Threatmatic · Mohan's Vision
The companion question to The Front Door: once a device is allowed to talk to something, what happens to its traffic on the way out? Same mesh, same nodes, opposite direction — zone policy, NetQoS, and π Inspection answer it, with QSChannel and Cloudiffusion carrying it everywhere the ingress page already covered.
what a device's own traffic goes through before it's allowed to leave — checked once, not felt at all if it's legitimate
Same rhythm as ingress — three different questions, none of them each other's job.
"Are you even allowed where you're going?"— WireGuard-level reachability plus the ZTNA policy engine. A device only ever sees the destinations its zone permits — the rest doesn't exist to it, not just "is blocked."
"Are you taking more than your share?"— per-flow rate shaping at the source, before traffic ever reaches a firewall. Enforces at the device itself, same "kernel-level, sub-200ms" model as SynGuard and EdgeGuard.
"What's actually in the bag?" — decrypt, classify, re-encrypt, today running endpoint-local on the device. The exact same engine EdgePi relocates to the edge for ingress — same classifier, different place to stand.
"Does this apply to cloud workloads too?"— app-level bandwidth governance against runaway cloud costs is already part of what Cloudiffusion ships — NetQoS's own egress-shaping idea, already extended into the cloud.
Egress doesn't get a separate mesh. It's the same QSChannel tunnel, same nodes, traffic just flowing the other way.
the device only sees a path to what its zone actually allows — everything else is invisible, not merely refused
Egress is further along than ingress, honestly — most of this already runs in production.
| Layer | Today | The vision |
|---|---|---|
| Zone Policy | Real, running — WireGuard reachability + full ZTNA policy engine, live for every device. | Already matches the vision at this layer. |
| NetQoS | Real, kernel-level, sub-200ms, per-flow — enforcement-verified. | Already matches the vision; console-side policy wiring still catching up. |
| π Inspection | Real, endpoint-local, shipped classifier with 20+ categories. | Same engine relocated to the edge (EdgePi) for fleet-scale egress — design-stage. |
| Cloudiffusion | Shipped and marketed — bandwidth governance already extends into cloud VPCs. | Already real; the anchor both this page and the ingress one build toward matching. |
| QSChannel | Real, mature, production — same mesh as the ingress page, no separate egress network. | Multi-region routing — same open item noted on the ingress page. |