The File Sharing Intelligence Engine monitors seven distinct channels through which files can leave your organisation. Cloud storage services like Google Drive, OneDrive, and Dropbox are tracked alongside file hosting platforms, dedicated transfer services, USB device operations, clipboard file copies, browser downloads, and sync applications. Each channel is analysed independently and in aggregate.

The engine classifies file sharing activity by destination type, distinguishing between enterprise services (sanctioned by the organisation) and personal or consumer platforms. This classification is critical for data loss prevention, as it highlights when corporate data moves to unsanctioned channels. Incognito browsing and after-hours activity are flagged as additional risk indicators.

File sharing data feeds directly into the Insider Threat engine and the DLP engine, where it contributes to per-user risk scoring. Unusual spikes in upload volume, new service adoption, or after-hours data transfers all generate elevated risk signals.