Data exfiltration
Copying data out of your environment to somewhere the attacker controls.
Exfiltration is deliberately boring to spot. Data leaves over HTTPS to a cloud storage provider, through a legitimate file-sync client, or slowly enough to look like ordinary traffic. Attackers frequently use services your business already allows.
Detecting it means knowing what normal outbound volume looks like per user and per system, and being able to see cloud application usage rather than just firewall traffic. Preventing it is mostly least privilege: an account that cannot read the data cannot leak it.
Where this comes up
Data exfiltration sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.