In the infosec space, I am seeing rumblings of moving to compliant devices where the network tap is at the OS level and/or application level using software agen

In the infosec space, I am seeing rumblings of moving to compliant devices where the network tap is at the OS level and/or application level using software agents, AV hooks, or fake virtual network devices.