1. A host computer comprising: a set of processing units for executing instructions; a non-transitory machine readable medium storing: a plurality of data compute nodes (DCNs) with a plurality of guest introspectors installed on the plurality of DCNs for capturing data regarding network access attempts on the DCNs; at least one service compute node (SCN) (i) to receive captured data regarding network access attempts from a set of guest introspectors on the host computer, (ii) to reject a network access attempt when a network access policy stored on the host computer requires rejection of the network access, and (iii) to allow a network access when no network access policy stored on the host computer requires rejection of the network access, at least one of said guest introspectors to send to the SCN network-access data from a DCN before the data is encrypted by an encryption module of the DCN, and to send the network-access data to the encryption module only when the SCN allows the network-access data.