Mechanisms are provided for identifying transparent network communication interception appliances in a network topology. The mechanisms collect network configuration data from a plurality of devices in the network topology and analyze the collected network configuration data using one or more heuristics to identify patterns in the collected network configuration data indicative of the presence of a transparent network communication interception appliance. The mechanisms calculate a confidence measure value based on results of the analysis of the collected network configuration data. The mechanisms further send a notification of a detected presence of a transparent network communication interception appliance to a computing device in response to the calculated confidence measure value meeting or exceeding at least one threshold value.