Table Of Content
Related Posts
Data Exfiltration Through Unmonitored Endpoints: Why Network Trust Models Fail in Hybrid Work
-
August 18, 2026
-
Quick Answer:
AI Security Posture Management (AISPM), also called AI Posture Management, is the continuous process of discovering, monitoring, and controlling how AI tools, models, and agents interact with your company's data and systems. It covers everything from spotting an unapproved AI app on someone's laptop to blocking a customer record from being pasted into a public chatbot. Most teams that manage AI posture well pair a discovery layer with policy enforcement at the point where employees actually use AI, which is the endpoint.
Remote employees using split-tunnel network configurations route only corporate traffic through encryption while everything else, from personal streaming to SaaS logins to GenAI prompts, goes straight to the open internet. That design choice improves speed and cuts infrastructure load, but it also means a large share of an employee’s daily data activity never passes through any corporate inspection point at all. For a workforce that now routes sensitive files, credentials, and prompts through AI tools every day, that unmonitored path is where data actually leaks.
Kitecyber works with hybrid and remote-first companies moving away from network-centric security models, and the pattern is consistent: network-based access controls were built for a bandwidth problem, not a data-protection problem, and relying on them for security leaves a real gap between what a tunnel sees and where sensitive data actually ends up.
TL;DR
- Unmonitored endpoints send only corporate-bound traffic through encryption; everything else, including GenAI apps and unmanaged SaaS, travels unmonitored [42gears.com].
- Roughly 36% of corporate users have adopted split tunneling to optimize performance, expanding the blind spot across the hybrid workforce [fieldeffect.com][infosecurity-magazine.com].
- NIST SP 800-207 explicitly warns that network connection should never imply trust, since flat network architectures allow lateral movement once one device or credential is compromised.
- AI has compressed the exfiltration timeline: data can leave a device in as little as 27 seconds once an attacker or a misconfigured agent has access.
- Endpoint-native data controls, not network tunnels, are the only mechanism that can see and govern data movement regardless of which path traffic takes.
About the Author: This article is published by Kitecyber, a data-security company built around endpoint DLP, GenAI and AI-agent controls, and Zero Trust Network Access for hybrid organizations replacing legacy VPN and SSE stacks. Kitecyber’s engineering and security teams work directly with technology, healthcare, and financial services customers migrating off split-tunnel architectures toward endpoint-native enforcement.
Why Endpoint Data Protection Must Be Your Primary Control
Split-tunnel network configurations create exfiltration risk because they remove corporate inspection from exactly the traffic most likely to carry sensitive data outward. Security teams frequently assume a network tunnel, split or not, provides a baseline layer of protection. It doesn’t cover what never enters the tunnel.
Consider what typically gets excluded from the tunnel in a standard split-tunnel policy:
- Personal cloud storage uploads (Dropbox, personal Google Drive)
- Unsanctioned SaaS and shadow IT applications
- GenAI copilots and browser-based AI tools
- Personal email and messaging apps
- General web browsing on an unmanaged network
Each of these is a plausible channel for sensitive data to leave a device. A support engineer pasting a customer record into a personal AI assistant, a contractor uploading source code to an unsanctioned file-sharing tool, an employee on public Wi-Fi with malware riding the unencrypted leg of their connection: none of these are hypothetical edge cases anymore, they are documented risk categories tied directly to split-tunnel design [fieldeffect.com][community.spiceworks.com][fractionalciso.com].
The mechanism is worth spelling out plainly, because it explains why patching the network configuration doesn’t solve it: a tunnel is a pipe, not a filter. It decides which traffic travels encrypted to headquarters, but it has no visibility into the content moving through the traffic it excludes. Asking a split-tunnel configuration to prevent data exfiltration is like asking a toll booth on one highway exit to catch every car leaving town when three other roads have no booth at all. Network access controls were never designed to inspect content; they were designed to route packets.
How Has AI Changed the Stakes of This Gap?
The split-tunnel blind spot existed before AI, but AI has changed how much damage fits through it and how fast. Average organizations now upload 8.2 GB of data per month to AI applications, and prompt volume into GenAI apps has grown sixfold in a single year. Almost none of that traffic is destined for a corporate server that a network tunnel would route through the corporate path; it goes directly to third-party AI infrastructure over the open internet, which is precisely the traffic split tunneling excludes by design.
This is the core argument behind why endpoint visibility now matters more than network visibility. AI copilots and autonomous agents can read, summarize, and move sensitive data at machine speed, often without a human reviewing what left the device. Attackers have adapted at the same pace: AI-accelerated attacks have compressed the average breakout time to 29 minutes, with data exfiltration observed in as little as 27 seconds in the fastest cases. A network appliance inspecting traffic at a gateway, even a well-configured one, cannot react inside a 27-second window if the traffic in question never reaches that gateway.
This is the exact reason legacy tools fall short here: endpoint tools were built to catch malware signatures, network tools were built to inspect packets crossing a perimeter, and network-based access controls were built to trust a connection once authenticated. None of them were built to evaluate what a GenAI prompt contains or where an autonomous agent is about to send a file. The endpoint, where the file, the prompt, and the user action all originate, is the only point where that evaluation can happen before the data leaves.
Why Network-Based Trust Models Cannot Scale to Endpoint Risk
NIST SP 800-207, the federal standard defining Zero Trust Architecture, states plainly that network location, including being connected to a secure tunnel, should not grant implicit trust. Traditional network-based access relies on flat networks: once a device authenticates, it typically gains broad access to internal resources, which means a single compromised credential or device can move laterally across the network with little friction.
This is a distinct problem from split tunneling but a related one. Split tunneling weakens visibility into what leaves the device; flat network trust weakens containment of what an attacker can reach once inside. NIST’s guidance pushes toward micro-segmentation and continuous, per-session verification rather than a one-time authentication check at connection, a principle that Zero Trust Network Access architectures are built to enforce directly [appgate.com][jimber.io].
How Zero Trust Network Access and Endpoint Enforcement Work Together
Zero Trust Network Access replaces implicit connection-based trust with continuous, context-based access decisions evaluated per session and per resource. Instead of granting a device broad access to a network segment once it authenticates, it grants access to a specific application based on identity, device posture, and least privilege, re-evaluated continuously rather than assumed for the life of the session.
This matters because endpoint data enforcement must run in parallel. Network access control determines who can reach which resource; endpoint data protection determines what they can do with that data once they reach it. Access decisions happen at the point of connection to each resource, which removes the performance-versus-visibility tradeoff that made split tunneling attractive in the first place.
|
Capability |
Legacy Network Tunnel |
Split-Tunnel Configuration |
Zero Trust Network Access with Endpoint DLP |
|---|---|---|---|
|
Visibility into all traffic |
Yes, at cost of performance |
No, by design |
Per-application, continuous, plus endpoint inspection |
|
Lateral movement risk |
High (flat network) |
High (flat network) |
Low (segmented, least privilege) |
|
GenAI/SaaS traffic inspection |
Only if backhauled |
None |
Endpoint-native, independent of network path |
|
Performance impact |
High |
Low |
Low |
|
Trust model |
Connection-based |
Connection-based |
Session, context, and data-aware |
The table makes the tradeoff explicit: network access controls alone cannot provide visibility without reintroducing the performance problem split tunneling was meant to fix. Endpoint data protection closes that gap by making visibility independent of network routing.
Data Protection Must Be the Center of Your Hybrid Access Strategy
Given everything above, data protection has to sit at the endpoint, because the endpoint is the only place present for every version of this traffic: tunneled, split, encrypted, or direct to a GenAI app. Network-layer controls, whether a full tunnel, a split-tunnel configuration, or even a well-configured secure access service edge, only see traffic that passes through them. Endpoint-native enforcement sees the action itself: the file being opened, the clipboard being copied, the prompt being typed, the upload being initiated, regardless of which network path it eventually takes.
This is the design principle behind Kitecyber’s approach: See, Decide, Enforce, continuously. A single lightweight agent observes data movement, browser activity, SaaS access, and GenAI interactions directly on the device, evaluates each action in context (who is acting, what device, what data, where it’s going), and enforces the right control (allow, block, warn, coach, log, or isolate) at the moment of action, before data leaves rather than after a network appliance flags it downstream.
Practically, this looks like consolidation rather than a new layer bolted onto an existing stack:
- Endpoint DLP software replaces static, perimeter-dependent DLP rules with real-time classification using document context and data lineage
- Network DLP extends the same policy engine to traffic that does route through managed connections
- Zero Trust Network Access replaces flat network trust with per-session, least-privilege access to private apps and cloud infrastructure
- Secure Web Gateway and cloud access security broker functions run at the endpoint rather than requiring backhaul, closing the exact gap split tunneling opens
- GenAI and AI-agent controls govern what users and autonomous agents can do with sensitive data at the point of the prompt, not after the fact
Organizations evaluating endpoint and network security architectures broadly are, in practice, asking the same underlying question this article opened with: where should the enforcement point actually live. Kitecyber’s answer is consistent across every one of these categories: as close to the data as possible, which is the endpoint, not the network path it happens to travel.
References
- The hidden risks of VPN split tunnelling (and how to manage them) (fieldeffect.com)
- Remote VPN Clients, Split Tunnels – For or Against? – Networking – Spiceworks Community (community.spiceworks.com)
- What is Split Tunnel VPN? Benefits, Risks and How to Secure It with MDM (42gears.com)
- Splitting Hairs on Split Tunneling (fractionalciso.com)
- Remote Hybrid Workforce Security 2026: Home Network and Endpoint Guide (decryptiondigest.com)
- The VPN Security Crisis: Why Your 2026 Access Strategy… | AppGate (appgate.com)
- Why Zero Trust Network Access is replacing VPN in 2026 – Jimber (jimber.io)
- VPN Split-Tunneling – To Enable or Not To Enable – Infosecurity Magazine (infosecurity-magazine.com)
Frequently Asked Questions
Yes, in terms of network visibility. Split tunneling excludes non-corporate traffic from inspection, which improves performance but removes the ability to monitor that traffic for exfiltration or malware [42gears.com][fractionalciso.com].
No. Full-tunnel setup restores visibility for traffic routed through corporate infrastructure but still relies on connection-based trust, which NIST SP 800-207 identifies as a lateral movement risk once a credential or device is compromised.
Partially. Secure access service edge platforms improve inspection for traffic routed through their cloud, but coverage still depends on how much traffic is actually backhauled, which is the same tradeoff split tunneling was created to avoid.
Because GenAI traffic goes directly to third-party infrastructure and typically falls outside the corporate tunnel by default, and prompt volume into these apps has grown sixfold in a year, meaning the excluded traffic category is growing faster than corporate traffic.
Endpoint DLP evaluates data actions at the device, regardless of network path; network DLP evaluates traffic that passes through a monitored network segment. Split tunneling limits network DLP's coverage but does not affect endpoint DLP's visibility.
Zero Trust Network Access is built to provide per-application access based on identity and device posture rather than broad network-level trust upon connection [appgate.com][jimber.io].
This typically requires an endpoint-level audit of data movement and network destinations rather than relying on network logs alone.
With over a decade of experience steering cybersecurity initiatives, my core competencies lie in network architecture and security, essential in today's digital landscape. At Kitecyber, our mission resonates with my quest to tackle first-order cybersecurity challenges. My commitment to innovation and excellence, coupled with a strategic mindset, empowers our team to safeguard our industry's future against emerging threats.
Since co-founding Kitecyber, my focus has been on assembling a team of adept security researchers to address critical vulnerabilities and enhance our network and user security measures. Utilizing my expertise in the Internet Protocol Suite (TCP/IP) and Cybersecurity, we've championed the development of robust solutions to strengthen cyber defenses and operations.
Posts: 81
With over a decade of experience steering cybersecurity initiatives, my core competencies lie in network architecture and security, essential in today's digital landscape. At Kitecyber, our mission resonates with my quest to tackle first-order cybersecurity challenges. My commitment to innovation and excellence, coupled with a strategic mindset, empowers our team to safeguard our industry's future against emerging threats.
Since co-founding Kitecyber, my focus has been on assembling a team of adept security researchers to address critical vulnerabilities and enhance our network and user security measures. Utilizing my expertise in the Internet Protocol Suite (TCP/IP) and Cybersecurity, we've championed the development of robust solutions to strengthen cyber defenses and operations.
Posts: 81
