CSIS advises using an outbound proxy to stop agents from leaking data. Firewalls check only incoming traffic, so agents can bypass them by making outbound calls from your servers. Send all agent traffic through a proxy that blocks unauthorized destinations.