Abstract: Generating tracer payloads, integrating the tracer payloads into digital files, and collecting telemetry when the files are accessed on foreign computing environments. A computing device generates a tracer payload including an identifier corresponding to a file and embedded content structured for interpretation by standard file-handling behavior. The computing device integrates the tracer payload into the file to produce a tracer payload-integrated file that, when accessed on a foreign computing environment, automatically causes the foreign computing environment to perform a telemetry operation. The telemetry operation includes generating a network communication containing the identifier and network-pathway attributes associated with the foreign computing environment. A telemetry management service receives the network communication, determines that an exfiltration of the file has occurred, and initiates a responsive action in accordance with enterprise policy.