Abstract: Mobile management method, system and client. Method includes receiving a DNS query for a host name from an application on client; retrieving reputation data associated with host name from a local cache on client; and determining a policy based on host name and the reputation data. Based on determined policy for the host name, blocking attempted network flows to a host corresponding to host name to produce blocked attempted network flows. Method also includes sending attempted network flow metadata related to the blocked attempted network flows to a collector on client; transmitting the attempted network flow metadata from the collector to a VPN server pool via a VPN tunnel; and producing an anomaly report from the transmitted attempted network flow metadata. The anomaly report includes at least one of anomalies, cohorts, trends, location boundaries, detected network security issues, detected compromised clients and/or optimized network usage.