Business data doesn't only move through email and the browser.
ZORB watches the data your applications send outbound — checking it's going where it should.
Why nothing else in your stack does this
Your firewall sees an IP. DLP sees content. EDR sees behaviour. None connects the process that opened the connection to the company that owns the destination — because none was built to.
We check the vendor IP matches the expected application's ASN ownership. We don't trust DNS. Poison the resolver — our answer doesn't change.
Enriched services intel
Your firewall sees an IP. Your EDR can tell you svchost.exe made a connection — but svchost.exe is the process name for dozens of different Windows services. The process list alone can't tell you which one.
ZORB names it: which service inside svchost, which function a DLL call actually ran, which script python executed, what command ssh ran and against which repo. That's the kind of detail Process Explorer shows manually, one process at a time. ZORB captures it automatically, on every connection, as it happens.
Each service is tracked separately, too — so a malicious one can't hide behind a legitimate one sharing its alert history.
26 applications enriched this way — currently in beta.
Where your updaters actually go
Updaters download code and execute it, unattended, on a schedule, with nobody watching.
ZORB shows every update channel and where it actually connected — vendor infrastructure, a CDN in front of it, or something else. Start with your AI tooling — newest software on the estate, least scrutiny.
A trusted updater to the wrong destination — blocked.
CDN or masquerade — you can't always tell
Vendors route traffic through shared infrastructure — Akamai, Cloudflare, the rest. That means a legitimate app can land on an IP outside its own vendor's ASN, and an attacker on the same shared infrastructure looks identical.
We've blocked it — and the IP links straight to VirusTotal, in your browser, against their database. You're not taking our word for it.
Nobody can tell a legitimate CDN from an attacker on clean infrastructure by looking at it. Which is the argument for enforcement, not detection — you don't need to spot the masquerade if the traffic was never allowed to leave for anywhere but the vendor.
In practice, most of these are the mundane case — a real app on a CDN outside its usual range — and they mostly recover on their own. When a trusted app gets blocked this way, we nudge it: a fast reset that pushes it to reconnect, often landing back inside the vendor's own range on the retry. The block still happened; nothing left the device on the failed attempt.
Making traffic go where it should
Every outbound flow is held, checked, then released or dropped. Nothing leaves the device while the check runs.
Source application
Is this process one you've authorised?
Destination
Does it belong to that vendor's ASN?
Transmission
Is the channel one your policy permits?
The third check isn't just port policy. A maintained list of ports tied to known attack tools — Metasploit's default reverse-shell port, Tor, RDP, SSH, the legacy remote-execution protocols still abused today — is blocked regardless of whether the app and destination both check out. A trusted app suddenly talking RDP, or reaching out on a Metasploit port, gets stopped. Trustlisted or not.
| App Name | Display Name | Vendor IPs | ASNs | Allowed Countries |
|---|---|---|---|---|
| 148.0.7730.0\updater.exe | Chrome Browser Update | ANY | ANY | |
| anthropicclaude\update.exe | Claude App Updater | ANY | ANTHROPIC, GOOGLE | ANY |
| apphostregistrationverifier.exe | MS Windows | ANY | MICROSOFT | GB, US |
One app, one or more approved ASNs — an application in no profile raises an "application unknown" event. Default deny.
Deploy without impact
Three stages. You decide when to move between them.
Discovery mode
Full pass-through. Nothing blocked. 10 days gives a real benchmark.
Approve the Trustlist
Discovery builds the candidate list from observed traffic. You approve it.
Turn it on
Per application, when ready. Reversible.
It also drops into your stack without reshaping anything else in it. No content classifier to tune, no rules engine to write before day one — there's nothing to classify, so there's no false-positive tuning period to sit through first.
A record of what happened, not a queue to work through
Every flow becomes an event the moment it's decided — blocked or allowed, timestamped, in real time. Nothing waits for a batch job or a scheduled scan.
That's a deliberate distinction from an alert queue. The engine is deterministic — no confidence scores, no probabilities, nothing to adjudicate at 2am. You tune the Trustlist once, then it runs. The work moves rather than disappears: approving a Trustlist takes an afternoon, and when a block is wrong you'll hear about it from a user, not from a dashboard. There's a great deal less of it than triage.
The interesting number is yours, not ours.
This figure is application flows, not malicious activity — layer attacker behaviour on top and the real number climbs.
Poisoning, cache poisoning, hijacking — validation never touches DNS, so a poisoned resolver changes nothing.
Destination redirect — app told to send data one place, goes another.
Data sent to unexpected or untrusted endpoints, disguised as normal application traffic.
Botnet beaconing, ransomware pre-encryption callback — unrecognised destination fires regardless of intent.
A trusted app or dependency phoning home to infrastructure its vendor doesn't own.
Data sent to unsanctioned AI tools, local models calling out, unauthorised AI plugin/agent egress.
Unsanctioned SaaS, personal cloud storage, endpoints nobody signed off.
Misconfigured integrations, legacy or orphaned connections nobody remembers exist.
BGP hijack — ASN ownership is announced via BGP, which can be hijacked. Certificate pinning is roadmapped as the mitigation.
VPN — traffic passes through uninspected while a VPN adapter is active. Enforcement is roadmapped.
Very short-lived connections can finish before the process is attributed. Blocked and labelled — not guessed at.
Our own agent's traffic isn't exempt from its own rules — it appears in your dashboard, labelled, same as everything else.
Ten devices. Ten days. Zero changes.
Submit a request. Download the software directly from our portal — code-signed, SHA-256 published, no email attachment, no waiting on a link.
Access is provisioned per request — usually same day.