Morphisec adds exfiltration control to anti-ransomware suite

Morphisec on Sept. 23, 2026 launched Data Exfiltration Control, a new add-on for its Anti-Ransomware Assurance Suite that lets security teams govern common file-transfer tools without inspecting file contents. The release targets double-extortion ransomware, where stolen data can create breach-notification and legal risk even if systems are restored.

Why it matters: - Ransomware now often includes data theft, not just encryption, which makes recovery harder and raises breach-notification pressure. - Morphisec's new control layer is designed to stop outbound theft before encryption completes, using policy and process context instead of content inspection. - The launch extends protection from automatic blocking into a manual control plane for common transfer tools used in double-extortion attacks.

What happened: - Morphisec announced general availability of Data Exfiltration Control on Sept. 23, 2026. - The add-on expands the company's Data Exfiltration Protection capability and the Anti-Ransomware Assurance Suite. - The product runs on the Morphisec Protector already deployed by customers. - The launch is available now as a licensed add-on.

The details: - Data Exfiltration Control governs supported tools including rclone, AzCopy, WinSCP, MegaSync and the AWS CLI. - Security teams can set each tool to Monitor, Alert or Terminate. - Enforcement is deterministic and based on process context plus network destination at the root-domain level. - The product uses zero content inspection. - Teams can begin in Monitor Mode, then move to Preventive Mode with one-click allow rules by domain, account and host. - Outbound transfers are grouped by tool and destination. - Critical-severity Exfiltration Violation incidents map to MITRE ATT&CK techniques T1567.002, T1537 and T1020. - Coverage spans Windows, Linux and macOS. - Morphisec manages the feature centrally in Morphisec Security Center alongside anti-ransomware. - The module adds no new agent and no new console. - The capability is built into the Morphisec Protector. - The company says the add-on is backed by its Ransomware-Free Guarantee. - Organizations can request a demo at More information.

Between the lines: - The release positions Morphisec against traditional DLP tools, which often depend on classifiers and tuning. - Morphisec is betting that tool-based controls will be faster to deploy than content-based inspection. - The strategy reflects a prevention-first model that aims to block exfiltration upstream of encryption.

What's next: - Morphisec said coverage is expanding across Linux and macOS, with full Monitor and Preventive enforcement already available on Windows. - The company is likely to market the add-on as an easier deployment path for teams that want exfiltration controls without a second agent or a separate console.

The bottom line: - Morphisec is turning ransomware defense into a broader control system for outbound data movement, not just malware blocking.