A method implemented in a network security system, the method comprising: providing data communication from processing nodes to external systems (200, 220, 230), wherein the processing nodes are external to network edges of the external systems (200, 220, 230) and external from associated users of the external systems (200, 220, 230), and in each processing node: receiving and storing security policy data for each of the external systems (200, 220, 230) and threat data from an authority node; monitoring content items requested by or sent from the external systems (200, 220, 230); threat detecting the content items to classify the content items according to threat classifications based on the threat data and based on a layered threat detection architecture, wherein the threat detecting utilizes a plurality of data inspection engines 116 including any of a virus scanner engine, a uniform resource locator, URL, filter, a data leakage prevention, DLP, engine, and a content categorization engine, and wherein the threat classifications comprise one of clean and violating from each of the plurality of data inspection engines 116; and enforcing an associated security policy for the associated external systems (200, 220, 230) in accordance with the security policy data and the threat classifications of the content items; and anonymizing and obfuscating log data to provide an overall system summary of security processing for all the external systems (200, 220, 230) and users without revealing the identity of any one account, wherein the log data relates to security operations and network traffic processed by the processing nodes for each external system and is stored in one or more logging nodes external to the external systems (200, 220, 230), wherein the log data is encrypted and accessible through the one or more logging nodes, wherein the log data is only accessible for accounts related to the associated external systems (200, 220, 230). receiving and storing security policy data for each of the external systems (200, 220, 230) and threat data from an authority node; monitoring content items requested by or sent from the external systems (200, 220, 230); threat detecting the content items to classify the content items according to threat classifications based on the threat data and based on a layered threat detection architecture, wherein the threat detecting utilizes a plurality of data inspection engines 116 including any of a virus scanner engine, a uniform resource locator, URL, filter, a data leakage prevention, DLP, engine, and a content categorization engine, and wherein the threat classifications comprise one of clean and violating from each of the plurality of data inspection engines 116; and enforcing an associated security policy for the associated external systems (200, 220, 230) in accordance with the security policy data and the threat classifications of the content items; and anonymizing and obfuscating log data to provide an overall system summary of security processing for all the external systems (200, 220, 230) and users without revealing the identity of any one account, wherein the log data relates to security operations and network traffic processed by the processing nodes for each external system and is stored in one or more logging nodes external to the external systems (200, 220, 230), wherein the log data is encrypted and accessible through the one or more logging nodes, wherein the log data is only accessible for accounts related to the associated external systems (200, 220, 230).