Outbound transfers, unusual access and policy violations are reviewed after the fact, so exfiltration is discovered once the data's already gone. The signal exists but isn't watched live.
"Is our sensitive data leaving the building right now, and would we catch it in time?"
Undetected exfiltration
Live exposure monitor
To first outcomes