What is data egress, and why does it matter for security and cost?

Data egress is data leaving a network, system or cloud environment for somewhere else. It matters twice. For security, egress is the path an intruder uses to steal data, so you need to see and control it. For cost, cloud providers have often charged for data leaving their platforms, which affects architecture and exit plans.

What is egress from a security point of view?

MITRE ATT&CK has a tactic called Exfiltration, described as the adversary trying to steal data. It says the techniques for getting data out of a target network typically include transferring it over the attacker's control channel or an alternative channel, and may include size limits on the transmission. Data is often packaged first, through compression or encryption, to avoid detection.

The technique pages show how varied the paths are. Exfiltration over alternative protocol covers sending data over a different protocol than the command and control channel, listing FTP, SMTP, HTTP and HTTPS, DNS and SMB, and says attackers may encrypt or obscure these channels. Exfiltration over web service uses existing legitimate external web services. Transfer data to cloud account covers moving stolen data into an account the attacker controls on a cloud service. Others cover automated exfiltration, scheduled transfers and data transfer size limits.

The common thread: egress rarely looks like an attack. It looks like HTTPS to a cloud storage domain, or DNS queries, or a nightly job.

How do you see egress?

You need a baseline. Which systems send data out, to where, in what volume, at what times? Flow records and proxy or firewall logs answer that. Once a database server that never initiated outbound traffic starts sending gigabytes to a new address, the change is visible even if the content is encrypted. NIST CSF 2.0 expresses the monitoring need as an outcome: networks and network services are monitored to find potentially adverse events.

How do you limit it?

Default deny for outbound traffic from servers, with allowlists for the destinations they truly need. Egress filtering for sensitive segments. Proxy based inspection for user traffic where policy and privacy allow. Controls on which cloud accounts staff can reach from company devices, since personal storage accounts are a common exit. Data classification so that your highest value stores get the tightest rules. And alerts on volume and destination changes.

What is egress from a cost point of view?

Providers have commonly charged for data leaving their networks, which can make moving large datasets between providers expensive. The European Commission's explainer on the Data Act describes how customers face barriers to switching cloud providers, naming high charges including data egress, and says the Act will entirely remove switching charges, including charges for data egress, from 12 January 2027. During the transition, from 11 January 2024 to 12 January 2027, providers may still charge for the costs incurred in switching and egress. Check the Act's text and your provider's current terms for how this applies to you. This article does not state any provider's prices.

A constructed example

A company's analytics team exports a customer table nightly to a partner. The security team sees the job in flow data: 2 GB at 02:00 to a fixed address, every night for months. Normal. One night the same server sends 40 GB to a different address at 14:00. The baseline makes it stand out. The team blocks the destination, finds a compromised service account used to run a query and a compression utility, and rotates the credentials. Separately, finance asks whether the partner export could stay inside the same cloud region to reduce transfer charges, which is a cost question about the same data movement.

How to check or apply this

1. List every legitimate outbound data flow: exports, backups, integrations, replication, and note owner and destination.
2. Baseline volumes and destinations per system for at least a few weeks.
3. Block outbound traffic by default from servers and open only what each needs.
4. Alert on new destinations, large transfers, off hours transfers and unusual DNS volume.
5. Restrict access to unmanaged cloud storage from company devices where policy allows.
6. For cost, ask providers in writing for current egress terms, and model what a migration or multi region design would transfer.
7. Test detection with a controlled transfer and confirm someone is alerted.

Quick check

Sources

• MITRE ATT&CK, Exfiltration tactic (TA0010)
• MITRE ATT&CK, Exfiltration Over Alternative Protocol (T1048)
• NIST Cybersecurity Framework 2.0, CSWP 29
• European Commission, Data Act explained

Last reviewed: 18 October 2026.