A method for auditing a message in a message stream, comprising: a) capturing messages in a message stream traversing a security boundary that divides the message stream into an encrypted side and a plaintext side, a copy of each message being captured on the encrypted side and on the plaintext side, the messages captured on the encrypted side being encrypted and the messages captured on the plaintext side having a plaintext format, the captured messages including at least one message in an extensible markup language format; b) from the captured messages that include a message in an XML format, extracting the XML formatted message from both the copy of the message captured from the encrypted side and the copy of the message captured from the plaintext side to obtain two versions of the extracted XML formatted message, the two versions including an encrypted version of the XML formatted message obtained from the copy of the message captured from the encrypted side and a plaintext version of the XML formatted message obtained from the copy of the message captured from the plaintext side; c) applying a timestamp to each version of the extracted XML formatted message; d) storing the timestamped versions of the extracted XML formatted messages in two data stores, the timestamped encrypted version of the XML formatted message being stored in a first of the two data stores and the timestamped plaintext version of the XML formatted message being stored in a second of the two data stores; and e) correlating the timestamped encrypted version of the XML formatted message to the timestamped plaintext version of the XML formatted message to detect changes between the two versions of the XML formatted message, a detected change between the versions of the XML formatted message indicating that one of the versions of the XML formatted message has been tampered; wherein the encrypted version of the XML formatted message is captured, extracted, timestamped and stored on the encrypted side of the security boundary while the plaintext version of XML formatted message is captured, extracted, timestamped and stored on the plaintext side of the security boundary. a) capturing messages in a message stream traversing a security boundary that divides the message stream into an encrypted side and a plaintext side, a copy of each message being captured on the encrypted side and on the plaintext side, the messages captured on the encrypted side being encrypted and the messages captured on the plaintext side having a plaintext format, the captured messages including at least one message in an extensible markup language format; b) from the captured messages that include a message in an XML format, extracting the XML formatted message from both the copy of the message captured from the encrypted side and the copy of the message captured from the plaintext side to obtain two versions of the extracted XML formatted message, the two versions including an encrypted version of the XML formatted message obtained from the copy of the message captured from the encrypted side and a plaintext version of the XML formatted message obtained from the copy of the message captured from the plaintext side; c) applying a timestamp to each version of the extracted XML formatted message; d) storing the timestamped versions of the extracted XML formatted messages in two data stores, the timestamped encrypted version of the XML formatted message being stored in a first of the two data stores and the timestamped plaintext version of the XML formatted message being stored in a second of the two data stores; and e) correlating the timestamped encrypted version of the XML formatted message to the timestamped plaintext version of the XML formatted message to detect changes between the two versions of the XML formatted message, a detected change between the versions of the XML formatted message indicating that one of the versions of the XML formatted message has been tampered;