How do we tell a legitimate cloud sync from data theft?
Compare the transfer with what that device normally does and with the tools your company actually uses. A sync client sending files to the company's approved storage service follows a pattern: it runs from workstations of people who use it, its volume rises and falls with working hours, and the destination is the service you pay for. Data theft tends to differ in at least one way: a server, rather than a workstation, uploads a lot; the destination is a personal or unknown storage account, a file-sharing site or a rented server; the volume is far above that host's usual level; it happens at night or over a weekend; or it follows other warning signs such as scanning or new admin logins. Tools attackers use for this, such as command-line sync utilities, often look just like legitimate backup. Ask the owner of the host first, then check the storage provider's own logs for the account used. On every plan, NetSenX alerts on unusual outbound data volume per host and shows the destination; it cannot see which files were sent.