CoreDefence - SSL Inspection

As of 2025, more than 95% of internet traffic is encrypted with TLS/SSL. While that encryption protects user privacy, it also gives attackers a place to hide: 85% of malware now uses encrypted channels to slip past traditional security controls. CoreDefence SSL Inspection eliminates this blind spot by providing full visibility into encrypted traffic.

Our platform decrypts network traffic securely using a man-in-the-middle (MitM) proxy and re-encrypts it after content analysis. It fully supports modern TLS 1.3 features such as encrypted Client Hello (ECH) and 0-RTT resumption. It also decrypts traffic flowing over HTTP/3 (QUIC), detecting threats inside UDP-based encrypted communication.

Our malware detection layer runs multi-engine analysis on decrypted traffic: signature-based detection, heuristic analysis, sandbox integration and AI-powered behavioural analysis. Threat intelligence correlation covers known malicious domains, IP addresses and certificate fingerprints. Compromised systems communicating with C2 servers, encrypted DNS (DoH/DoT) tunnelling attempts and data exfiltration channels are all identified.

Data Loss Prevention (DLP) integration detects sensitive data flowing inside encrypted traffic — credit card numbers, national ID numbers, health records, confidential corporate information — and blocks it or raises an alert according to your policies. Regex, keyword matching and machine-learning-based data classification are all supported.

For privacy and compliance, we offer selective decryption policies that meet KVKK and GDPR requirements in full. Healthcare sites, banking applications and other privacy-sensitive categories can be exempted automatically. Exemption rules can be defined per category, per user and per application, and every decryption operation is written to an audit log.

Our certificate security module continuously monitors the TLS certificates across your network: certificates approaching expiry, weak key lengths (RSA < 2048, ECC < 256), untrusted root authorities, Certificate Transparency log mismatches and certificate pinning violations are all detected. MitM attempts using forged or self-signed certificates are blocked automatically.