ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™Insider Threat Matrix™
  • ID: IF010
  • Created: 01st June 2024
  • Updated: 17th August 2025
  • Platforms: WindowsLinuxMacOS
  • Contributor: The ITM Team

Exfiltration via Email

A subject uses electronic mail to exfiltrate data.

Subsections (2)

ID Name Description
IF010.001Exfiltration via Corporate Email

A subject exfiltrates information using their corporate-issued mailbox, either via software or webmail. They will access the conversation at a later date to retrieve information on a different system.

IF010.002Exfiltration via Personal Email

A subject exfiltrates information using a mailbox they own or have access to, either via software or webmail. They will access the conversation at a later date to retrieve information on a different system.