A quiet finding, years before the headlines
Some years ago I was asked to look into a security product deployed across a large organization. Nothing was obviously wrong — the software ran, the endpoints looked protected. The network told a different story.
Following the traffic forensically, I traced large, regular outbound transfers leaving the organization and terminating at a chain of proxy servers abroad. The volume was substantial and the cadence was regular — this was not a person browsing the web. So we did the responsible thing: we wrote to the vendor, attached what we had, and asked a simple question — what are these large, regular transfers?
The answer, delivered informally through a local representative, was: “updates.”
That answer does not survive first contact with how software actually works. When a vendor updates its product, it pushes data to you — new signatures, new binaries, new rules travel down the wire, into the endpoint. A steady stream of data leaving your network is the opposite shape. Updates come in. This was going out.
Let me be precise, because precision is the whole point of this profession. I no longer hold the packet captures from that engagement, and it was years ago; I will not name the client, and I will not accuse a specific vendor of wrongdoing I can no longer place in evidence. What I can give you is the lesson — the one that has held up in every engagement since, and that you can verify on your own network today.
The principle: read the direction, not the label
Every application has a traffic “shape.” A browser pulls pages in and sends small requests out. An update service pulls large files in on a schedule and sends almost nothing out. A backup client sends large volumes out — but to a destination you configured. Trouble looks like this:
- Direction — sustained outbound volume that dwarfs inbound.
- Cadence — regular, machine-like intervals (every hour; every night at 02:00). Humans are irregular; exfiltration is scheduled.
- Destination — IPs, domains or proxies unrelated to the vendor's published infrastructure or your business.
- Justification gap — the flow can't be explained by the app's function, and “updates” is offered to explain outbound traffic.
No single signal proves malice. Together they define anomalous egress — and anomalous egress is where data leaves. Endpoint antivirus and most EDR agents are built to inspect what runs on the host; they are not built to sit on the wire and ask why a trusted process is shipping gigabytes to a proxy in another jurisdiction.
How to check your own network — a practical playbook
You can do a first pass with tools you already have:
- Baseline egress per application. For a week, record bytes-out vs bytes-in per process and per destination. You are looking for the profile above: high, regular outbound to a narrow set of external endpoints.
- Resolve the destinations. Map outbound IPs and TLS SNI / DNS names to real owners. Proxies, hosting in unexpected countries, or infrastructure that doesn't match the vendor's published ranges deserve a question.
- Test the “update” claim. Real updates are pull-heavy and bursty around release times. If a product claims “updates” but shows steady, scheduled outbound volume, the claim and the data disagree.
- Watch privileged, trusted processes hardest. Security software runs with deep privileges and is trusted by definition — which is exactly why its egress deserves the most scrutiny, not the least.
The uncomfortable truth: the more trusted the software, the less anyone watches what it sends home.
Why jurisdiction is part of the threat model
Where your security vendor is based — and where its servers and updates actually route — is not a political footnote. Software installed with high privilege can, in principle, see and move a great deal, so trust in that software is inseparable from the legal and geopolitical jurisdiction that can compel it.
This is not a fringe view; it is public record. Multiple governments have restricted specific foreign security vendors from state and critical-infrastructure use on national-security grounds — the United States, European Union institutions, and Romania among them. Whatever one concludes about any single vendor, the pattern is documented and worth internalizing: vendor trust and vendor jurisdiction are the same decision.
My own view — formed on the wire, long before those official decisions — is simple: assume nothing about a privileged application until you have watched what it sends out.
What good looks like: continuous, autonomous egress monitoring
The answer is not paranoia; it is visibility. You want a system that continuously baselines normal traffic for every asset and raises a hand the instant egress deviates — new destination, wrong direction, off-schedule volume. Not once a year in an audit, but every minute, automatically.
This is precisely the gap between an endpoint antivirus with a default firewall and a real Security Operations Center. Endpoint tools ask “is this file bad?” A SOC — especially an autonomous, AI-driven one sitting inline on the network — asks the question that actually surfaced the transfers above: “is this trusted thing behaving the way it should?” That is the work we build CYBER3.AI to do: sovereign threat intelligence and autonomous detection and response, watching the traffic, not only the files.
Updates come in. Data goes out. If you remember one line from a career spent on the wire, make it that one — then go and look at your own egress.