> How do you test and monitor outbound access against program that adapts itself to get around things?

Literally what the industry has been doing since public networking is a thing. Adapt yourself.