thanks for giving the security department more reasons to think that way.

I spent the last 6 months trying to convince them not to block all outbound traffic by default.

The right middle ground is running Little Snitch in alert mode. The initial phase of training the filters and manually approving requests is painful, but it's a lot better than an air gap.