Who Was the First to Use the Term Exfiltration in Cybersecurity?

Cybersecurity professionals often use the word exfiltration to refer to the process of data leaving the compromised network. When did this term first appear in our field and where did it originate? And how likely are non-security geeks understand it?

Data Exfiltration with the SEC

The first time I saw the cybersecurity version of the word exfiltration on a document meant for non-technical readers was Verisign's 2010 data breach in a 2011 SEC filing which stated, “Information stored on the compromised corporate systems was exfiltrated.”

Verisign wasn't the first company to introduce the term exfiltration into SEC documentation in the information security context. As far as I can tell, the first mention can be attributed to SRA International. SRA’s May 11, 2009, 10-Q statement mentions several malware infections identified by the company’s IT and security staff. It continues:

"While we have not determined that specific information was exfiltrated, our forensic analysts suggest that the virus was designed for this purpose and, based on indirect evidence found, there is the possibility that data was compromised."

Origins of the Term Exfiltration

The Oxford English Dictionary defines exfiltrate as:

Withdrawing “(troops, spies, etc.) from a dangerous position.”

It also refers to exfiltration as the “action or process of filtering out” and points to a geological book published in 1866 by P. H. Lawrence. In it, the author states:

"The opal is a product of exfiltration from the rock in or near which it occurs."

Exfiltration in Cybersecurity

The first mention of the term in the context of cybersecurity that I could find dates to the unclassified NSA paper published in 2002 and titled Microsoft Office 2000 Executable Content Security Risks and Countermeasures. It explains:

"Customizations with VBA or ActiveX provide a powerful programming capability within Office applications. An attacker can write a wide range of attacks from altering system settings and exfiltrating information to dangerous denial of service attacks such as deleting all files on a hard drive."

Do you know of earlier uses of the term exfiltration in cybersecurity scenarios such as data breaches? I’m curious.


About the Author

I transform ideas into successful outcomes, building on my 25 years of experience in cybersecurity. As the CISO at Axonius, I lead the security program to earn customers' trust. I'm also a Faculty Fellow at SANS Institute, where I author and deliver training for incident responders. The diversity of cybersecurity roles I've held over the years and the accumulated expertise, allow me to create practical solutions that drive business growth.

Learn more