposure can be fixed
To Summarise
A file called “family recipes” is a reminder that insider data loss rarely announces itself. Most risky activity is accidental, some is deliberate, and both can look like everyday work. Visibility into how sensitive data moves, validated by people who understand the context, lets an organisation catch the cases that matter and treat its employees fairly while it does. If you’d like to see what this looks like in your own environment, ask us about a Proof of Value on your Microsoft 365 tenant.
CEO & Co-Founder, ShadowSight
Who is Christopher McNaughton
Chris is a proficient problem solver with a strategic aptitude for anticipating and addressing potential business issues, particularly in areas such as Insider Threat, Data Governance, Digital Forensics, Workplace Investigations, and Cyber Security. He thrives on turning intricate challenges into opportunities for increased efficiency, offering pragmatic solutions derived from a practical and realistic approach.
Starting his career as a law enforcement Detective, Chris transitioned to multinational organisations where he specialised and excelled in Cyber Security, proving his authority in the field. Even under demanding circumstances, his commitment to delivering exceptional results remains unwavering, underpinned by his extraordinary ability to understand both cyber and business problems swiftly, along with a deep emphasis on active listening.