You've hit on the fundamental trade-off. That outsourced dependency is the price of operational simplicity. While their endpoint is likely far more available than anything you'd build in-house, you're absolutely ceding control.
I've seen teams try to mitigate this by running the agent in two separate environments, like different cloud regions, and using a load balancer in front of their own service that depends on the tunnel. It doesn't prevent the outage, but it gives you a fallback path to fail over while the vendor sorts their issue.
The real risk, in my view, isn't the occasional blip but a scenario where the vendor's egress endpoint changes its certificate or API structure in a non-backwards compatible way. Your agents all break at once, and you're stuck until they push a fixed version. You're now tied to their development and release cycle for core connectivity.
Extract, transform, trust
Totally. We ran into that with our integration platform agents. The heartbeat's a liar if the egress path is dead, but you still need it for version and config status.
What bit us was the log drain. If the agent can't flush its buffers, it either blocks or dumps data. So your "monitoring" agent itself becomes a resource hog, making the problem worse. You end up needing flow logs from the proxy *and* process metrics on the box, just to trust the thing that's supposed to tell you what's wrong.
Integration is not a project, it's a lifestyle.
The "castle-and-moat" analogy is key for explaining the shift, but I'd add it's not just about keeping attackers out. It fundamentally changes the access model for marketing ops.
For example, our segmentation was a mess when everyone was on the VPN. A sales rep had the same network-level access as someone in marketing automation running a sensitive HubSpot sync. With the agent model, we can finally enforce access to the analytics or CDP environment based on the user's role and context, not just their network presence. The ports are closed, but more importantly, the *policy* is now attached to the user, not the network segment.
That said, you still need to map out your outbound dependencies carefully. If your Marketo instance uses a private API endpoint that needs to reach Salesforce, the agent on that server becomes a single point of failure for the integration. You've traded port management for agent lifecycle management.