Competitive Intelligence and Strategic Plans as Unlabeled High-Value Targets
Strategic documents lack labels, making them invisible to the tools designed to protect them.
The information that creates enterprise value, competitive intelligence files, strategic plans, go-to-market roadmaps, M&A analyses, and pricing models, is the information most organizations cannot see leaving. Its loss does not trigger a compliance violation. It triggers a strategic one, and that distinction explains why so much of it disappears without anyone noticing.
Unlike PII or payment card data, this category of information has no standardized definition and no regulatory tripwire. Its sensitivity is entirely a function of what it means to the business. A credit card number is sensitive because a rule says so. A pricing model is sensitive because a competitor would pay to see it, and no rule captures that difference. The consequences follow the same logic. A breach that exposes customer records produces a notification obligation, a fine, and bad press, all legible and measurable. The theft of a five-year product roadmap produces a competitor who is never caught, a market position that erodes quietly, and a strategic advantage that evaporates without a single alarm sounding.
Adversaries understand this asymmetry precisely. Nation-state actors are no longer focused only on classified secrets. They are systematically collecting sensitive unclassified information across virtually every sector of the economy, targeting trade secrets, intellectual property, and R&D. Beijing has prioritized AI, biotechnology, quantum information science, and semiconductors, pursuing this agenda through IP theft, cyber operations, and talent recruitment. Strategic and technical plans for any organization working near those fields are prime targets, not incidental ones.
The Under Armour case adds the long tail. The Everest Ransomware Group stole 343GB in November 2025, eventually leaked in January 2026, including product catalog records, marketing campaign logs, user behavior analytics, and internal documents. The fallout arrived in the form of class-action litigation. What is instructive about that inventory is how few of the files would have carried a classification label under any conventional scheme. They were ordinary business documents, the kind that fill shared drives and collaboration platforms in every enterprise. Their loss was devastating precisely because no one had marked them as valuable.
Why these files carry no label — and why that is structural, not an oversight
The absence of classification labels on competitive intelligence and strategic documents is not a process failure that better training will fix. It is a structural feature of how this information is created and used, and treating it as an oversight misdiagnoses the problem from the start. These documents are typically produced by business users, strategy teams, sales leaders, product managers, working in standard productivity tools. Classification workflows, where they exist, were built for IT-adjacent or compliance-adjacent processes. They assume a document arrives at a point where someone formally decides what it is, applies a tag, and files it accordingly. That assumption does not survive contact with the cadence of a quarterly planning cycle. A go-to-market roadmap is drafted, shared, commented on, revised, and redistributed across a half-dozen tools before anyone would reasonably pause to classify it. By the time a labeling workflow could engage, the document has already proliferated.
The deeper problem is that this information resists pattern-based identification. A document's sensitivity is contextual and temporal: a go-to-market roadmap is not sensitive on its face. It is sensitive because of what it reveals about timing, pricing, and competitive positioning, none of which is captured in a regex or a content pattern. A spreadsheet containing a competitive win/loss model looks identical to a spreadsheet containing sales training data. The difference is not in the content's structure or vocabulary. It is in what the content would mean to a competitor who obtained it at this moment, against this market, during this cycle. That is not a property any static rule can recognize.
The evidence confirms the gap at scale. Fortinet's 2025 Insider Risk Report found that only roughly a quarter of organizations have effective data discovery and classification. The majority cannot reliably identify which documents belong to this category, let alone protect them. The same report found that most organizations cannot see how users interact with sensitive data across endpoints, cloud apps, and GenAI platforms. The visibility gap and the classification gap compound each other. If a file carries no label, any tool that reads labels to decide what to protect will treat that file as ordinary. That is the logical consequence this entire category of data faces daily.
What label-dependent controls do when they encounter an unlabeled strategic document
Legacy DLP does not fail on unlabeled strategic documents because it is misconfigured. It fails because it was designed around a fundamentally different problem: known data types with detectable patterns. The tools were built for an era when the things worth protecting announced themselves through format. That architecture still works for what it was made to catch. It was never made to catch this.
Traditional DLP operates on predefined rules, blocking transmission of content that matches a known pattern, a credit card number, a Social Security format, a specific keyword list. The mechanism has no way to evaluate what a document means to the business, because meaning is not a property the rule engine can read. When an unlabeled competitive analysis or M&A target list moves through email, a USB drive, or a cloud sync, the tool sees a document with no triggering label and no matching pattern, and it does nothing. That is not a malfunction. It is the correct execution of the tool's design logic, applied to a category of risk the design never anticipated.
The Intel case makes the bypass mechanism explicit. A former employee downloaded approximately 18,000 sensitive files before termination. Intel's DLP blocked one exfiltration attempt, but the employee used a second device to complete the theft. Static rules created a chokepoint, not a shield. The incident demonstrates what happens when protection depends on blocking specific transfers rather than understanding the pattern of activity surrounding them. One chokepoint held. Every other path remained open.
The false positive problem compounds the miss rate from the opposite direction. Legacy DLP produces a high volume of alerts on ordinary data movement, training analysts to deprioritize or dismiss alerts. So even when a signal does appear, it competes against noise. The analyst who has cleared three hundred false positives this quarter is not primed to recognize the three hundred and first alert as genuine. Fortinet's 2025 Insider Risk Report found that most organizations do not consider their existing DLP tools effective at preventing sensitive data from leaving the organization, and that these tools lack the visibility to understand the who and the why behind data movement. The strategic document leaves, and the system that was supposed to see it leave reports that nothing happened.
How the exfiltration window for this data has narrowed — and what has opened new channels
Two concurrent developments have shortened the time between access and loss: the compression of the attack lifecycle by AI, and the emergence of enterprise AI tools as a new, low-friction exfiltration surface inside the organization. Neither development is speculative. Both are measurable in the 2025 evidence, and both make the structural blindness documented above more costly than it was even two years ago.
AI has become a force multiplier for threat actors, compressing the attack lifecycle from access to impact. The share of incidents reaching exfiltration in under one hour grew from 2024 to 2025. That shift removes the window in which a defender might notice something moving. An attack that took days gave analysts time to correlate signals. An attack that takes minutes gives no one anything.
Enterprise AI tools remove the discovery latency that once gave defenders time to act. An insider can surface credentials, financial data, or intellectual property at the speed of a prompt. The practical consequence is that the search phase of data theft, which used to require knowing where files lived and navigating to them, now collapses into a natural-language query. Common shadow AI practices include uploading internal documents to generative AI tools and using AI meeting assistants that generate summaries. These actions create exfiltration channels that carry no traditional DLP signal because the action looks like ordinary productivity behavior. A strategic document pasted into a public AI interface produces no pattern match, no label violation, and no alert. It produces a completed query and a satisfied user.
The organizational readiness gap compounds the exposure. Fortinet's 2025 Insider Risk Report found that most organizations do not feel fully prepared to respond to GenAI as an expanding attack surface, even as concern about AI tool misuse is high among security leaders. The concern exists. The preparation does not. The resulting posture leaves organizations watching a channel they cannot close with tools that cannot see it. The IRS contractor case illustrates a related archetype: trusted third parties accessed and exfiltrated sensitive documents and databases, a category of action that looks authorized until the damage is done. Privileged access performed exactly as legitimate access is supposed to perform, which is precisely why static rules could not baseline against it.
Why insider risk programs still miss this category of data loss even when they exist
The existence of an insider risk program does not close the gap if that program relies on behavioral baselines and reactive alerting. Unlabeled IP theft often looks normal, authorized, and statistically unremarkable until after the damage is done. The program may be functioning exactly as designed. The design does not match the threat.
The scale of the shortfall is measurable. Fortinet's 2025 Insider Risk Report found that only 14% of organizations feel fully confident in their insider threat detection capabilities, and that most lack effective behavioral insight, contextual awareness, and real-time responsiveness. The dominant execution path for insider-style data loss is not a dramatic anomaly. It is low-noise access through legitimate credentials: console access, SaaS data pulls, bulk exports through authorized accounts, all appearing within normal permission boundaries. The system sees activity that is indistinguishable from productive work, because in the technical sense it is.
Behavioral baselines are insufficient as a sole detection layer for reasons that are structural, not incidental. Risk may exist from day one, a new hire with an intent to steal, before any baseline has formed. It may remain statistically normal throughout, a trusted employee with authorized access to everything they take. Or it may occur entirely through authorized access, a departing employee copying files they have always been allowed to touch. In each case, the anomaly detector has nothing anomalous to detect. Fragmented tool integration compounds the problem architecturally. Alerts from DLP, UEBA, and SIEM are frequently not correlated into coherent cases, so the moment a strategic document is staged for exfiltration produces signals in multiple systems that no analyst connects. Each tool sees a fragment. No one sees the theft.
It is worth acknowledging the strongest objection honestly. Behavioral analytics have improved significantly, and they have genuine value. The argument is not that they are useless. The 2025 evidence shows something more precise: insider incidents were still frequently detected late or post-impact, with identity misuse and living-off-the-land techniques succeeding precisely because they generated no behavioral anomaly to detect. A detection layer that depends on anomaly will miss the adversary who never behaves anomalously. That is not a flaw in the layer. It is a statement of its boundary.
What effective protection of unlabeled strategic IP actually requires
Protecting unlabeled competitive intelligence and strategic plans requires a platform that understands what information means to the business, not just what it says about itself, and combines that understanding with the full context of who is touching it, where it is going, and what the surrounding pattern of activity looks like. No single signal carries the answer. The architecture must hold them together.
Data-loss controls should combine content inspection with context: user, device, destination, application, and behavioral history. Industry guidance frames this as the necessary evolution beyond perimeter-focused and label-dependent approaches. Treating any one signal as sufficient reproduces the failure this piece has traced from the beginning, because each signal is weak in isolation. A single event is almost never the risk. The risk lives in the behavioral pattern across an entire user timeline. A departing employee downloading a competitive analysis is low signal on its own, but that action in the context of an upcoming departure date, a spike in cloud sync activity, and a history of accessing files outside their normal scope is a different matter entirely. The context transforms a benign action into a readable indicator, and it does so without requiring the file to carry a label.
Shadow AI cannot be controlled through visibility alone or by blanket prohibition. Controls must be sensitive to the data, the destination, the account ownership, and the context, with the ability to intervene before sensitive content reaches an uncontrolled AI surface. That last clause matters. Intervention after the prompt has been answered is documentation, not protection. The control point has to sit between the user's intention and the data's departure.
AI-driven investigation should operate before alerts reach human analysts, not after, so that by the time a security team member sees a candidate event, the surrounding context, timeline, related actions, identity, role, access pattern, is already assembled. This directly addresses the alert fatigue problem that allows unlabeled IP theft to go undetected. The analyst who receives a pre-assembled case can evaluate the pattern rather than reconstruct it, which is the difference between catching a theft and closing a ticket. The most valuable data often has no label, so the platform's understanding of data sensitivity must come from what the content means in business context, not from whether a classification tag is present. That is the foundational requirement, and it is the one that eliminates the protection gap this piece has traced from its first paragraph.
