One request, inspected end to end.

The request path, step by step

1. 1

   ProblemThe browser is where work happens, so it is where attackers aim.

   The request starts

   A user signs in to a SaaS app, opens a link, uploads a file or pastes text into an AI assistant. Each action is an HTTP request that may carry data out or bring code in.

2. 2

   ProblemEndpoint agents add deployment effort, compatibility issues and support load.

   The way in

   The request leaves the device with no VxSure agent installed.

   • Remote users: through the organisation's existing VPN.
   • Offices: through tunnels from existing firewalls and routers.
   • Identity: the user authenticates with the organisation's current identity provider, so every decision is tied to a named user.
3. 3

   ProblemReplacing the firewall to add web inspection is a project nobody approves.

   Arrival

   The request reaches the VxSure appliance, deployed beside the firewall on the partner's public cloud, private cloud, KVM platform or data centre. The firewall keeps its network-layer role; VxSure adds the application layer.

4. 4

   ProblemDNS is used to exfiltrate data and to bypass filtering.

   The name lookup

   • DNS lookups are filtered against policy.
   • DNS tunnelling, data hidden inside lookups, is detected and blocked.
   • Encrypted DNS is kept under the organisation's policy, so it cannot route around filtering.
5. 5

   ProblemMost web traffic is HTTPS, and a control that cannot decrypt it inspects nothing.

   Opening the encrypted session

   VxSure terminates TLS using the organisation's own certificate authority, inspects the content, and re-encrypts toward the destination. The organisation holds the trust anchor.

   Organisations are responsible for lawful authorisation and employee notice for TLS inspection in their jurisdiction.

6. 6

   ProblemChained tools inspect separately, add delay, and leave gaps when one rule is bypassed.

   One pass

   All checks evaluate together in a single pass:

   Input	What is evaluated
   Session behaviour	What the activity does across the session, not one request in isolation
   Device posture	Device context as a policy condition
   Files	Inline inspection as files stream, with no separate sandbox wait
   Data	Detection of PII, financial and health records in text, files, archives and images with OCR (Power and Advanced)
   AI and SaaS	App identification and company versus personal account separation (Power and Advanced)
   Acceptable-use policy	The organisation's own rules, enforced at the proxy so users cannot quietly bypass them

   Because the evaluation is single-pass, skipping one rule does not switch the others off.

   Policy ruleIllustration

   IFdestination = AI assistant

   ANDaccount = personal

   ANDupload contains PII

   THENBlockLog

7. 7

   ProblemAllow or block is too coarse; it either stops work or accepts risk.

   The decision

   Outcome	When it applies
   Allow	The session meets policy
   Strip	Risky active content is removed from the page; files are not rebuilt
   Isolate	The page renders in a remote browser on partner infrastructure; active code never reaches the device (Power and Advanced)
   Block	Policy forbids the action, such as a sensitive-data upload to an unapproved destination

   Connections from malware attempting to reach its operator (command and control) are cut off.

   DecisionsIllustration

   09:41:02GETdocs.saas-app.exampleAllow

   09:41:09GETnew-domain.exampleIsolateUncategorised site

   09:41:12GETnews-portal.exampleStripRisky active content removed

   09:41:15POSTfiles.share.exampleBlockSensitive data to unapproved destination

8. 8

   ProblemA page that passed inspection can still run code the organisation did not expect.

   The way back

   The response returns with a page security header that limits which scripts may run and which connections the page may make. This limits what an unknown attack can do in the browser.

9. 9

   ProblemWithout evidence, incidents cannot be investigated and audits cannot be passed.

   The record

   • Every decision is logged: user, request, rule applied, outcome.
   • Policy changes are versioned, with author and time.
   • Logs stay on the partner's infrastructure, in the region the customer requires.
   • Structured logs are forwarded to SIEM, ticketing and automation tools.

   This evidence helps organisations meet their obligations under India's DPDP Act, GDPR and HIPAA.

   Decision log · JSONIllustration

   { "user": "a.rao", "rule": "pii-to-ai-personal",
     "action": "block", "detector": "PII",
     "policy_version": 14, "time": "09:41:05" }

Compare editions