Breach is inevitable.Damage isn’t.

Regulators are starting to ask for evidence of where your data is going. DataShield gives you visibility and control of where your application data goes, and whose servers it lands on.

Request your assessment See how it works

10 devices · 10 days · your environment · real evidence, not demo data

The threat isn’t always the hacker

You approved the application.You didn’t approve where it sends your data.

Applications don’t send data just to their vendors. They route through CDNs, resolve to shared infrastructure, and hand off to services you’ve never heard of.

It’s all legitimate — it’s how the internet works. But it’s invisible, and it isn’t in your control.

In one day: Radeon software sending to Akamai, not AMD. Windows update traffic terminating in Ireland. Office traffic to France, Japan and India. Trusted applications, different jurisdictions, none of them chosen by you.

NOTIFICATIONTIMEAPPLICATIONASNDESTINATIONCTRY

DESTINATION11:45:31CNext\radeonsoftware.exeAkamai Technologies, Inc.23.215.233.47:443GB

SENT11:56:05System32\svchost.exe (wuauserv)Microsoft Corporation72.145.35.144:443IE

SENT11:42:42Office16\winword.exeMicrosoft Corporation20.74.67.0:443FR

SENT11:49:59OneDrive\onedrivelauncher.exeMicrosoft Corporation20.89.1.11:443JP

SENT11:55:56System32\taskhostw.exeMicrosoft Corporation4.247.188.224:443IN

One laptop. One day. Same vendors — four jurisdictions.

We find 25–45% of application flows aren’t sent directly to the vendor.

This isn’t a failure of your security stack. Akamai probably is trustworthy. So is Microsoft in India. But your tools can’t tell you which destinations are the vendor’s own. Is this a risk you’re happy to carry?

The gap

Your stack is doing its job.Application data just isn’t in it.

DLP

What data moved

Monitors email and web gateways.

Trusts the destination

EDR/XDR

Threats that move data

Detects malicious behaviour.

Trusts the application

ZORB

Where data can go

Controls and logs every destination in real time.

Trusts nothing

Neither was built to connect the application that opened the connection to the company that owns the destination. We complement the tools that inspect content and the ones that watch for threats coming in. We don’t replace them.

Why nothing else in your stack does this →

What DataShield does

Trusted application. Trusted destination.

DataShield sits on the endpoint and watches outbound flows, correlating each application process to its true destination.

The application asks DNS where it should go. DataShield checks that DNS points it to a legitimate vendor-owned destination for that application, and confirms the channel itself isn’t malicious. That stops redirection attacks, resolver poisoning and covert exfiltration.

Fail any one of the checks, and the data never leaves the device.

Risk overview · last 24 hours

Critical

Untrusted

Trusted

Destination map

N AMERICAEUROPEASIA

Top blocked applications

svchost.exe (NetworkService)4

svchost.exe (netprofm)3

onedrive.exe2

slack.exe2

winword.exe2

svchost.exe (Schedule)1

Recent activity

NotificationApplicationASNCountry

SENTwinword.exeMicrosoft CorporationFR

DESTINATIONradeonsoftware.exeAkamai TechnologiesGB

SENTmsedgewebview2.exeMicrosoft CorporationUS

SENToutlook.exeMicrosoft CorporationFR

Every outbound flow, decided as it happens.

Radeon reaching Akamai may be entirely legitimate in your environment. The difference is that you’ve authorised that endpoint, rather than the internet choosing it for you.

Every outbound flow is recorded, whether it was allowed or stopped. We read the connection, never the contents. No payload inspection, no documents, no messages — by design.

Ten devices, ten days, your own environment. Request your assessment →

Control and visibility

Two questions. Four answers.

Regulators used to ask whether you had controls in place. Increasingly they ask you to prove what those controls actually did. DataShield gives you both: the control, and the evidence.

Control — stopping it

Application data theft prevention

Data that isn’t authorised to leave doesn’t leave. Not flagged for review, not logged for later — stopped before it leaves the endpoint, in real time, without human intervention.

NOTIFICATIONAPPLICATIONASN

BLOCKEDonedrivestandaloneupdater.exeGoogle LLC

DESTINATIONradeonsoftware.exeAkamai Technologies

SENToutlook.exeMicrosoft Corporation

Flows stopped at the endpoint — nothing left the device.

Application ops resilience

If something goes wrong, you can see in real time which applications are affected and which aren’t. That turns a shutdown decision into a scoped one, rather than pulling everything offline while you find out.

APP213

MALICIOUS

DESTINATION53153

SENT239135171121

UPDATES111

18:5403:5412:54

Unauthorised applications caught — everything else sent.

Visibility — proving it

Application data flow accuracy

Your ROPA says “Microsoft”. Your traffic says Microsoft in Ireland, France, Japan and India. Both are true. Only one is evidence.

NOTIFICATIONAPPLICATIONASNCOUNTRY

SENTsvchost.exe (wuauserv)Microsoft CorporationIE

SENTwinword.exeMicrosoft CorporationFR

SENTonedrivelauncher.exeMicrosoft CorporationJP

SENTtaskhostw.exeMicrosoft CorporationJP

Same vendor. Four jurisdictions. None of them in your register.

Application destination confidence

For every flow: which application, which company, which country, which network. Exportable, timestamped. Answered in hours, not weeks after a forensics audit.

N AMERICAEUROPEASIA

Per application, per destination — named, not inferred.

Who we are

We’re a Cambridge company, and we’re new.

ZORB was founded by Dr Mark Graham, who spent forty years in cyber security and completed a PhD in malware detection at Cambridge. DataShield came out of that research.

We came through NCSC For Startups, the UK government’s cyber accelerator.

We don’t have a wall of customer logos yet. What we have is a product that shows you your own data, on your own devices, in ten days — and you can keep the findings whether you buy or not.

Our research background, and who recognises us →

ZORB Security Ltd · Registered in England 10992329 · Built in Cambridge

Rollout

How to deploy

See it

Discovery mode

Install across key parts of your estate. Every flow, application and destination recorded. Nothing blocked. Run it long enough to get a real baseline of where your data goes.

Prove it

Build your Trustlists

Discovery builds the picture. You review it, by department or group, and approve what your applications are actually allowed to reach.

Enforce it

Active mode, when you’re ready

Per application, reversible, and optional. You can stay in Discovery and use the record as your compliance evidence.

See where your own applications are sending data

Ten devices. Ten days. Your environment. Real evidence, not demo data.

✓No infrastructure changes — the agent installs, your network stays as it is

✓Discovery mode — nothing is blocked during the assessment

✓Download via our portal: code-signed, SHA-256 published

✓A report at the end, plus an optional review of what it found

✓The findings are yours either way — no pressure to continue

Request your assessment

No cost, no obligation.

Devices

Days

Zero

Changes