and your firewall is default/deny. (I frequently forget to say this often but always configure for one at the start.) Corporate Bonus if you can scrub all TLS

and your firewall is default/deny. (I frequently forget to say this often but always configure for one at the start.) Corporate Bonus if you can scrub all TLS traffic at kernel level while running a transparent HTTPS/TLS proxy at the border gateway: that is, force all TLS through that proxy by payload detection mechanism and not just by port numbers.