Determining on-net/off-net status of a client device

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a client device, causes the one or more processors to perform a method comprising:

• maintaining, by an endpoint security program running on the client device, an enterprise public Internet Protocol (IP) list containing one or more ranges of public Internet Protocol (IP) addresses associated with an enterprise network;
• sending, by the endpoint security program, a request to a cloud-based service for information regarding a public Internet Protocol (IP) address of the client device;
• responsive to the request, receiving, by the endpoint security program, from the cloud-based service a response containing the public IP address;
• and
• determining, by the endpoint security program, a connection status of the client device with respect to the enterprise network by comparing the public IP address to the enterprise public IP list.

The non-transitory computer-readable storage medium 10, wherein the method further comprises:

• maintaining, by the endpoint security program, a list of subnets and corresponding gateway media access control (MAC) addresses associated with the enterprise network;
• and
• when the connection status indicates the client device is not connected to the enterprise network, then:
• attempting to connect to a client manager device, based on one or more of a subnet to which the client device is connected and a default gateway IP address configured for the client device;
• and
• when said attempting is successful, then setting the connection status to a value indicating the client device is connected to the enterprise network.