Outbound egress control is a security measure that restricts which remote hosts, ports, or protocols a system is allowed to contact. Instead of letting every process reach the internet freely, the network or host policy only permits approved destinations. This is a core defense in environments that handle sensitive code, data, or credentials.
It matters because many attacks rely on a machine making an outbound connection on the attacker’s behalf. In software supply-chain incidents, a build server may try to download a malicious dependency, fetch a payload during compilation, or call back to a command-and-control server. Egress filtering can block those requests even if a poisoned package enters the build. Good egress control is usually paired with allowlists, proxy logging, DNS filtering, and separate build networks with no direct internet access. In practice, defenders use it to reduce blast radius, spot unusual build-time traffic, and prevent automation from silently reaching attacker-controlled infrastructure.