[natebc]

The Crowdstrike Falcon Sensor agent (with a kernel module) establishes TLS connections to several random AWS endpoints.

I really have no idea how security people think this is a good thing aside from checkbox compliance but man-o-man do they love it.

[neffy]

Well honestly, this security person thinks its a terrible idea - but needless to say the people selling those systems disagree - and for non-technical management, it ticks the compliance box and they get back to their jobs.