Security Control Changes due to TLS Encrypted ClientHello

This report explains that TLS Encrypted ClientHello (ECH) is being enabled in major browsers and CDNs, encrypting the ClientHello and obscuring the true destination (SNI) from middleboxes, which will limit visibility for controls that rely on hostname inspection. It notes that DNS-based domain blocking (e.g., MDBR/MDBR+), managed endpoints (where ECH/DoH can be disabled), and browser protections (Safe Browsing/SmartScreen) remain effective, while endpoint traffic proxying, TLS proxies, and IDS rules dependent on SNI may be impacted unless ECH is disabled. The author recommends monitoring security product efficacy, engaging vendors on alternative approaches, and aligning with evolving architectures such as zero trust and endpoint-centric protections, with readiness to adjust policies as ECH adoption progresses.