The Attacker Is Already Past Your Firewall

Most companies protect the places their files live: the network, the laptops, the email system, the shared drive. That worked when files stayed put. Today they go out to customers, partners, lawyers and auditors, and each of those is another place where a stolen password or a breached supplier can put a stranger in the room. Attackers also use AI now to write messages that read like they came from a colleague.

No one can promise to keep every intruder out. What you can ask is what that person finds once they are inside.

Most of our controls protect places, not files

Think about the last sensitive file your company sent outside: a contract draft to a customer, or a financial forecast to a lender. Your own security was probably fine. The file then sat in someone else’s inbox, on someone else’s laptop, protected by someone else’s password. An attacker who gets that login arrives looking like the person you trusted.

The numbers point the same way. Verizon’s 2026 Data Breach Investigations Report found the human element in 62% of breaches and third-party involvement in 48%. IBM’s 2026 Cost of a Data Breach report puts the average cost at $4.99 million and the time to identify and contain a breach at 247 days.

The two clocks do not match. Under the SEC’s 2023 disclosure rules, a public company must file an Item 1.05 Form 8-K within four business days of determining that an incident is material, while the average incident takes 247 days to identify and contain.

A test you can run this week

Pick one sensitive file your company shared outside last quarter, such as a contract or a financial forecast. Then ask your IT or security lead three questions:

1. Who has tried to open it since it was sent?
2. Can you end access today without asking the recipient to do anything?
3. If the recipient forwarded it, would the new person get in?

If any answer is no, that file is relying on the walls around it. Once someone is past them, nothing about the file itself says who should be reading it.

A file with its own rules gives different answers. Its policy is checked each time someone tries to open it. The owner can change or end access after sending. Forwarding does not give a new person access. The history log records every attempt, successful or not. That does not stop anyone from trying. It means each attempt is measured against a policy and written down, which is what you will want in hand when a board member or regulator asks what happened.

Assume the perimeter will be crossed

I do not think security teams are doing anything wrong. They built defenses around the places files live, and those defenses still matter. But the files that matter most leave those places every day, and the rules need to go with them. That is why we built SafeSuite. Each file carries its own policy, and the owner keeps control after sending. The history log shows every attempt.