Threat Pulse · Deep dive
Bulk data transfer
An unusual volume of data moved in a short window, the signature of scraping, bulk export, or a compromised agent dumping its context.
How we stop it
Transfer volumes are baselined per agent. Spikes beyond the baseline are blocked and flagged for review.
Frequently asked
What is bulk data transfer?
An unusual volume of data moved in a short window, the signature of scraping, bulk export, or a compromised agent dumping its context.
How does Rogue-Agent Defense stop bulk data transfer?
Transfer volumes are baselined per agent. Spikes beyond the baseline are blocked and flagged for review.
What should I do if I see bulk data transfer in the Threat Pulse feed?
Nothing urgent: the feed only shows attacks that were already blocked or flagged. If one class keeps appearing, review the linked defense guide and check your agents' allowlists, data boundaries, and spend caps.
Counts are real enforcement rows, anonymized. Attack classes seen in fewer than three workspaces never get a page.