There's plenty of this stuff at the US government level for data exfiltration and the fact that ordinary websites can have XSS or other funny business going on.

There's plenty of this stuff at the US government level for data exfiltration and the fact that ordinary websites can have XSS or other funny business going on. For instance there's EINSTEIN https://www.dhs.gov/einstein https://www.dhs.gov/einstein. There's also the opposite of what the initial boon of DPI gave you for egress traffic and instead doing DPI on ingress traffic in places in front of critical applications using things like SSL bump and so on. This seems worse but better in a way, where the DPI is part of the secure system instead of doing a carte blanche decrypting streams (the traffic that the internal secure system receives is in fact the traffic that it is party to instead of just wile e coyote to the universe). It's very hard to detect targeted attack to third party enterprise webapps otherwise.