Egress Control

Every computer in a company is connected to the internet. Data traffic flows in two directions: in and out. The word “egress” simply means “exit,” so it refers to everything that leaves one’s own network. Egress control is the collection of rules that specifically examines and restricts this outgoing traffic. The basic idea: a program may only communicate with servers that have been explicitly permitted beforehand. Everything else is blocked, even if no one suspects it could be dangerous.

Why the exit is often guarded less well than the entrance

Classic security technology focuses on the entrance. A firewall, essentially a digital bouncer for data traffic, is meant to keep attackers out. That makes sense, but it falls short. Because an attacker who has once made it inside wants above all one thing: to carry data out. Without control of the exit, exactly this step goes unnoticed.

The actual damage from a hacking attack rarely occurs at the moment of the break-in. It occurs when customer data, passwords, or design plans end up on a foreign server. Experts call this data exfiltration. Good egress control makes this final step difficult or impossible. Even if the malware is already running, it finds no open path to the outside.

With AI systems, there is a second reason. Modern language models are being given tools that let them call up websites or send data themselves. Such a system can be tricked with hidden instructions embedded in a document. It might then obediently send confidential content to a foreign address without any human having ordered it. Egress control draws the final line here.

Allowlists, proxies, and a look into the data stream

Technically, egress control usually works with an allowlist. It contains the few addresses and ports that a system is permitted to contact. Ports are numbered channels through which various services communicate. Anything not on the list is discarded. This is the opposite of the previously common practice, in which almost everything was allowed outbound.

Often all traffic is additionally routed through a proxy. This is an intermediary server through which every connection must pass. It logs who is speaking to whom and can block individual destinations. In cloud environments, so-called security groups handle this — sets of rules that are assigned individually to each virtual server.

A well-known problem is encrypted traffic. Because nearly every connection today is encrypted, the bouncer sees only the destination, not the content. Some companies therefore break the encryption in a controlled manner, which is legally and technically delicate. A second mistake is assuming that egress control is a one-time task. In reality, permitted destinations change constantly, and outdated rules eventually block normal operations.

From school Wi-Fi to the AI sandbox

In everyday life, you encounter this principle earlier than you’d think. When certain websites or games are unreachable on a school network, that is a form of egress control. The path outward is restricted, not the path inward. Company laptops, too, often deny access to private cloud storage so that no work files end up there.

In the news, the term usually appears after major data breaches. Investigation reports then note that attackers let data flow out unnoticed for weeks. Exactly this would have been caught by strict egress control. Cloud providers such as AWS or Microsoft Azure also explicitly advertise such features.

The topic is especially important right now with AI agents, i.e., programs that independently carry out tasks on the internet. They often run in a sandbox, an isolated test environment without free network access. Only a few destinations are permitted there. Anyone reading about secure AI systems will therefore almost inevitably come across egress control.