EgressProof

EgressProof is a web app (with optional lightweight agent) that monitors and controls outbound data movement from cloud workloads. It focuses on the most common real-world breach path: attackers using valid credentials to quietly move data out via object storage downloads, database dumps, SaaS sync tools, or “legit” HTTPS traffic. The MVP connects to AWS CloudTrail/VPC Flow Logs (and later Azure/GCP equivalents) to build a baseline of normal egress by workload, destination, and volume. It then flags anomalies and can enforce guardrails like temporary egress throttling, destination allowlists, and automated incident tickets. It’s not a full SIEM replacement; it’s a narrow, opinionated control plane for outbound risk. Expect some false positives early—this product wins by being fast to deploy, easy to tune, and focused on high-signal egress events teams actually act on.