Navy Data Exfiltration: Two Definitions, One Shared Technical Surface

Executive Summary: Search “navy data exfiltration” and two completely different categories of results come back. Office of Naval Research SBIR topics describe exfiltration as moving sensor data from distributed defense platforms to aggregation nodes. Cybersecurity glossaries describe it as adversaries stealing classified data from defense networks. Both meanings are real, both are active problems for the Navy and its supplier base, and they share far more technical surface than most teams recognize.

Why “Navy Data Exfiltration” Means Two Different Things

The term “data exfiltration” exists inside two separate professional vocabularies.

In defense technical programs, “exfiltration” is neutral. It means moving data from a distributed collection point back to a central node for aggregation. ONR SBIR topic N232-109, titled “Data Exfiltration and Communication Architecture for Cooperative, Autonomous, Underwater, Long-endurance Sensors,” uses the term exactly this way. The Navy wants fleets of underwater autonomous sensors collecting oceanographic data at depths from 60 to 1,500 feet, networked across 1 to 10 nautical miles, and exfiltrating that data back to specialized aggregation nodes. Nobody is attacking anyone. The exfiltration is the mission.

In cybersecurity vocabulary, data exfiltration is almost always malicious. Glossaries from vendors like ThreatLocker, Arctic Wolf, and EfficientIP all define it as the unauthorized transfer of data from a system by an attacker, insider, or malware. In defense contexts specifically, that means adversaries pulling classified material out of Navy networks, defense contractor environments, or supplier systems.

Same term. Opposite framings. Both correct inside their respective worlds.

Why both meanings matter at the same time

Defense programs run both problems simultaneously. The Navy legitimately needs to exfiltrate large volumes of sensor and operational data from the tactical edge back to the enterprise. It also needs to prevent adversaries from exfiltrating anything from any of those same paths.

The uncomfortable truth: the technical surface for both problems overlaps almost entirely.

The Shared Technical Surface

Both problems rely on the same categories of infrastructure.

• Movement of large data volumes over difficult networks. Underwater acoustic links, satellite backhaul, airborne mesh, contested RF, intermittent connectivity. Adversaries exploit the same bandwidth-constrained paths defenders are trying to make reliable.
• Encryption in transit and at rest. Legitimate exfiltration programs require it. Adversary exfiltration campaigns weaponize it, since encrypted channels defeat traditional deep packet inspection.
• Protocol choice. Standard TCP has fundamental throughput limits over high-latency links. UDP-based transport protocols work around that. Both missions need them. Both missions exploit them.
• Edge-to-enterprise data flow architecture. Legitimate programs see a sensor-to-aggregator pipeline. Attackers see a credentials-to-staging-server pipeline. Same shape.
• Identity and credentialing at the edge. Non-human identities, machine credentials, and long-lived tokens on remote platforms. Legitimate programs have to manage them. Adversaries hunt them.
• Integrity verification at the receiving node. Was the data that arrived the data that was sent, from a platform that was actually authorized to send it?

Architectures that solve the legitimate problem well tend to also harden against the illegitimate one. Architectures that fail at one tend to fail at both.

The Legitimate Side: What ONR Is Asking For

ONR SBIR N232-109 is instructive because it describes the actual operational problem defense faces at the tactical edge.

The topic calls for:

• 10 to 100 distributed sensors operating in a cooperative network
• Depths from 60 feet to over 1,500 feet
• Platform spacing of 1 to 10 nautical miles
• Size, weight, and power constraints that fit in an A-size sonobuoy lower unit (under 1,100 cubic inches, under 24 pounds)
• Data types starting with latitude, longitude, pressure, and temperature, with future expansion to acoustic data
• Classified work expected in Phase II with secret-level facility and personnel clearance required

The challenge is not just “move the data.” It is “move the data from a platform you may never physically retrieve, under constraints that defeat most commercial networking assumptions, with integrity guarantees that survive classification review.” That is a hard engineering problem even without an adversary present.

This same problem recurs across every defense program with a distributed edge. Replace underwater sensors with drones, remote sensing packages, forward-deployed compute nodes, or operational tech on allied platforms. The core question stays identical: how do you move operationally critical data from where it was collected to where it will be used, through environments the enemy also has access to?

The Adversary Side: What Defense Environments Actually Face

Nation-state adversaries have been targeting the Navy and its supplier base for years. The 2025 infostealer campaigns against Lockheed Martin and Boeing, the RedNovember espionage activity, and the sustained Chinese and North Korean focus on the US defense industrial base all demonstrate the pattern.

Common exfiltration patterns observed across recent defense-sector breaches:

• Living-off-the-land exfiltration using legitimate tools. SharePoint sync, OneDrive, Dropbox-for-business, approved SFTP. The data moves through sanctioned channels at legitimate times, which is specifically why it is hard to flag.
• DNS tunneling and encrypted channel abuse. Smaller volumes but much harder to detect, especially for persistent long-dwell collection operations.
• Supply chain exfiltration. Adversaries compromise a smaller contractor or supplier to reach the prime, then move laterally into DoD-adjacent environments.
• Non-human identity abuse. Service accounts, API tokens, and long-lived machine credentials that nobody rotates get picked up and used to pull data out at machine speed.
• Insider removal via collaboration platforms. Teams, Slack, email forwarding rules, auto-exports to personal cloud storage, printed documents, removable media.

Defense environments add complication layers civilian environments do not have: classification boundaries, cross-domain solutions, air-gapped networks that still have to receive updates, and compliance regimes (CMMC 2.0, DFARS 252.204-7012, NIST SP 800-171) with legal and contractual consequences for mishandling.

Where the Two Problems Converge for Security Teams

Organizations operating on either side of a defense data pipeline, whether collecting, moving, aggregating, or securing it, need an operational response that addresses both meanings of exfiltration at once.

Visibility into every data path, including the ones you authorized

A legitimate exfiltration pipeline moving 50 GB a day from a sensor network to an aggregation server is also a 50 GB a day path that no data loss prevention tool will flag as anomalous, because it is baseline behavior. If an adversary stages data onto that same path, nothing lights up. Data security posture management platforms like Cyera address this by knowing where sensitive data actually lives and who is accessing it, not just what port it moved through.

Behavioral baselining of the authorized pipeline itself

Who is supposed to be transmitting, at what cadence, with what payload characteristics? Endpoint behavior analytics tools like those from TrendAI catch deviations from established patterns, including deviations hidden inside legitimate data streams.

High-performance secure transport that does not force a tradeoff

Standard TCP throttles over high-latency, lossy links. Defense data has to move anyway, because the mission requires it. The transport layer has to be both fast enough for legitimate volumes and controlled enough that unauthorized use is visible. IBM Aspera’s FASP protocol was built for exactly this bandwidth-latency-security envelope: UDP-based transport, strong encryption, token-based access, and detailed per-transfer logging. PacGenesis deploys and supports Aspera for defense, media, and research environments where moving large files at wire speed is a mission requirement.

Breach and attack simulation against the paths that cannot be lost

Defense security teams do not get to assume the paths work. Breach and attack simulation platforms like Picus Security continuously validate that the controls on authorized data paths actually block unauthorized use, before an adversary gets to find out for them.

Container and software signing for the systems that move the data

The edge platforms moving defense data run on code. If that code came out of a compromised supply chain, every piece of data the platform touches is suspect. Container signing from CleanStart ensures the containers running on remote defense platforms are what they claim to be, built from the sources they claim to come from.

API security for programmatic data flows

Modern defense data pipelines are increasingly API-driven. API security platforms like Radware address the specific class of exfiltration attacks that target API endpoints handling bulk transfer, including attacks that abuse legitimate agent-driven workflows.

What Defense Contractors and Suppliers Should Take From This

If your organization sits anywhere in the defense supply chain, both definitions of “data exfiltration” apply to you.

CMMC 2.0 and DFARS 252.204-7012 obligations hinge heavily on controlling the movement of Controlled Unclassified Information. That means knowing exactly where your legitimate data flows go and detecting illegitimate ones. The documentation requirements alone force an answer to the question “what are all the paths our CUI legitimately moves through?” Once that inventory exists, the detection problem for illegitimate movement becomes solvable.

Supply chain breaches now routinely use smaller contractors as the pivot point to reach primes. The 2025 and 2026 campaigns against Lockheed Martin, Boeing, and other primes consistently showed initial access through subcontractor environments where identity and credential hygiene lagged the primes. If you serve a prime, your adversary profile is the prime’s adversary profile.

The engineering decisions you make for your own legitimate data movement (protocol choice, encryption, authentication, logging) directly determine your detection surface for illegitimate movement later. Build the pipeline right the first time and the monitoring is cheaper. Build it wrong and no amount of DLP tooling bolted on afterward will fully compensate.

The agencies and labs writing SBIR topics like ONR N232-109 are solving one half of the exfiltration problem. The security vendors writing glossary pages about data exfiltration prevention are solving the other half. Organizations that actually serve the DoD have to solve both at the same time, because they are not really two different problems. They are the same problem viewed from opposite ends of the data path.

Operational Baseline

Treating “data exfiltration” as a single problem with two directions produces better architecture decisions than treating it as two separate programs that happen to share a vocabulary.

• Inventory every authorized path your organization uses to move sensitive or classified data. Legitimate exfiltration pipelines count.
• Baseline the behavior of each path: who, what, when, how much, to where.
• Instrument deviations from that baseline, not just unauthorized destinations.
• Enforce strong, auditable transport (encrypted, authenticated, logged per transfer) on every path.
• Verify integrity at both ends of every pipeline, not just origin or destination.
• Validate the controls on your authorized paths regularly through breach and attack simulation.
• Treat non-human identities on edge platforms the same way you treat human identities on your network: inventoried, rotated, monitored, revocable.

Key Takeaways

• “Navy data exfiltration” means two different things depending on which professional vocabulary is reading the term. Both meanings describe real, active defense problems.
• ONR SBIR topic N232-109 illustrates the legitimate side: underwater autonomous sensor networks that must exfiltrate oceanographic data to aggregation nodes under severe size, weight, power, and bandwidth constraints.
• The adversary side involves nation-state actors targeting Navy networks, defense contractors, and the broader DoD supply chain to steal classified and Controlled Unclassified Information.
• Both problems share the same technical surface: large data volumes over difficult networks, encryption in transit and at rest, protocol choice, identity management at the edge, and integrity verification at the receiving node.
• Defense security teams need visibility into every authorized data path, behavioral baselining of those paths, high-performance secure transport that does not force tradeoffs, breach and attack simulation, container signing, and API security.
• Organizations serving the DoD cannot treat these as two separate programs. The engineering decisions made for legitimate data movement directly determine the detection surface for illegitimate movement.

---

PacGenesis helps defense, media, and research organizations deploy high-performance secure data transfer architectures through IBM Aspera and a complementary stack of data security partners including Cyera, Picus Security, TrendAI, CleanStart, and Radware. For deployment or consulting on secure, high-throughput data movement, contact PacGenesis.