# Volume Of Data Compromised

*/Metrics/Volume_Of_Data_Compromised*

## Overview

The metric Volume of Data Compromised measures the precise quantity of sensitive records, bytes, or files accessed and exfiltrated during a security breach. Security analysts and forensic teams spend hundreds of hours during incident response manually cross-referencing server logs, database query histories, and network traffic captures to determine exactly what left the network. Regulators require exact counts of affected individuals and exposed assets within strict compliance windows, turning data quantification into a labor-intensive bottleneck.

This workflow provides fertile ground for autonomous digital forensics agents. Agents connect directly to SIEM tools, data loss prevention endpoints, and database audit logs to trace unauthorized access paths and automatically calculate the exact volume of compromised data. Services-as-software platforms replace manual log parsing with deterministic mapping that categorizes the sensitivity of exfiltrated data to deliver immediate impact assessments.

Headless incident response tools use this metric to trigger automated regulatory filings and targeted breach notifications. Instead of relying on external forensic firms to estimate the blast radius, organizations deploy continuous auditing systems that instantly isolate the exact data delta when an exfiltration event occurs.

## Icp Opportunities

- [Blast Radius Analysis](/Metrics/Volume_Of_Data_Compromised/Opportunities/Blast_Radius_Analysis) — Agent
- [Exfiltration Prevention Engine](/Metrics/Volume_Of_Data_Compromised/Opportunities/Exfiltration_Prevention_Engine) — Headless SaaS
- [Vendor Risk Triage](/Metrics/Volume_Of_Data_Compromised/Opportunities/Vendor_Risk_Triage) — Service-as-Software
- [Breach Notification Automation](/Metrics/Volume_Of_Data_Compromised/Opportunities/Breach_Notification_Automation) — Agent
- [AI Incident Triage](/Metrics/Volume_Of_Data_Compromised/Opportunities/AI_Incident_Triage) — Service-as-Software

## Breakdown

### Vulnerable Data Types
- [Personally Identifiable Information](/Metrics/Volume_Of_Data_Compromised/Knowledge/Personally_Identifiable_Information)
- [Protected Health Information](/Metrics/Volume_Of_Data_Compromised/Knowledge/Protected_Health_Information)
- [Financial Transactions](/Metrics/Volume_Of_Data_Compromised/Knowledge/Financial_Transactions)
- [Intellectual Property](/Metrics/Volume_Of_Data_Compromised/Knowledge/Intellectual_Property)
- [Authentication Credentials](/Metrics/Volume_Of_Data_Compromised/Knowledge/Authentication_Credentials)

### Compromise Vectors
- [Phishing Campaigns](/Metrics/Volume_Of_Data_Compromised/Processes/Phishing_Campaigns)
- [Ransomware Deployment](/Metrics/Volume_Of_Data_Compromised/Processes/Ransomware_Deployment)
- [Cloud Misconfigurations](/Metrics/Volume_Of_Data_Compromised/Processes/Cloud_Misconfigurations)
- [Third Party Breaches](/Metrics/Volume_Of_Data_Compromised/Processes/Third_Party_Breaches)
- [Insider Data Exfiltration](/Metrics/Volume_Of_Data_Compromised/Processes/Insider_Data_Exfiltration)

### Data Protection Tooling
- [Data Loss Prevention](/Metrics/Volume_Of_Data_Compromised/Software/Data_Loss_Prevention)
- [Endpoint Detection Response](/Metrics/Volume_Of_Data_Compromised/Software/Endpoint_Detection_Response)
- [Cloud Security Posture](/Metrics/Volume_Of_Data_Compromised/Software/Cloud_Security_Posture)
- [Identity Access Management](/Metrics/Volume_Of_Data_Compromised/Software/Identity_Access_Management)
- [Security Information Management](/Metrics/Volume_Of_Data_Compromised/Software/Security_Information_Management)

### Highly Targeted Organizations
- [Healthcare Providers](/Metrics/Volume_Of_Data_Compromised/CompanyTypes/Healthcare_Providers)
- [Financial Institutions](/Metrics/Volume_Of_Data_Compromised/CompanyTypes/Financial_Institutions)
- [Government Agencies](/Metrics/Volume_Of_Data_Compromised/CompanyTypes/Government_Agencies)
- [Retail Enterprises](/Metrics/Volume_Of_Data_Compromised/CompanyTypes/Retail_Enterprises)
- [Technology Companies](/Metrics/Volume_Of_Data_Compromised/CompanyTypes/Technology_Companies)

## Diagrams

```mermaid
flowchart TD; Incident[Incident Detected]-->Storage[Identify Affected Storage]; Storage-->Egress[Analyze Egress Logs]; Storage-->Access[Audit Access Logs]; Egress-->Bytes[Calculate Exfiltrated Bytes]; Access-->Records[Count Unauthorized Records]; Bytes-->Aggregate[Aggregate Compromised Volume]; Records-->Aggregate; Aggregate-->UpdateMetric[Update Volume Metric];
```

```mermaid
flowchart LR; MetricRoot[Volume Of Data Compromised]-->RecCount[Record Count]; MetricRoot-->DataSize[Data Size]; RecCount-->PII[PII Records]; RecCount-->Fin[Financial Records]; DataSize-->DB[Database Dumps]; DataSize-->Docs[Document Archives];
```

## Neighborhood

### Latent gaps

- [AI Incident Triage](/Opportunities/AI_Incident_Triage) — latent gap · Opportunities
- [Blast Radius Analysis](/Opportunities/Blast_Radius_Analysis) — latent gap · Opportunities
- [Breach Notification Automation](/Opportunities/Breach_Notification_Automation) — latent gap · Opportunities
- [Exfiltration Prevention Engine](/Opportunities/Exfiltration_Prevention_Engine) — latent gap · Opportunities
- [Vendor Risk Triage](/Opportunities/Vendor_Risk_Triage) — latent gap · Opportunities

### Problems this exposes

- [Surging Cyber Insurance Premiums](/Problems/Surging_Cyber_Insurance_Premiums) — exposes problem · Problems
- [Determine Breach Blast Radius](/Problems/Determine_Breach_Blast_Radius) — exposes problem · Problems
- [Third-Party Data Exposures](/Problems/Third-Party_Data_Exposures) — exposes problem · Problems
- [Halt Active Data Exfiltration](/Problems/Halt_Active_Data_Exfiltration) — exposes problem · Problems
- [Incident Responder Burnout](/Problems/Incident_Responder_Burnout) — exposes problem · Problems
- [Post-Breach Customer Churn](/Problems/Post-Breach_Customer_Churn) — exposes problem · Problems
- [Regulatory Breach Fine Exposure](/Problems/Regulatory_Breach_Fine_Exposure) — exposes problem · Problems

### Similar Metrics

- [Number Of Service Breaches](/Metrics/Number_Of_Service_Breaches) — similar · Metrics
- [Volume Discrepancy Rate](/Metrics/Volume_Discrepancy_Rate) — similar · Metrics
- [Compliance Violation Count](/Metrics/Compliance_Violation_Count) — similar · Metrics
- [Security Breach Rate](/Metrics/Security_Breach_Rate) — similar · Metrics
- [Number Of Vulnerabilities Resolved](/Metrics/Number_Of_Vulnerabilities_Resolved) — similar · Metrics
- [Number Of Audit Findings](/Metrics/Number_Of_Audit_Findings) — similar · Metrics
- [Shadow IT Incident Count](/Metrics/Shadow_IT_Incident_Count) — similar · Metrics
- [Critical Findings Count](/Metrics/Critical_Findings_Count) — similar · Metrics
- [Audit Finding Count](/Metrics/Audit_Finding_Count) — similar · Metrics
- [Security Compliance Rate](/Metrics/Security_Compliance_Rate) — similar · Metrics
- [Incident Resolution Cost](/Metrics/Incident_Resolution_Cost) — similar · Metrics
- [Policy Violation Frequency](/Metrics/Policy_Violation_Frequency) — similar · Metrics
- [Remediation Completion Rate](/Metrics/Remediation_Completion_Rate) — similar · Metrics
- [Security Gap Identification Rate](/Metrics/Security_Gap_Identification_Rate) — similar · Metrics
- [Reported Compliance Violations](/Metrics/Reported_Compliance_Violations) — similar · Metrics
- [Risk Assessment Completeness](/Metrics/Risk_Assessment_Completeness) — similar · Metrics
- [Critical Vulnerabilities Identified](/Metrics/Critical_Vulnerabilities_Identified) — similar · Metrics
- [Compliance Gap Rate](/Metrics/Compliance_Gap_Rate) — similar · Metrics
- [Number of Material Findings](/Metrics/Number_of_Material_Findings) — similar · Metrics
- [Cost of Recovery](/Metrics/Cost_of_Recovery) — similar · Metrics