You report that eighty-five percent of egress is inspected — what denominator makes that honest, and what can an adversary keep out of it?

## The number people quote, and why it is usually wrong "We inspect eighty-five percent of egress" is a sentence said in a lot of review meetings, and most of the time nobody can say what the denominator was. Three questions expose it immediately. **What is counted?** Bytes, flows, sessions, distinct destinations and distinct internal hosts give wildly different answers over the same week. Bytes are the flattering choice: a few large backups, software distribution and video streams dominate the total, so inspecting those puts your figure in the nineties while hundreds of small unread sessions disappear into the rounding. Flows and distinct destinations track control coverage far better, because the thing you care about — a channel established to somewhere you cannot name — is small by volume and singular by count. Report at least two denominators and say which one you are steering by. **Over what population?** The share is only meaningful against every path out of the estate. That includes remote users whose split tunnel sends most traffic straight out, cloud workloads egressing to the internet without traversing a corporate border, guest networks, operational-technology and building systems, laboratory segments, and circuits that came with an acquisition. If the figure covers only the sites with a device in them, it is a statement about those sites, and it should be labelled that way. **From what source?** This is the error that makes the number circular. If the denominator comes from the inspection stack's own logs, you are dividing what the device saw by what the device saw, and everything that avoided the device is invisible to both halves of the fraction. The denominator has to come from somewhere else: interface and routing counters at each egress, cloud egress accounting, circuit-level counters. That is harder, less tidy, and the only way the number means anything. ## Unread versus uncounted The distinction is the whole leaf. Traffic that reaches your inspection point and cannot be read — encrypted client hello, a pinned client, an exempted category — is *unread*: you know it exists, you can size it, you can put it in the denominator honestly. Traffic that crosses a path with no inspection point at all is *uncounted*: it does not appear in your fifteen percent, because it never appeared anywhere. An adversary who has looked at your network for an afternoon does not attack the readable share. They pick the uncounted path: the contractor laptop that never joins the tunnel, the workload with its own internet gateway, the camera network with a default route nobody remembers, the segment the acquisition brought with it. The control was not evaded; it was never in the path. So the useful question is not "what percentage do we inspect" but "which paths out exist, and which of them have a control on them" — an inventory question answered from routing, not from a dashboard. ## Two of everything A merged estate makes this concrete and is a favourite interview scenario. Two companies, two inspection stacks, two exemption lists built by two teams with different agreements behind them, two definitions of what counts as egress — and one combined figure requested for the group. Averaging the two percentages is arithmetic nonsense: the denominators are not the same quantity. The honest move is to publish one figure with one stated denominator recomputed across both estates, plus the two blind shares broken out by cause, and to say plainly which parts of the merged network have no measurement at all yet. A number produced by aggregation you cannot explain will be quoted back at you for years. ## Report a slope, not a point The readable share decays for reasons outside your control: client vendors ship encrypted client hello, applications move to transports your stack does not parse, more clients pin, resolution moves to encrypted channels so the name is not available from that side either. A single quarter's figure hides all of it. What is worth reporting is the trend, decomposed by cause — this much lost to exemptions we granted, this much to clients we cannot break, this much to paths with no control — because the decomposition tells you which losses you could reverse and which you cannot. That decomposition is also what tells you when a position stops being worth its cost. If the share you can read at the border is falling several points a quarter and the causes are all outside your control, then continuing to buy decryption capacity is buying a shrinking asset, and the argument for reading closer to the plaintext gets stronger every quarter. Say that with the numbers rather than as an opinion. ## What to avoid saying Do not present the inspected share as a security outcome. It measures where your control stands, not whether anything was caught, and a high figure with a category bypass covering the top ten destinations is worse than a lower figure with narrow named exemptions. Report coverage as coverage, and keep the claim in the direction the measurement supports.