TLS 1.3 with cert pinning and end-to-end encryption is making life hell for corporate compliance. Our Palo Alto firewalls are about as good as it gets but it's a constant battle to de-obfuscate traffic.

Google loves to mix traffic types (ad, telemetry, biz app) across protocols basically creating their own overlay which is a huge pain.

For Apple, we basically have to exempt the entire 17.0.0.0/8 as that is theirs and they pin everything.

Microsoft at least has several dynamic lists but I have my own list of their stuff that ISN'T on their lists (a few hundred IPs).

At this point I don't think there's any way to secure a network. You can't trust or verify much of the traffic.

Maybe using a synthetic NIC at the endpoint that is directly tied to the policy system is the only way forward.