I’m not sure that breaches are prevented by “watching the dashboard”, but what do I know?

This feels like a lifetime ago, but IIRC evidence of on-going exfil was apparently presented to users who were no longer working.