A computer-implemented method executed by one or more processors, the method comprising: receiving, by a network gateway from a first client device within a network, a first request addressed to a particular resource on a server outside the network; determining, by the network gateway that the first request should be redirected to a man-in-the-middle gateway within the network; redirecting, by the network gateway, the request to the man-in-the-middle gateway within the network responsive to determining that the first request should be redirected; establishing a first encrypted connection between the first client device and the man-in-the-middle gateway, and a second encrypted connection between the man-in-the-middle gateway and the server; retrieving, by the man-in-the-middle-gateway, the particular resource from the server; modifying the particular resource into a modified resource by changing pointers within the particular resource to point to a location in a domain associated with the man-in-the-middle gateway within the network; serving, by the man-in-the-middle-gateway to the first client device, the modified resource; receiving, by the network gateway from a second client device within the network, a second request addressed to the particular resource on the server; determining, by the network gateway that the second request should not be redirected to the man-in-the-middle gateway within the network; characterized by responsive to determining that the second request should not be redirected to the man-in-the-middle gateway, redirecting, by the network gateway the second request to a cloud proxy service outside of the network, the cloud proxy service configured to: establish a third encrypted connection between the second client device and the cloud proxy service, and a fourth encrypted connection between the cloud proxy service and the server; retrieve the particular resource from the server; modify the particular resource into a second modified resource by changing pointers within the particular resource; and serve the second modified resource to the second client device. receiving, by a network gateway from a first client device within a network, a first request addressed to a particular resource on a server outside the network; determining, by the network gateway that the first request should be redirected to a man-in-the-middle gateway within the network; redirecting, by the network gateway, the request to the man-in-the-middle gateway within the network responsive to determining that the first request should be redirected; establishing a first encrypted connection between the first client device and the man-in-the-middle gateway, and a second encrypted connection between the man-in-the-middle gateway and the server; retrieving, by the man-in-the-middle-gateway, the particular resource from the server; modifying the particular resource into a modified resource by changing pointers within the particular resource to point to a location in a domain associated with the man-in-the-middle gateway within the network; serving, by the man-in-the-middle-gateway to the first client device, the modified resource; receiving, by the network gateway from a second client device within the network, a second request addressed to the particular resource on the server; determining, by the network gateway that the second request should not be redirected to the man-in-the-middle gateway within the network; characterized by responsive to determining that the second request should not be redirected to the man-in-the-middle gateway, redirecting, by the network gateway the second request to a cloud proxy service outside of the network, the cloud proxy service configured to: establish a third encrypted connection between the second client device and the cloud proxy service, and a fourth encrypted connection between the cloud proxy service and the server; retrieve the particular resource from the server; modify the particular resource into a second modified resource by changing pointers within the particular resource; and serve the second modified resource to the second client device. establish a third encrypted connection between the second client device and the cloud proxy service, and a fourth encrypted connection between the cloud proxy service and the server; retrieve the particular resource from the server; modify the particular resource into a second modified resource by changing pointers within the particular resource; and serve the second modified resource to the second client device.