Regulators are starting to ask for evidence of where your data is going. DataShield gives you visibility and control of where your application data goes, and whose servers it lands on.
Applications don’t send data just to their vendors. They route through CDNs, resolve to shared infrastructure, and hand off to services you’ve never heard of.
It’s all legitimate — it’s how the internet works. But it’s invisible, and it isn’t in your control.
In one day: Radeon software sending to Akamai, not AMD. Windows update traffic terminating in Ireland. Office traffic to France, Japan and India. Trusted applications, different jurisdictions, none of them chosen by you.
We find 25–45% of application flows aren’t sent directly to the vendor.
This isn’t a failure of your security stack. Akamai probably is trustworthy. So is Microsoft in India. But your tools can’t tell you which destinations are the vendor’s own. Is this a risk you’re happy to carry?
DLP
Monitors email and web gateways.
EDR/XDR
Detects malicious behaviour.
ZORB
Controls and logs every destination in real time.
Neither was built to connect the application that opened the connection to the company that owns the destination. We complement the tools that inspect content and the ones that watch for threats coming in. We don’t replace them.
DataShield sits on the endpoint and watches outbound flows, correlating each application process to its true destination.
The application asks DNS where it should go. DataShield checks that DNS points it to a legitimate vendor-owned destination for that application, and confirms the channel itself isn’t malicious. That stops redirection attacks, resolver poisoning and covert exfiltration.
Fail any one of the checks, and the data never leaves the device.
Radeon reaching Akamai may be entirely legitimate in your environment. The difference is that you’ve authorised that endpoint, rather than the internet choosing it for you.
Every outbound flow is recorded, whether it was allowed or stopped. We read the connection, never the contents. No payload inspection, no documents, no messages — by design.
Regulators used to ask whether you had controls in place. Increasingly they ask you to prove what those controls actually did. DataShield gives you both: the control, and the evidence.
Data that isn’t authorised to leave doesn’t leave. Not flagged for review, not logged for later — stopped before it leaves the endpoint, in real time, without human intervention.
If something goes wrong, you can see in real time which applications are affected and which aren’t. That turns a shutdown decision into a scoped one, rather than pulling everything offline while you find out.
Your ROPA says “Microsoft”. Your traffic says Microsoft in Ireland, France, Japan and India. Both are true. Only one is evidence.
For every flow: which application, which company, which country, which network. Exportable, timestamped. Answered in hours, not weeks after a forensics audit.
ZORB was founded by Dr Mark Graham, who spent forty years in cyber security and completed a PhD in malware detection at Cambridge. DataShield came out of that research.
We came through NCSC For Startups, the UK government’s cyber accelerator.
We don’t have a wall of customer logos yet. What we have is a product that shows you your own data, on your own devices, in ten days — and you can keep the findings whether you buy or not.
Our research background, and who recognises us →
ZORB Security Ltd · Registered in England 10992329 · Built in Cambridge
Install across key parts of your estate. Every flow, application and destination recorded. Nothing blocked. Run it long enough to get a real baseline of where your data goes.
Discovery builds the picture. You review it, by department or group, and approve what your applications are actually allowed to reach.
Per application, reversible, and optional. You can stay in Discovery and use the record as your compliance evidence.
Ten devices. Ten days. Your environment. Real evidence, not demo data.
No cost, no obligation.
We use cookies on this site. Strictly necessary cookies are always active. We'd also like to use analytics cookies to help us improve our website — these are only set with your consent. See zorbsecurity.com/cookie-policy for details.
