Hi there, let's start from full disclosure - I'm a co-founder of Forelens. Having said that, let's move to "why we feel like a generic firewall, but we're not"

Hi there, let's start from full disclosure - I'm a co-founder of Forelens. Having said that, let's move to "why we feel like a generic firewall, but we're not" :). Firewalls, as you mentioned, do exactly this - they monitor what is happening, but the problem begins when they have to make the decision if what they see is OK, or not OK. The strongest possible set of rules for firewall is the "allowlist", where you block by default everything that is not known. But then you need to maintain those rules (you need people with expertise and time for it) and they don't come "out of the box" with firewalls (again - time, people, expertise). That's something we provide and maintain for our customers and because it's cloud based - "the more the merrier" - because applications used across companies have some overlap, so if we cover application X, it's covered for everyone, if we don't, then we get our hands dirty for you and new rules are up and running without you needing to do anything. Regarding bypasses you mention, yes they do exist and in case of browsers - for obvious reasons we don't maintain allowlist for those, unless someone would want to live in a locked down www world, then we can provide that as well. Browsers though, will be most likely only a stepping stone to get some sort of second stage, which then we'd detect. Regarding malicious usage of "other trusted apps", that's something we would see immediately, because we do know that process X should be talking to abcd.org, but now we see it talking to evil.com. We don't give special treatment to signed and trusted processes (as opposed to most security software out there), so if you have SolarWinds update agent signed with all the signatures and talking over a protocol that looks exactly like it should, we'd still see that it's going out to an unexpected destination. Give another read to the blog post you linked. I know it's a bit long, but we explain there why we can see things that firewalls, AVs, EDRs, or sandboxes can miss.