chasersystems.com

What It Is

Chaser Systems’ core product is DiscrimiNAT Firewall, positioned as a cloud-native outbound firewall and an alternative to Cloud NAT/NAT Gateway, primarily for AWS and Google Cloud. It is not a traditional HTTP proxy; instead, it performs deep packet inspection and domain-level policy enforcement on outbound traffic, restricting cloud workloads to approved FQDNs and reducing risks such as RCE, SSRF, malicious software downloads, and data exfiltration.

Core Capabilities and Compliance

In terms of protection, the product covers FQDN egress filtering, TLS SNI spoofing detection, DNS spoofing validation, TLS 1.2/1.3 and SSH v2 protocol requirements, default-deny enforcement, and least-privilege controls. It emphasizes that it does not require TLS decryption, CA certificate installation, or HTTP_PROXY/HTTPS_PROXY configuration inside applications, which reduces the impact on privacy, certificate operations, and performance. On compliance, the materials mention PCI DSS v4.0 Requirement 1.3.2, NIST SP 800-53 AC-4/SC-7/SC-8, and SOC 2 readiness, but these appear to be controls the product can help support rather than certifications held by the product itself.

Deployment, Management, and Integrations

Deployment is cloud-native: it replaces NAT at the VPC egress point and works with AWS Security Groups, GCP Firewall Rules, route tables, and Auto-Scaling Groups. For management, it supports monitor/see-thru mode to first discover FQDNs before switching to enforcement; it also supports per-app dry runs and rollback to Cloud NAT within one minute. Logs are sent to CloudWatch or GCP Logs Explorer for auditing, forensics, and incident response, and can also be forwarded to a SIEM. Its IaC integration is strong, with support for Terraform, CDK, and CloudFormation, making it suitable for DevSecOps and platform engineering workflows.

Pricing, Pros, and Cons

No specific plans or pricing are disclosed. The company only emphasizes that there are no per-GB data processing or transfer fees, which may help reduce cloud egress costs. Key advantages include no application changes required, no TLS termination, native cloud platform integration, FQDN-level least-privilege access, and comprehensive compliance logging. Limitations include the fact that most information focuses on AWS/GCP, with no clear statement of full Azure support; it also does not perform payload-level TLS decryption, so it cannot replace content-level DLP or malicious file detection.

Who It’s For and Access from China

It is suitable for security and platform teams in finance, healthcare, insurance, manufacturing, retail, and technology companies that need cloud egress governance, compliance auditing, and DaaS/ZTNA scenarios. For smaller teams, adoption may involve a learning curve if they lack cloud networking and IaC expertise. Access from China, payment methods, and domestic availability are not specified in the materials, so it is recommended to test connectivity to the official website, documentation, and control plane in practice. Alternatives to consider include AWS Network Firewall, GCP NGFW, Squid Proxy, or firewall/NAT security capabilities from domestic Chinese cloud providers.