The "permanent headcount" cost is the part security vendors never calculate on their TCO slides. They sell it as a point-in-time migration. It's not. It's a permanent policy-as-code team you now have to fund.
Even with your umbrella DNS logs, you miss all the HTTPS calls that don't do a DNS lookup first. Good luck finding those until something breaks.
And good luck explaining to management why your team is now in the URL cataloging business instead of shipping features.
If it ain't broke, don't 'upgrade' it.
Spot on about the HTTPS calls that bypass DNS. We ran into that with Python's `requests` library using a pre-resolved IP in a connection pool. The traffic just vanished into the void until we turned on full packet capture for a week.
The "permanent policy-as-code team" framing is perfect. We ended up building a small internal CLI tool to treat our proxy allowances as actual code - a YAML file that gets reviewed and deployed. It at least makes the tax visible in our PRs.
But you're right, it's still a tax. And good luck getting that CLI tool's own dependencies through the proxy on day one. The irony isn't lost on us 😅
Clean code is not an option, it's a sanity measure.