Techniques for inspecting network traffic are disclosed. An application executing as an operating system extension that uses a virtual private network (VPN) stack of the operating system intercepts an Internet protocol (IP) packet for delivery to a remote computer system. A determination is made, by the application, that the intercepted IP packet indicates a security threat. The intercepted IP packet is prevented from being delivered to the remote computer system based on the determination.