Okie dokie

SNI isn’t going to do much for malware delivered over legit file share services like Dropbox or Google Drive, and it definitely won’t help prevent IP from being leaked out of an enterprise.

TLS decrypt isn’t perfect, there is a performance hit and troubleshooting can be a real nightmare too.

TLS intercept is required for any NGFW to inspect for traffic for malware, analyze potential threats against signatures, prevent the loss of intellectual property, or provide any other advanced security service.

This will have some significant use on firewall appliances that perform TLS decryption, requiring a MITM certificate to be deployed and rotated on a scheduled basis.

Any particular reason you’ve decided to stay with CML? I’m sure you’ve vetted the alternatives, curious to know if CML brings something unique to the table

This is such a rare experience

Most organization boundaries find the automation team working in an isolated pocket, or handled by an outside partner

They are fed work through a unidirectional communication pipeline, never contributing their creative problem solving skills outside of coding