A system for automatically adjusting the scope of network traffic that is subject to security inspection, comprising: a first network device that in operation provides request routing of client requests, said request routing including directing at least some client requests to a second network device for inspection, said request routing according to a first configuration, and that in operation produces first logs of the request routing performed by the first network device; a second network device that in operation receives client requests routed by the first device to the second network device for inspection, and inspects for network security threats at least one of: (i) the received client requests and (ii) responses to the client requests generated by a remote host, said inspection being performed according to a second configuration at the second network device; the second network device in operation producing second logs of the results of the inspections; a feedback analysis system that in operation receives the first logs and the second logs, and based on processing thereof produces at least one adjustment to at least one of the first configuration and the second configuration, said at least one adjustment comprising at least one of: a) an indication of network traffic that should be blocked at the first network device, where said network traffic was previously routed to the second network device for inspection, b) an indication of network traffic to whitelist at the first network device, where said network traffic was previously routed to the second network device for inspection, and, c) an indication of network traffic that the first network device should route to the second network device for inspection; the first network device, the second network device, and the feedback analysis system comprising one or more or hardware processors and memory storing computer program instructions to operate the first network device, the second network device, and the feedback analysis system as specified above. a first network device that in operation provides request routing of client requests, said request routing including directing at least some client requests to a second network device for inspection, said request routing according to a first configuration, and that in operation produces first logs of the request routing performed by the first network device; a second network device that in operation receives client requests routed by the first device to the second network device for inspection, and inspects for network security threats at least one of: (i) the received client requests and (ii) responses to the client requests generated by a remote host, said inspection being performed according to a second configuration at the second network device; the second network device in operation producing second logs of the results of the inspections; a feedback analysis system that in operation receives the first logs and the second logs, and based on processing thereof produces at least one adjustment to at least one of the first configuration and the second configuration, said at least one adjustment comprising at least one of: a) an indication of network traffic that should be blocked at the first network device, where said network traffic was previously routed to the second network device for inspection, b) an indication of network traffic to whitelist at the first network device, where said network traffic was previously routed to the second network device for inspection, and, c) an indication of network traffic that the first network device should route to the second network device for inspection; a) an indication of network traffic that should be blocked at the first network device, where said network traffic was previously routed to the second network device for inspection, b) an indication of network traffic to whitelist at the first network device, where said network traffic was previously routed to the second network device for inspection, and, c) an indication of network traffic that the first network device should route to the second network device for inspection; the first network device, the second network device, and the feedback analysis system comprising one or more or hardware processors and memory storing computer program instructions to operate the first network device, the second network device, and the feedback analysis system as specified above.