Three destinations are exempt from your VPN tunnel - how do you prove an implant is not using that uninspected path?

## The question contains a trap "Prove nothing is using the exempt path" asks for a negative from a place where you have deliberately removed every observer. No amount of analysis produces evidence a sensor never collected, and the first mark of a strong answer is naming that rather than producing a reassuring dashboard. The claims available to you are narrower than the question implies: - Available: *this path is unobserved by any corporate control*. - Available with caveats: *the endpoint agent recorded no matching process activity on the machines where it was healthy and reporting*. - Not available: *no exfiltration or command traffic used this path*. Confusing the second for the third is the failure this question exists to catch. ## Buying a vantage back, and what each option costs **Re-include and measure.** Withdraw the exemption for a sampled cohort, or for the whole fleet during a defined window, and let the traffic traverse the stack. This is the only option that produces evidence of the same class you lost. Its price is precisely the price the exemption was avoiding: concurrent sessions and egress at peak, plus a degraded experience for the cohort, plus somebody to own the change. Done as a window, it also only tells you about the window. **A metadata-only path.** Send the exempt destinations somewhere that records the five-tuple, volume and timing without the full inspection tier. It is cheaper than full re-inclusion and yields far less: it can show that bytes moved to a destination, never what they were. That is still a large improvement over nothing, because the shape of a transfer is often the first thing anyone notices. **The endpoint.** The agent records process and connection activity regardless of route, so it is the natural fallback - with three honest caveats. It runs on the machine you are assuming is compromised. Its coverage is a rollout and licensing fact, not a given, so "we saw nothing" is unqualified until you can say on how many devices the agent was actually healthy. And it answers about that host only. **The destination's own trail.** Where the exempt destination is a service you are a tenant of, its audit trail is real evidence about *your tenant*. Its blind spot is the important one here: an implant using an attacker-controlled account, or any other service answering inside the same shared address block, appears nowhere in your tenant's records. The exemption is keyed to addresses, and your tenant trail is keyed to your account. ## Ordering the response A workable sequence: state the bounded claim; check how many devices actually have healthy endpoint coverage, because that number caps every host-based statement you are about to make; pull the destination-side trail for what it does cover; then decide whether the residual uncertainty justifies re-including the destinations for a measured window. If it does, plan it as a capacity event with an owner and a rollback, not as a quiet experiment - re-tunnelling the heaviest destinations is exactly the load the head-end could not carry, which is why the exemption exists at all. ## The structural point Every answer above is more expensive than the exemption was, and that is the lesson worth carrying out of the question. An exemption is cheap when it is made and expensive every time anyone needs to say something about the traffic that uses it. Estates that grant exemptions without deciding, in advance, what evidence they will accept about that path end up in this exact position: a reasonable question, a control decision made two years earlier, and no way to answer without spending the money that was saved.