diff --git a/api/db/changelog/db.changelog-246-add-vwb-egress-event-columns.xml b/api/db/changelog/db.changelog-246-add-vwb-egress-event-columns.xml
new file mode 100644
index 00000000000..d1e9ab5ebd8
--- /dev/null
+++ b/api/db/changelog/db.changelog-246-add-vwb-egress-event-columns.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<databaseChangeLog
+        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+                      http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.1.xsd">
+    <changeSet author="yonghao" id="db.changelog-246-add-is-vwb-egress-event-column">
+        <addColumn tableName="egress_event">
+            <column name="vwb_workspace_id" type="varchar(80)" />
+            <column name="vwb_vm_name" type="varchar(80)" />
+            <column name="gcp_project_id" type="varchar(80)" />
+            <column name="vwb_incident_count" type="bigint" />
+            <column name="vwb_egress_event_id" type="varchar(80)" />
+        </addColumn>
+    </changeSet>
+</databaseChangeLog>
diff --git a/api/db/changelog/db.changelog-master.xml b/api/db/changelog/db.changelog-master.xml
index e5ea740e533..c7fcec7161f 100644
--- a/api/db/changelog/db.changelog-master.xml
+++ b/api/db/changelog/db.changelog-master.xml
@@ -253,6 +253,7 @@
   <include file="changelog/db.changelog-243-replace-extension-count.xml"/>
   <include file="changelog/db.changelog-244-add-is-vwb-workspace-column.xml"/>
   <include file="changelog/db.changelog-245-add-vwb-template-id-cdr-version.xml"/>
+  <include file="changelog/db.changelog-246-add-vwb-egress-event-columns.xml"/>
   <!--
    Note: to update the DB locally, do the following:
    - Migrate schema changes: `./project.rb run-local-all-migrations`
diff --git a/api/src/main/java/org/pmiops/workbench/actionaudit/auditors/EgressEventAuditor.java b/api/src/main/java/org/pmiops/workbench/actionaudit/auditors/EgressEventAuditor.java
index 798a645d223..fbc3b5dee21 100644
--- a/api/src/main/java/org/pmiops/workbench/actionaudit/auditors/EgressEventAuditor.java
+++ b/api/src/main/java/org/pmiops/workbench/actionaudit/auditors/EgressEventAuditor.java
@@ -5,6 +5,7 @@
 import org.pmiops.workbench.db.model.DbUser;
 import org.pmiops.workbench.model.SumologicEgressEvent;
 import org.pmiops.workbench.model.SumologicEgressEventRequest;
+import org.pmiops.workbench.model.VwbEgressEventRequest;
 
 /**
  * Auditor service which handles collecting audit logs for high-egress events. These events are
@@ -18,6 +19,12 @@ public interface EgressEventAuditor {
    */
   void fireEgressEvent(SumologicEgressEvent event);
 
+  /**
+   * Decorates a Verily Workbench high-egress event with Workbench metadata and fires an audit event
+   * log in the target workspace.
+   */
+  void fireVwbEgressEvent(VwbEgressEventRequest event, DbUser dbUser);
+
   /**
    * Decorates a Sumologic-reported high-egress event with Workbench metadata and fires an audit
    * event log in the target workspace for the specified user.
diff --git a/api/src/main/java/org/pmiops/workbench/actionaudit/auditors/EgressEventAuditorImpl.java b/api/src/main/java/org/pmiops/workbench/actionaudit/auditors/EgressEventAuditorImpl.java
index ee45dfd93ee..47adf531b69 100644
--- a/api/src/main/java/org/pmiops/workbench/actionaudit/auditors/EgressEventAuditorImpl.java
+++ b/api/src/main/java/org/pmiops/workbench/actionaudit/auditors/EgressEventAuditorImpl.java
@@ -29,6 +29,7 @@
 import org.pmiops.workbench.model.SumologicEgressEvent;
 import org.pmiops.workbench.model.SumologicEgressEventRequest;
 import org.pmiops.workbench.model.UserRole;
+import org.pmiops.workbench.model.VwbEgressEventRequest;
 import org.pmiops.workbench.workspaces.WorkspaceService;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
@@ -109,6 +110,35 @@ public void fireEgressEvent(SumologicEgressEvent event) {
     fireEvent(agentId, agentEmail, dbWorkspace, event);
   }
 
+  @Override
+  public void fireVwbEgressEvent(VwbEgressEventRequest event, DbUser user) {
+    String actionId = actionIdProvider.get();
+    Builder baseEventBuilder =
+        ActionAuditEvent.builder()
+            .timestamp(clock.millis())
+            .actionId(actionId)
+            .actionType(ActionType.DETECT_HIGH_EGRESS_EVENT)
+            .agentType(AgentType.USER)
+            .agentIdMaybe(user.getUserId())
+            .agentEmailMaybe(user.getUsername())
+            .targetType(TargetType.WORKSPACE);
+    var events = new ArrayList<ActionAuditEvent>();
+    // File 3 events: Workspace, VM, GCP projects. Can add more if needed in the future
+    events.add(
+        baseEventBuilder
+            .targetPropertyMaybe("vwbWorkspaceId")
+            .newValueMaybe(event.getVwbWorkspaceId())
+            .build());
+    events.add(
+        baseEventBuilder
+            .targetPropertyMaybe("gcpProjectId")
+            .newValueMaybe(event.getGcpProjectId())
+            .build());
+    events.add(
+        baseEventBuilder.targetPropertyMaybe("vmName").newValueMaybe(event.getVmName()).build());
+    actionAuditService.send(events);
+  }
+
   @Override
   public void fireEgressEventForUser(SumologicEgressEvent event, DbUser user) {
     DbWorkspace dbWorkspace = getDbWorkspace(event);
diff --git a/api/src/main/java/org/pmiops/workbench/api/CloudTaskEgressController.java b/api/src/main/java/org/pmiops/workbench/api/CloudTaskEgressController.java
index 844b193e5d9..a209e28e05d 100644
--- a/api/src/main/java/org/pmiops/workbench/api/CloudTaskEgressController.java
+++ b/api/src/main/java/org/pmiops/workbench/api/CloudTaskEgressController.java
@@ -1,10 +1,10 @@
 package org.pmiops.workbench.api;
 
 import static org.pmiops.workbench.exfiltration.ExfiltrationUtils.EGRESS_SUMOLOGIC_SERVICE_QUALIFIER;
+import static org.pmiops.workbench.exfiltration.ExfiltrationUtils.EGRESS_VWB_SERVICE_QUALIFIER;
 
 import org.pmiops.workbench.exfiltration.EgressRemediationService;
 import org.pmiops.workbench.model.ProcessEgressEventRequest;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.RestController;
@@ -12,13 +12,25 @@
 @RestController
 public class CloudTaskEgressController implements CloudTaskEgressApiDelegate {
 
-  @Autowired
-  @Qualifier(EGRESS_SUMOLOGIC_SERVICE_QUALIFIER)
-  private EgressRemediationService egressRemediationService;
+  private final EgressRemediationService sumologicEgressRemediationService;
+  private final EgressRemediationService vwbEgressRemediationService;
+
+  public CloudTaskEgressController(
+      @Qualifier(EGRESS_SUMOLOGIC_SERVICE_QUALIFIER)
+          EgressRemediationService sumologicEgressRemediationService,
+      @Qualifier(EGRESS_VWB_SERVICE_QUALIFIER)
+          EgressRemediationService vwbEgressRemediationService) {
+    this.sumologicEgressRemediationService = sumologicEgressRemediationService;
+    this.vwbEgressRemediationService = vwbEgressRemediationService;
+  }
 
   @Override
   public ResponseEntity<Void> processEgressEvent(ProcessEgressEventRequest request) {
-    egressRemediationService.remediateEgressEvent(request.getEventId());
+    if (request.isIsVwbEgressEvent()) {
+      vwbEgressRemediationService.remediateEgressEvent(request.getEventId());
+    } else {
+      sumologicEgressRemediationService.remediateEgressEvent(request.getEventId());
+    }
     return ResponseEntity.ok().build();
   }
 }
diff --git a/api/src/main/java/org/pmiops/workbench/api/OfflineEgressController.java b/api/src/main/java/org/pmiops/workbench/api/OfflineEgressController.java
index a1bcc845f1d..08f7caa6448 100644
--- a/api/src/main/java/org/pmiops/workbench/api/OfflineEgressController.java
+++ b/api/src/main/java/org/pmiops/workbench/api/OfflineEgressController.java
@@ -5,11 +5,11 @@
 import java.time.Duration;
 import java.util.List;
 import java.util.logging.Logger;
-import java.util.stream.Collectors;
 import org.pmiops.workbench.cloudtasks.TaskQueueService;
 import org.pmiops.workbench.db.dao.EgressEventDao;
 import org.pmiops.workbench.db.model.DbEgressEvent;
 import org.pmiops.workbench.db.model.DbEgressEvent.DbEgressEventStatus;
+import org.pmiops.workbench.exfiltration.ExfiltrationUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.RestController;
@@ -27,20 +27,17 @@ public class OfflineEgressController implements OfflineEgressApiDelegate {
   public ResponseEntity<Void> checkPendingEgressEvents() {
     Timestamp latestModifiedTime = Timestamp.from(clock.instant().minus(PENDING_EVENT_LIMIT));
 
-    List<Long> oldPendingEventIds =
-        egressEventDao
-            .findAllByStatusAndLastModifiedTimeLessThan(
-                DbEgressEventStatus.PENDING, latestModifiedTime)
-            .stream()
-            .map(DbEgressEvent::getEgressEventId)
-            .collect(Collectors.toList());
-    for (long eventId : oldPendingEventIds) {
-      taskQueueService.pushEgressEventTask(eventId);
+    List<DbEgressEvent> oldPendingEvents =
+        egressEventDao.findAllByStatusAndLastModifiedTimeLessThan(
+            DbEgressEventStatus.PENDING, latestModifiedTime);
+    for (DbEgressEvent event : oldPendingEvents) {
+      taskQueueService.pushEgressEventTask(
+          event.getEgressEventId(), ExfiltrationUtils.isVwbEgressEvent(event));
     }
 
-    if (oldPendingEventIds.size() > 0) {
+    if (oldPendingEvents.size() > 0) {
       log.warning(
-          String.format("found and re-enqueued %d old PENDING events", oldPendingEventIds.size()));
+          String.format("found and re-enqueued %d old PENDING events", oldPendingEvents.size()));
     }
     return ResponseEntity.noContent().build();
   }
diff --git a/api/src/main/java/org/pmiops/workbench/api/VwbEgressAdminController.java b/api/src/main/java/org/pmiops/workbench/api/VwbEgressAdminController.java
index 7e2d5bff55b..d6e9f324e22 100644
--- a/api/src/main/java/org/pmiops/workbench/api/VwbEgressAdminController.java
+++ b/api/src/main/java/org/pmiops/workbench/api/VwbEgressAdminController.java
@@ -1,13 +1,52 @@
 package org.pmiops.workbench.api;
 
+import jakarta.inject.Provider;
+import java.util.logging.Logger;
+import org.pmiops.workbench.config.WorkbenchConfig;
+import org.pmiops.workbench.db.model.DbUser;
+import org.pmiops.workbench.exceptions.ForbiddenException;
+import org.pmiops.workbench.exceptions.UnauthorizedException;
+import org.pmiops.workbench.exfiltration.EgressEventService;
 import org.pmiops.workbench.model.VwbEgressEventRequest;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.RestController;
 
 @RestController
 public class VwbEgressAdminController implements VwbEgressAdminApiDelegate {
+  private static final Logger log = Logger.getLogger(NotebooksController.class.getName());
+  private final EgressEventService egressEventService;
+
+  private final Provider<WorkbenchConfig> workbenchConfigProvider;
+
+  private final Provider<DbUser> userProvider;
+
+  @Autowired
+  public VwbEgressAdminController(
+      EgressEventService egressEventService,
+      Provider<WorkbenchConfig> workbenchConfigProvider,
+      Provider<DbUser> userProvider) {
+    this.egressEventService = egressEventService;
+    this.workbenchConfigProvider = workbenchConfigProvider;
+    this.userProvider = userProvider;
+  }
+
   @Override
   public ResponseEntity<Void> createVwbEgressEvent(VwbEgressEventRequest body) {
+    if (!workbenchConfigProvider.get().featureFlags.enableVWBEgressMonitor) {
+      throw new ForbiddenException("VWB Egress Monitor is disabled");
+    }
+    if (!workbenchConfigProvider
+        .get()
+        .vwb
+        .exfilManagerServiceAccount
+        .equals(userProvider.get().getUsername())) {
+      throw new UnauthorizedException(
+          String.format(
+              "User %s is not authorized to create VwbEgressEvent",
+              userProvider.get().getUsername()));
+    }
+    egressEventService.handleVwbEvent(body);
     return ResponseEntity.ok().build();
   }
 }
diff --git a/api/src/main/java/org/pmiops/workbench/cloudtasks/TaskQueueService.java b/api/src/main/java/org/pmiops/workbench/cloudtasks/TaskQueueService.java
index 557983b578f..3fbbf5aaec5 100644
--- a/api/src/main/java/org/pmiops/workbench/cloudtasks/TaskQueueService.java
+++ b/api/src/main/java/org/pmiops/workbench/cloudtasks/TaskQueueService.java
@@ -175,11 +175,11 @@ private <T> List<List<T>> groupDeleteWorkspaceTasks(List<T> workspacesToDelete)
     return CloudTasksUtils.partitionList(workspacesToDelete, batchSize);
   }
 
-  public void pushEgressEventTask(Long eventId) {
+  public void pushEgressEventTask(Long eventId, boolean isVwbEgressEvent) {
     createAndPushTask(
         EGRESS_EVENT_QUEUE_NAME,
         EGRESS_EVENT_PATH,
-        new ProcessEgressEventRequest().eventId(eventId));
+        new ProcessEgressEventRequest().eventId(eventId).isVwbEgressEvent(isVwbEgressEvent));
   }
 
   public void pushCreateWorkspaceTask(long operationId, Workspace workspace) {
diff --git a/api/src/main/java/org/pmiops/workbench/db/dao/EgressEventDao.java b/api/src/main/java/org/pmiops/workbench/db/dao/EgressEventDao.java
index 6bda388cf77..a67b9534071 100644
--- a/api/src/main/java/org/pmiops/workbench/db/dao/EgressEventDao.java
+++ b/api/src/main/java/org/pmiops/workbench/db/dao/EgressEventDao.java
@@ -1,6 +1,7 @@
 package org.pmiops.workbench.db.dao;
 
 import java.sql.Timestamp;
+import java.util.Collection;
 import java.util.List;
 import org.pmiops.workbench.db.model.DbEgressEvent;
 import org.pmiops.workbench.db.model.DbEgressEvent.DbEgressEventStatus;
@@ -23,7 +24,8 @@ public interface EgressEventDao
   Page<DbEgressEvent> findAllByUserAndWorkspaceOrderByCreationTimeDesc(
       DbUser user, DbWorkspace workspace, Pageable p);
 
-  List<DbEgressEvent> findAllByUserAndStatusNot(DbUser user, DbEgressEventStatus status);
+  List<DbEgressEvent> findAllByUserAndStatusNotIn(
+      DbUser user, Collection<DbEgressEventStatus> status);
 
   List<DbEgressEvent> findAllByUserAndWorkspaceAndCreationTimeBetweenAndCreationTimeNot(
       DbUser user,
diff --git a/api/src/main/java/org/pmiops/workbench/db/model/DbEgressEvent.java b/api/src/main/java/org/pmiops/workbench/db/model/DbEgressEvent.java
index 902c771dd42..f5c07a29a33 100644
--- a/api/src/main/java/org/pmiops/workbench/db/model/DbEgressEvent.java
+++ b/api/src/main/java/org/pmiops/workbench/db/model/DbEgressEvent.java
@@ -42,6 +42,12 @@ public enum DbEgressEventStatus {
 
   private String bucketAuditEvent;
 
+  private String vwbWorkspaceId;
+  private String vwbVmName;
+  private String gcpProjectId;
+  private String vwbEgressEventId;
+  private int vwbIncidentCount;
+
   @Id
   @GeneratedValue(strategy = GenerationType.IDENTITY)
   @Column(name = "egress_event_id", nullable = false)
@@ -149,6 +155,56 @@ public DbEgressEvent setStatus(DbEgressEventStatus s) {
     return this;
   }
 
+  @Column(name = "vwb_workspace_id")
+  public String getVwbWorkspaceId() {
+    return vwbWorkspaceId;
+  }
+
+  public DbEgressEvent setVwbWorkspaceId(String vwbWorkspaceId) {
+    this.vwbWorkspaceId = vwbWorkspaceId;
+    return this;
+  }
+
+  @Column(name = "vwb_vm_name")
+  public String getVwbVmName() {
+    return vwbVmName;
+  }
+
+  public DbEgressEvent setVwbVmName(String vwbVmName) {
+    this.vwbVmName = vwbVmName;
+    return this;
+  }
+
+  @Column(name = "gcp_project_id")
+  public String getGcpProjectId() {
+    return gcpProjectId;
+  }
+
+  public DbEgressEvent setGcpProjectId(String gcpProjectId) {
+    this.gcpProjectId = gcpProjectId;
+    return this;
+  }
+
+  @Column(name = "vwb_egress_event_id")
+  public String getVwbEgressEventId() {
+    return vwbEgressEventId;
+  }
+
+  public DbEgressEvent setVwbEgressEventId(String vwbEgressEventId) {
+    this.vwbEgressEventId = vwbEgressEventId;
+    return this;
+  }
+
+  @Column(name = "vwb_incident_count")
+  public int getVwbIncidentCount() {
+    return vwbIncidentCount;
+  }
+
+  public DbEgressEvent setVwbIncidentCount(int vwbIncidentCount) {
+    this.vwbIncidentCount = vwbIncidentCount;
+    return this;
+  }
+
   public boolean equals(Object o) {
     if (this == o) {
       return true;
@@ -165,7 +221,11 @@ public boolean equals(Object o) {
         && Objects.equals(creationTime, that.creationTime)
         && Objects.equals(lastModifiedTime, that.lastModifiedTime)
         && status == that.status
-        && Objects.equals(sumologicEvent, that.sumologicEvent);
+        && Objects.equals(sumologicEvent, that.sumologicEvent)
+        && Objects.equals(vwbWorkspaceId, that.vwbWorkspaceId)
+        && Objects.equals(vwbVmName, that.vwbVmName)
+        && Objects.equals(gcpProjectId, that.gcpProjectId)
+        && Objects.equals(vwbIncidentCount, that.vwbIncidentCount);
   }
 
   @Override
@@ -179,6 +239,10 @@ public int hashCode() {
         creationTime,
         lastModifiedTime,
         status,
-        sumologicEvent);
+        sumologicEvent,
+        vwbWorkspaceId,
+        vwbVmName,
+        gcpProjectId,
+        vwbIncidentCount);
   }
 }
diff --git a/api/src/main/java/org/pmiops/workbench/exfiltration/EgressEventService.java b/api/src/main/java/org/pmiops/workbench/exfiltration/EgressEventService.java
index 81153ada202..9161515a795 100644
--- a/api/src/main/java/org/pmiops/workbench/exfiltration/EgressEventService.java
+++ b/api/src/main/java/org/pmiops/workbench/exfiltration/EgressEventService.java
@@ -1,7 +1,10 @@
 package org.pmiops.workbench.exfiltration;
 
 import org.pmiops.workbench.model.SumologicEgressEvent;
+import org.pmiops.workbench.model.VwbEgressEventRequest;
 
 public interface EgressEventService {
   void handleEvent(SumologicEgressEvent egressEvent);
+
+  void handleVwbEvent(VwbEgressEventRequest egressEvent);
 }
diff --git a/api/src/main/java/org/pmiops/workbench/exfiltration/EgressEventServiceImpl.java b/api/src/main/java/org/pmiops/workbench/exfiltration/EgressEventServiceImpl.java
index 06c4545b534..7a57130e1fc 100644
--- a/api/src/main/java/org/pmiops/workbench/exfiltration/EgressEventServiceImpl.java
+++ b/api/src/main/java/org/pmiops/workbench/exfiltration/EgressEventServiceImpl.java
@@ -24,6 +24,7 @@
 import org.pmiops.workbench.db.model.DbUser;
 import org.pmiops.workbench.db.model.DbWorkspace;
 import org.pmiops.workbench.model.SumologicEgressEvent;
+import org.pmiops.workbench.model.VwbEgressEventRequest;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
@@ -100,8 +101,38 @@ public void handleEvent(SumologicEgressEvent event) {
     this.egressEventAuditor.fireEgressEventForUser(event, egressUser.get());
 
     Optional<DbEgressEvent> maybeEvent =
-        this.maybePersistEgressEvent(event, Optional.of(egressUser.get()), dbWorkspaceMaybe);
-    maybeEvent.ifPresent(e -> taskQueueService.pushEgressEventTask(e.getEgressEventId()));
+        this.maybePersistSumoEgressEvent(event, Optional.of(egressUser.get()), dbWorkspaceMaybe);
+    maybeEvent.ifPresent(e -> taskQueueService.pushEgressEventTask(e.getEgressEventId(), false));
+  }
+
+  @Override
+  public void handleVwbEvent(VwbEgressEventRequest egressEvent) {
+    Optional<DbUser> egressUser = userService.getByUsername(egressEvent.getUserEmail());
+    if (egressUser.isEmpty()) {
+      logger.severe(
+          String.format(
+              "An egress event happened for workspace: %s, but we're unable to find a user %s.",
+              egressEvent.getVwbWorkspaceId(), egressEvent.getUserEmail()));
+    }
+    this.egressEventAuditor.fireVwbEgressEvent(egressEvent, egressUser.get());
+    DbEgressEvent event =
+        egressEventDao.save(
+            new DbEgressEvent()
+                .setUser(egressUser.orElse(null))
+                .setVwbEgressEventId(egressEvent.getVwbEgressEventId())
+                .setVwbWorkspaceId(egressEvent.getVwbWorkspaceId())
+                .setVwbVmName(egressEvent.getVmName())
+                .setGcpProjectId(egressEvent.getGcpProjectId())
+                .setVwbIncidentCount(egressEvent.getIncidentCount().intValue())
+                .setEgressMegabytes(
+                    Optional.ofNullable(egressEvent.getEgressMib())
+                        // Mebibytes (2^20 bytes) -> Megabytes (10^6 bytes)
+                        .map(mib -> (float) (mib * ((1 << 20) / 1e6)))
+                        .orElse(null))
+                .setEgressWindowSeconds(
+                    Optional.ofNullable(egressEvent.getTimeWindowDuration()).orElse(null))
+                .setStatus(DbEgressEventStatus.PENDING));
+    taskQueueService.pushEgressEventTask(event.getEgressEventId(), true);
   }
 
   @NotNull
@@ -139,7 +170,7 @@ private boolean isEventStale(SumologicEgressEvent egressEvent) {
     return windowStart.isBefore(clock.instant().minus(windowDuration.multipliedBy(2L)));
   }
 
-  private Optional<DbEgressEvent> maybePersistEgressEvent(
+  private Optional<DbEgressEvent> maybePersistSumoEgressEvent(
       SumologicEgressEvent event,
       Optional<DbUser> userMaybe,
       Optional<DbWorkspace> workspaceMaybe) {
diff --git a/api/src/main/java/org/pmiops/workbench/exfiltration/EgressRemediationService.java b/api/src/main/java/org/pmiops/workbench/exfiltration/EgressRemediationService.java
index 305e9d62834..fdb70a7ae5c 100644
--- a/api/src/main/java/org/pmiops/workbench/exfiltration/EgressRemediationService.java
+++ b/api/src/main/java/org/pmiops/workbench/exfiltration/EgressRemediationService.java
@@ -91,7 +91,7 @@ public void remediateEgressEvent(long egressEventId) {
       return;
     }
     // Gather/merge past alerts into an incident history
-    int egressIncidentCount = getEgressIncidentCountForUser(user);
+    int egressIncidentCount = getEgressIncidentCountForUser(event, user);
 
     // Determine escalating remediation action, if any
     EgressAlertRemediationPolicy egressPolicy =
@@ -101,7 +101,7 @@ public void remediateEgressEvent(long egressEventId) {
     // Execute the action, if any
     escalation.ifPresent(
         e -> {
-          EgressRemediationAction action = getEgressRemediationAction(user, e);
+          EgressRemediationAction action = getEgressRemediationAction(user, e, event);
 
           if (egressPolicy != null && egressPolicy.enableJiraTicketing) {
             try {
@@ -126,18 +126,26 @@ public void remediateEgressEvent(long egressEventId) {
   }
 
   @NotNull
-  private EgressRemediationAction getEgressRemediationAction(DbUser user, Escalation e) {
-    EgressRemediationAction action;
-    if (e.disableUser != null) {
-      disableUser(user);
-      action = EgressRemediationAction.DISABLE_USER;
-    } else if (e.suspendCompute != null) {
-      suspendUserCompute(user, Duration.ofMinutes(e.suspendCompute.durationMinutes));
-      action = EgressRemediationAction.SUSPEND_COMPUTE;
+  private EgressRemediationAction getEgressRemediationAction(
+      DbUser user, Escalation e, DbEgressEvent event) {
+    if (ExfiltrationUtils.isVwbEgressEvent(event)) {
+      if (e.disableUser != null) {
+        disableUserVwbDataAccess(user);
+        return EgressRemediationAction.DISABLE_USER;
+      } else if (e.suspendCompute != null) {
+        // Compute will be suspended by VWB.
+        return EgressRemediationAction.SUSPEND_COMPUTE;
+      }
     } else {
-      throw new ServerErrorException("egress alert policy is invalid: " + e);
+      if (e.disableUser != null) {
+        disableUser(user);
+        return EgressRemediationAction.DISABLE_USER;
+      } else if (e.suspendCompute != null) {
+        suspendUserCompute(user, Duration.ofMinutes(e.suspendCompute.durationMinutes));
+        return EgressRemediationAction.SUSPEND_COMPUTE;
+      }
     }
-    return action;
+    throw new ServerErrorException("egress alert policy is invalid: " + e);
   }
 
   protected abstract void sendEgressRemediationEmail(
@@ -159,9 +167,11 @@ protected abstract void logEvent(DbEgressEvent event, EgressRemediationAction ac
    * @return the count of logical egress incidents for this user for all time, including any events
    *     which are actively being processed
    */
-  private int getEgressIncidentCountForUser(DbUser user) {
+  protected int getEgressIncidentCountForUser(DbEgressEvent event, DbUser user) {
     List<DbEgressEvent> events =
-        egressEventDao.findAllByUserAndStatusNot(user, DbEgressEventStatus.VERIFIED_FALSE_POSITIVE);
+        egressEventDao.findAllByUserAndStatusNotIn(
+            user,
+            List.of(DbEgressEventStatus.VERIFIED_FALSE_POSITIVE, DbEgressEventStatus.BYPASSED));
 
     // If any egress alerts are missing workspace metadata (this should not happen), consider each
     // as unique incidents.
@@ -271,6 +281,18 @@ protected void disableUser(DbUser user) {
     stopUserRuntimesAndApps(user.getUsername());
   }
 
+  protected void disableUserVwbDataAccess(DbUser user) {
+    userService.updateUserWithRetries(
+        u -> {
+          u.setDisabled(true);
+          return u;
+        },
+        user,
+        Agent.asSystem());
+
+    // TODO: Lock user access in VWB.
+  }
+
   private void stopUserRuntimesAndApps(String userEmail) {
     int stoppedRuntimeCount = leonardoNotebooksClient.stopAllUserRuntimesAsService(userEmail);
     int stoppedAppCount = leonardoNotebooksClient.deleteUserAppsAsService(userEmail);
diff --git a/api/src/main/java/org/pmiops/workbench/exfiltration/ExfiltrationUtils.java b/api/src/main/java/org/pmiops/workbench/exfiltration/ExfiltrationUtils.java
index 93b7b772901..f6b56176380 100644
--- a/api/src/main/java/org/pmiops/workbench/exfiltration/ExfiltrationUtils.java
+++ b/api/src/main/java/org/pmiops/workbench/exfiltration/ExfiltrationUtils.java
@@ -2,6 +2,8 @@
 
 import java.util.Optional;
 import java.util.regex.Pattern;
+import org.javers.common.string.Strings;
+import org.pmiops.workbench.db.model.DbEgressEvent;
 import org.pmiops.workbench.utils.Matchers;
 
 /** Utilities and constants for exfiltration services. */
@@ -14,6 +16,7 @@ public class ExfiltrationUtils {
 
   public static final String EGRESS_SUMOLOGIC_SERVICE_QUALIFIER = "sumologicEgressService";
   public static final String SUMOLOGIC_JIRA_HANDLER_QUALIFIER = "sumologicJiraHandler";
+  public static final String EGRESS_VWB_SERVICE_QUALIFIER = "vwbEgressService";
 
   private static final Pattern VM_PREFIX_PATTERN = Pattern.compile("all-of-us-(?<userid>\\d+)");
   private static final String USER_ID_GROUP_NAME = "userid";
@@ -26,4 +29,9 @@ public static Optional<Long> gkeServiceNameToUserDatabaseId(String gkeServiceNam
     return Matchers.getGroup(VM_PREFIX_PATTERN, gkeServiceName, USER_ID_GROUP_NAME)
         .map(Long::parseLong);
   }
+
+  /** If egress event has VWB workspace id, it would be an VWB egress event */
+  public static boolean isVwbEgressEvent(DbEgressEvent e) {
+    return Strings.isNonEmpty(e.getVwbWorkspaceId());
+  }
 }
diff --git a/api/src/main/java/org/pmiops/workbench/exfiltration/impl/EgressVwbRemediationService.java b/api/src/main/java/org/pmiops/workbench/exfiltration/impl/EgressVwbRemediationService.java
new file mode 100644
index 00000000000..9b7cf21270c
--- /dev/null
+++ b/api/src/main/java/org/pmiops/workbench/exfiltration/impl/EgressVwbRemediationService.java
@@ -0,0 +1,113 @@
+package org.pmiops.workbench.exfiltration.impl;
+
+import static org.pmiops.workbench.exfiltration.ExfiltrationUtils.SUMOLOGIC_JIRA_HANDLER_QUALIFIER;
+import static org.pmiops.workbench.leonardo.LeonardoAppUtils.appServiceNameToAppType;
+
+import com.google.common.base.Strings;
+import jakarta.inject.Provider;
+import jakarta.mail.MessagingException;
+import java.time.Clock;
+import java.util.logging.Logger;
+import org.pmiops.workbench.actionaudit.auditors.EgressEventAuditor;
+import org.pmiops.workbench.config.WorkbenchConfig;
+import org.pmiops.workbench.db.dao.EgressEventDao;
+import org.pmiops.workbench.db.dao.UserService;
+import org.pmiops.workbench.db.model.DbEgressEvent;
+import org.pmiops.workbench.db.model.DbUser;
+import org.pmiops.workbench.exfiltration.EgressRemediationAction;
+import org.pmiops.workbench.exfiltration.EgressRemediationService;
+import org.pmiops.workbench.exfiltration.ExfiltrationUtils;
+import org.pmiops.workbench.exfiltration.jirahandler.EgressJiraHandler;
+import org.pmiops.workbench.jira.ApiException;
+import org.pmiops.workbench.leonardo.LeonardoApiClient;
+import org.pmiops.workbench.leonardo.LeonardoAppUtils;
+import org.pmiops.workbench.mail.MailService;
+import org.pmiops.workbench.model.SumologicEgressEvent;
+import org.pmiops.workbench.user.UserAdminService;
+import org.pmiops.workbench.utils.mappers.EgressEventMapper;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.stereotype.Service;
+
+@Service(ExfiltrationUtils.EGRESS_VWB_SERVICE_QUALIFIER)
+public class EgressVwbRemediationService extends EgressRemediationService {
+  private static final Logger logger =
+      Logger.getLogger(EgressVwbRemediationService.class.getName());
+
+  // The maximum egress user is allowed when bypassed for large file download. If more than this
+  // user will still trigger egress alert.
+  // Current value is 100GB
+  private static final int EGRESS_HARD_LIMIT_MB = 100 * 1024;
+
+  private final EgressJiraHandler egressJiraHandler;
+  private final MailService mailService;
+  private final EgressEventMapper egressEventMapper;
+  private final UserAdminService userAdminService;
+
+  @Autowired
+  public EgressVwbRemediationService(
+      Clock clock,
+      Provider<WorkbenchConfig> workbenchConfigProvider,
+      UserService userService,
+      LeonardoApiClient leonardoNotebooksClient,
+      EgressEventAuditor egressEventAuditor,
+      EgressEventDao egressEventDao,
+      EgressEventMapper egressEventMapper,
+      @Qualifier(SUMOLOGIC_JIRA_HANDLER_QUALIFIER) EgressJiraHandler egressJiraHandler,
+      MailService mailService,
+      UserAdminService userAdminService) {
+    super(
+        clock,
+        workbenchConfigProvider,
+        userService,
+        leonardoNotebooksClient,
+        egressEventAuditor,
+        egressEventDao,
+        egressEventMapper,
+        userAdminService);
+    this.egressJiraHandler = egressJiraHandler;
+    this.mailService = mailService;
+    this.egressEventMapper = egressEventMapper;
+    this.userAdminService = userAdminService;
+  }
+
+  @Override
+  protected void sendEgressRemediationEmail(
+      DbUser user, EgressRemediationAction action, DbEgressEvent event) throws MessagingException {
+    // TODO(RW-14138): Vwb email support
+    SumologicEgressEvent originalEvent = egressEventMapper.toSumoLogicEvent(event);
+    String environmentType =
+        appServiceNameToAppType(Strings.nullToEmpty(originalEvent.getSrcGkeServiceName()))
+            .map(LeonardoAppUtils::appDisplayName)
+            .orElse("Jupyter");
+    mailService.sendEgressRemediationEmail(user, action, environmentType);
+  }
+
+  @Override
+  protected void logEvent(DbEgressEvent event, EgressRemediationAction action) throws ApiException {
+    egressJiraHandler.logEventToJira(event, action);
+  }
+
+  @Override
+  protected boolean shouldSkipEgressEvent(DbEgressEvent event) {
+    if (isUserBypassedForLargeFileDownload(event)) {
+      logger.info(
+          String.format(
+              "Skip egress event %d because user is bypassed for large file download",
+              event.getEgressEventId()));
+      return true;
+    }
+    return false;
+  }
+
+  @Override
+  protected int getEgressIncidentCountForUser(DbEgressEvent event, DbUser user) {
+    return event.getVwbIncidentCount();
+  }
+
+  private boolean isUserBypassedForLargeFileDownload(DbEgressEvent event) {
+    return userAdminService.getCurrentEgressBypassWindow(event.getUser().getUserId()) != null
+        && event.getEgressMegabytes() != null
+        && event.getEgressMegabytes() < EGRESS_HARD_LIMIT_MB;
+  }
+}
diff --git a/api/src/main/resources/workbench-api.yaml b/api/src/main/resources/workbench-api.yaml
index 656f501107b..96f7d66f043 100644
--- a/api/src/main/resources/workbench-api.yaml
+++ b/api/src/main/resources/workbench-api.yaml
@@ -11732,6 +11732,10 @@ components:
           type: integer
           description: Egress event ID to be processed
           format: int64
+        isVwbEgressEvent:
+          type: boolean
+          description: Is this a VWB egress event
+          default: false
     DeleteTestUserWorkspacesRequest:
       type: array
       items:
@@ -13161,9 +13165,12 @@ components:
           type: integer
           format: int64
           description: current incident count for the user in the workspace
-        workspaceId:
+        vwbWorkspaceId:
           type: string
           description: UUID of a VWB workspace
+        vwbEgressEventId:
+          type: string
+          description: UUID of a VWB egress event
         egress_mib:
           type: number
           description: The total amount of egress detected during the window, in mebibytes
diff --git a/api/src/test/java/org/pmiops/workbench/api/OfflineEgressControllerTest.java b/api/src/test/java/org/pmiops/workbench/api/OfflineEgressControllerTest.java
index 757c6b58b00..f73ccc6ee66 100644
--- a/api/src/test/java/org/pmiops/workbench/api/OfflineEgressControllerTest.java
+++ b/api/src/test/java/org/pmiops/workbench/api/OfflineEgressControllerTest.java
@@ -1,5 +1,6 @@
 package org.pmiops.workbench.api;
 
+import static org.mockito.ArgumentMatchers.anyBoolean;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
@@ -56,7 +57,7 @@ public void testCheckPendingEgressEvents() {
     fakeClock.setInstant(FakeClockConfiguration.NOW.toInstant());
     offlineEgressController.checkPendingEgressEvents();
 
-    verify(mockTaskQueueService, times(2)).pushEgressEventTask(anyLong());
+    verify(mockTaskQueueService, times(2)).pushEgressEventTask(anyLong(), anyBoolean());
   }
 
   @Test
@@ -74,6 +75,8 @@ public void testCheckPendingEgressEvents_noMatches() {
   }
 
   private DbEgressEvent newEvent() {
-    return new DbEgressEvent().setStatus(DbEgressEventStatus.PENDING);
+    return new DbEgressEvent()
+        .setStatus(DbEgressEventStatus.PENDING)
+        .setVwbWorkspaceId("wb-test-123");
   }
 }
diff --git a/api/src/test/java/org/pmiops/workbench/api/VwbEgressAdminControllerTest.java b/api/src/test/java/org/pmiops/workbench/api/VwbEgressAdminControllerTest.java
new file mode 100644
index 00000000000..9b774d2bcd4
--- /dev/null
+++ b/api/src/test/java/org/pmiops/workbench/api/VwbEgressAdminControllerTest.java
@@ -0,0 +1,97 @@
+package org.pmiops.workbench.api;
+
+import static com.google.common.truth.Truth.assertThat;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import jakarta.inject.Provider;
+import java.time.Instant;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mock;
+import org.pmiops.workbench.config.WorkbenchConfig;
+import org.pmiops.workbench.db.model.DbUser;
+import org.pmiops.workbench.exceptions.ForbiddenException;
+import org.pmiops.workbench.exceptions.UnauthorizedException;
+import org.pmiops.workbench.exfiltration.EgressEventService;
+import org.pmiops.workbench.model.VwbEgressEventRequest;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.test.context.junit.jupiter.SpringJUnitConfig;
+
+@SpringJUnitConfig
+public class VwbEgressAdminControllerTest {
+  @Mock private Provider<DbUser> mockUserProvider;
+  @Mock private Provider<WorkbenchConfig> mockConfigProvider;
+  @Mock private EgressEventService mockEgressEventService;
+
+  private VwbEgressAdminController vwbEgressAdminController;
+
+  private WorkbenchConfig workbenchConfig = new WorkbenchConfig();
+  private VwbEgressEventRequest vwbEvent;
+  private DbUser authorizedUser;
+
+  @BeforeEach
+  public void setUp() {
+    this.vwbEgressAdminController =
+        new VwbEgressAdminController(mockEgressEventService, mockConfigProvider, mockUserProvider);
+    authorizedUser = new DbUser();
+    authorizedUser.setUsername("test-user@example.com");
+    workbenchConfig.featureFlags = new WorkbenchConfig.FeatureFlagsConfig();
+    workbenchConfig.featureFlags.enableVWBEgressMonitor = true;
+
+    workbenchConfig.vwb = new WorkbenchConfig.VwbConfig();
+    workbenchConfig.vwb.exfilManagerServiceAccount = authorizedUser.getUsername();
+    when(mockConfigProvider.get()).thenReturn(workbenchConfig);
+
+    vwbEvent =
+        new VwbEgressEventRequest()
+            .userEmail("testuser@example.com")
+            .vwbWorkspaceId("testWorkspaceId")
+            .vmName("testVmName")
+            .incidentCount(1L)
+            .egressMib(500.0)
+            .egressMibThreshold(100.0)
+            .gcpProjectId("test-gcp-project")
+            .timeWindowDuration(600L)
+            .timeWindowStart(Instant.now().toEpochMilli());
+  }
+
+  @Test
+  public void testCreateVwbEgressEvent() {
+    when(mockUserProvider.get()).thenReturn(authorizedUser);
+
+    ResponseEntity<Void> response = vwbEgressAdminController.createVwbEgressEvent(vwbEvent);
+
+    verify(mockEgressEventService).handleVwbEvent(vwbEvent);
+    assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
+  }
+
+  @Test
+  public void testCreateVwbEgressEvent_unauthorizedUser() {
+    DbUser dbUser = new DbUser();
+    dbUser.setUsername("unauthorized-user@example.com");
+
+    when(mockUserProvider.get()).thenReturn(dbUser);
+
+    assertThrows(
+        UnauthorizedException.class,
+        () -> {
+          vwbEgressAdminController.createVwbEgressEvent(vwbEvent);
+        });
+  }
+
+  @Test
+  public void testCreateVwbEgressEvent_flagNotEnabled() {
+    workbenchConfig.featureFlags = new WorkbenchConfig.FeatureFlagsConfig();
+    workbenchConfig.featureFlags.enableVWBEgressMonitor = false;
+    when(mockUserProvider.get()).thenReturn(authorizedUser);
+
+    assertThrows(
+        ForbiddenException.class,
+        () -> {
+          vwbEgressAdminController.createVwbEgressEvent(vwbEvent);
+        });
+  }
+}
diff --git a/api/src/test/java/org/pmiops/workbench/db/dao/EgressEventDaoTest.java b/api/src/test/java/org/pmiops/workbench/db/dao/EgressEventDaoTest.java
new file mode 100644
index 00000000000..afde58a8943
--- /dev/null
+++ b/api/src/test/java/org/pmiops/workbench/db/dao/EgressEventDaoTest.java
@@ -0,0 +1,92 @@
+package org.pmiops.workbench.db.dao;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import java.sql.Timestamp;
+import java.time.Instant;
+import java.util.List;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.pmiops.workbench.FakeClockConfiguration;
+import org.pmiops.workbench.config.CommonConfig;
+import org.pmiops.workbench.db.model.DbEgressEvent;
+import org.pmiops.workbench.db.model.DbEgressEvent.DbEgressEventStatus;
+import org.pmiops.workbench.db.model.DbUser;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.autoconfigure.orm.jpa.DataJpaTest;
+import org.springframework.context.annotation.Import;
+
+@Import({FakeClockConfiguration.class, CommonConfig.class})
+@DataJpaTest
+public class EgressEventDaoTest {
+  @Autowired private UserDao userDao;
+
+  @Autowired private EgressEventDao egressEventDao;
+
+  private static final Timestamp CURRENT_TIMESTAMP = Timestamp.from(Instant.now());
+  private DbUser user;
+
+  @BeforeEach
+  public void setUp() {
+    user = userDao.save(new DbUser());
+  }
+
+  @Test
+  public void testCreateAndGet() {
+    // Create
+    DbEgressEvent event = createValidDbEgressEvent();
+    event = egressEventDao.save(event);
+    assertThat(event.getEgressEventId()).isNotNull();
+
+    // Read
+    DbEgressEvent foundEvent = egressEventDao.findById(event.getEgressEventId()).orElse(null);
+    assertThat(foundEvent).isNotNull();
+    assertThat(foundEvent.getUser()).isEqualTo(user);
+    assertThat(foundEvent.getVwbWorkspaceId()).isEqualTo("testWorkspaceId");
+    assertThat(foundEvent.getVwbVmName()).isEqualTo("testVmName");
+    assertThat(foundEvent.getGcpProjectId()).isEqualTo("test-project");
+
+    // Update
+    foundEvent.setStatus(DbEgressEventStatus.VERIFIED_FALSE_POSITIVE);
+    egressEventDao.save(foundEvent);
+    DbEgressEvent updatedEvent = egressEventDao.findById(event.getEgressEventId()).orElse(null);
+    assertThat(updatedEvent.getStatus())
+        .isEqualTo(DbEgressEvent.DbEgressEventStatus.VERIFIED_FALSE_POSITIVE);
+  }
+
+  @Test
+  public void testFindAllByUserAndStatusNotIn() {
+    DbEgressEvent event1 = createValidDbEgressEvent();
+    event1.setStatus(DbEgressEventStatus.PENDING);
+    egressEventDao.save(event1);
+
+    DbEgressEvent event2 = createValidDbEgressEvent();
+    event2.setStatus(DbEgressEventStatus.REMEDIATED);
+    egressEventDao.save(event2);
+
+    DbEgressEvent event3 = createValidDbEgressEvent();
+    event3.setStatus(DbEgressEventStatus.VERIFIED_FALSE_POSITIVE);
+    egressEventDao.save(event3);
+
+    List<DbEgressEventStatus> excludedStatuses =
+        List.of(DbEgressEventStatus.REMEDIATED, DbEgressEventStatus.VERIFIED_FALSE_POSITIVE);
+    List<DbEgressEvent> result = egressEventDao.findAllByUserAndStatusNotIn(user, excludedStatuses);
+
+    assertThat(result).hasSize(1);
+    assertThat(result.get(0).getStatus()).isEqualTo(DbEgressEventStatus.PENDING);
+  }
+
+  private DbEgressEvent createValidDbEgressEvent() {
+    DbEgressEvent event = new DbEgressEvent();
+    event.setUser(user);
+    event.setCreationTime(CURRENT_TIMESTAMP);
+    event.setStatus(DbEgressEvent.DbEgressEventStatus.PENDING);
+    event.setEgressWindowSeconds(3600L);
+    event.setVwbWorkspaceId("testWorkspaceId");
+    event.setLastModifiedTime(CURRENT_TIMESTAMP);
+    event.setVwbVmName("testVmName");
+    event.setGcpProjectId("test-project");
+    ;
+    return event;
+  }
+}
diff --git a/api/src/test/java/org/pmiops/workbench/exfiltration/EgressEventServiceTest.java b/api/src/test/java/org/pmiops/workbench/exfiltration/EgressEventServiceTest.java
index b033c5f92b9..843daea7af1 100644
--- a/api/src/test/java/org/pmiops/workbench/exfiltration/EgressEventServiceTest.java
+++ b/api/src/test/java/org/pmiops/workbench/exfiltration/EgressEventServiceTest.java
@@ -1,6 +1,7 @@
 package org.pmiops.workbench.exfiltration;
 
 import static com.google.common.truth.Truth.assertThat;
+import static org.mockito.ArgumentMatchers.anyBoolean;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.verify;
@@ -132,7 +133,7 @@ public void testCreateEgressEventAlert() throws Exception {
     SumologicEgressEvent event = recentEgressEventForUser(dbUser1);
     egressEventService.handleEvent(event);
     verify(mockEgressEventAuditor).fireEgressEventForUser(event, dbUser1);
-    verify(mockTaskQueueService).pushEgressEventTask(anyLong());
+    verify(mockTaskQueueService).pushEgressEventTask(anyLong(), anyBoolean());
 
     List<DbEgressEvent> dbEvents = ImmutableList.copyOf(egressEventDao.findAll());
     assertThat(dbEvents).hasSize(1);
@@ -154,7 +155,7 @@ public void testAppCreateEgressEventAlert() {
 
     egressEventService.handleEvent(event);
     verify(mockEgressEventAuditor).fireEgressEventForUser(event, dbUser1);
-    verify(mockTaskQueueService).pushEgressEventTask(anyLong());
+    verify(mockTaskQueueService).pushEgressEventTask(anyLong(), anyBoolean());
 
     List<DbEgressEvent> dbEvents = ImmutableList.copyOf(egressEventDao.findAll());
     assertThat(dbEvents).hasSize(1);
@@ -176,7 +177,7 @@ public void testAppCreateEgressEventAlert_skipCromwell() {
 
     egressEventService.handleEvent(event);
     verify(mockEgressEventAuditor).fireEgressEventForUser(event, dbUser1);
-    verify(mockTaskQueueService).pushEgressEventTask(anyLong());
+    verify(mockTaskQueueService).pushEgressEventTask(anyLong(), anyBoolean());
 
     List<DbEgressEvent> dbEvents = ImmutableList.copyOf(egressEventDao.findAll());
     assertThat(dbEvents).hasSize(1);
@@ -231,7 +232,7 @@ public void testCreateEgressEventAlert_staleEventsMultiwindow() {
 
     fakeClock.setInstant(NOW);
     egressEventService.handleEvent(oldEgressEvent);
-    verify(mockTaskQueueService).pushEgressEventTask(anyLong());
+    verify(mockTaskQueueService).pushEgressEventTask(anyLong(), anyBoolean());
 
     Iterable<DbEgressEvent> dbEvents = egressEventDao.findAll();
     assertThat(dbEvents).hasSize(2);
@@ -256,7 +257,7 @@ public void testCreateEgressEventAlert_staleEventsDifferentUsers() {
     fakeClock.setInstant(NOW);
     egressEventService.handleEvent(oldEgressEvent);
     verify(mockEgressEventAuditor).fireEgressEventForUser(oldEgressEvent, dbUser1);
-    verify(mockTaskQueueService).pushEgressEventTask(anyLong());
+    verify(mockTaskQueueService).pushEgressEventTask(anyLong(), anyBoolean());
 
     Iterable<DbEgressEvent> dbEvents = egressEventDao.findAll();
     assertThat(dbEvents).hasSize(2);
@@ -282,12 +283,46 @@ public void testCreateEgressEventAlert_staleEventShortWindowPersisted() {
     fakeClock.setInstant(NOW);
     egressEventService.handleEvent(oldEgressEvent);
     verify(mockEgressEventAuditor).fireEgressEventForUser(oldEgressEvent, dbUser1);
-    verify(mockTaskQueueService).pushEgressEventTask(anyLong());
+    verify(mockTaskQueueService).pushEgressEventTask(anyLong(), anyBoolean());
 
     Iterable<DbEgressEvent> dbEvents = egressEventDao.findAll();
     assertThat(dbEvents).hasSize(2);
   }
 
+  @Test
+  public void testHandleVwbEgressEvent() {
+    VwbEgressEventRequest vwbEvent =
+        new VwbEgressEventRequest()
+            .userEmail(dbUser1.getUsername())
+            .vwbWorkspaceId("testWorkspaceId")
+            .vmName("testVmName")
+            .incidentCount(1L)
+            .egressMib(500.0)
+            .egressMibThreshold(100.0)
+            .gcpProjectId("test-gcp-project")
+            .timeWindowDuration(600L)
+            .timeWindowStart(NOW.toEpochMilli());
+
+    doReturn(Optional.of(dbUser1)).when(mockUserService).getByDatabaseId(dbUser1.getUserId());
+
+    egressEventService.handleVwbEvent(vwbEvent);
+
+    verify(mockEgressEventAuditor).fireVwbEgressEvent(vwbEvent, dbUser1);
+    verify(mockTaskQueueService).pushEgressEventTask(anyLong(), anyBoolean());
+
+    List<DbEgressEvent> dbEvents = ImmutableList.copyOf(egressEventDao.findAll());
+    assertThat(dbEvents).hasSize(1);
+    DbEgressEvent dbEvent = Iterables.getOnlyElement(dbEvents);
+    assertThat(dbEvent.getUser()).isEqualTo(dbUser1);
+    assertThat(dbEvent.getVwbWorkspaceId()).isEqualTo("testWorkspaceId");
+    assertThat(dbEvent.getVwbVmName()).isEqualTo("testVmName");
+    assertThat(dbEvent.getVwbIncidentCount()).isEqualTo(1);
+    assertThat(dbEvent.getEgressMegabytes())
+        .isEqualTo((float) (500 * ((1 << 20) / 1e6))); // Convert MiB
+    assertThat(dbEvent.getGcpProjectId()).isEqualTo("test-gcp-project");
+    assertThat(dbEvent.getEgressWindowSeconds()).isEqualTo(600L);
+  }
+
   private static SumologicEgressEvent recentEgressEventForUser(DbUser user) {
     return new SumologicEgressEvent()
         .projectName(DEFAULT_GOOGLE_PROJECT)
diff --git a/api/src/test/java/org/pmiops/workbench/exfiltration/EgressRemediationServiceTest.java b/api/src/test/java/org/pmiops/workbench/exfiltration/EgressRemediationServiceTest.java
index 20419b759ff..cf6fa1aa80c 100644
--- a/api/src/test/java/org/pmiops/workbench/exfiltration/EgressRemediationServiceTest.java
+++ b/api/src/test/java/org/pmiops/workbench/exfiltration/EgressRemediationServiceTest.java
@@ -12,6 +12,7 @@
 import static org.mockito.Mockito.verifyNoInteractions;
 import static org.mockito.Mockito.when;
 import static org.pmiops.workbench.exfiltration.ExfiltrationUtils.EGRESS_SUMOLOGIC_SERVICE_QUALIFIER;
+import static org.pmiops.workbench.exfiltration.ExfiltrationUtils.EGRESS_VWB_SERVICE_QUALIFIER;
 
 import com.google.common.collect.ImmutableList;
 import com.google.gson.Gson;
@@ -47,6 +48,7 @@
 import org.pmiops.workbench.db.model.DbWorkspace;
 import org.pmiops.workbench.exceptions.NotFoundException;
 import org.pmiops.workbench.exfiltration.impl.EgressSumologicRemediationService;
+import org.pmiops.workbench.exfiltration.impl.EgressVwbRemediationService;
 import org.pmiops.workbench.exfiltration.jirahandler.EgressJiraHandler;
 import org.pmiops.workbench.exfiltration.jirahandler.EgressSumologicJiraHandler;
 import org.pmiops.workbench.jira.JiraContent;
@@ -101,7 +103,11 @@ public class EgressRemediationServiceTest {
 
   @Autowired
   @Qualifier(EGRESS_SUMOLOGIC_SERVICE_QUALIFIER)
-  private EgressRemediationService egressRemediationService;
+  private EgressRemediationService sumologicEgressRemediationService;
+
+  @Autowired
+  @Qualifier(EGRESS_VWB_SERVICE_QUALIFIER)
+  private EgressRemediationService vwbEgressRemediationService;
 
   @Autowired private EgressJiraHandler egressJiraHandler;
 
@@ -113,6 +119,7 @@ public class EgressRemediationServiceTest {
   @Import({
     EgressEventMapperImpl.class,
     EgressSumologicRemediationService.class,
+    EgressVwbRemediationService.class,
     FakeClockConfiguration.class,
     FakeJpaDateTimeConfiguration.class,
     JiraService.class,
@@ -183,13 +190,14 @@ public void tearDown() {
   @Test
   public void testRemediateEgressEvent_notFound() {
     assertThrows(
-        NotFoundException.class, () -> egressRemediationService.remediateEgressEvent(123L));
+        NotFoundException.class,
+        () -> sumologicEgressRemediationService.remediateEgressEvent(123L));
   }
 
   @Test
   public void testRemediateEgressEvent_alreadyRemediated() {
     long eventId = saveNewEvent(newGCEEvent().setStatus(DbEgressEventStatus.REMEDIATED));
-    egressRemediationService.remediateEgressEvent(eventId);
+    sumologicEgressRemediationService.remediateEgressEvent(eventId);
 
     assertThat(getDbUser().getDisabled()).isFalse();
     assertComputeNotSuspended();
@@ -200,7 +208,7 @@ public void testRemediateEgressEvent_alreadyRemediated() {
   public void testRemediateEgressEvent_emptyPolicy() {
     workbenchConfig.egressAlertRemediationPolicy = null;
 
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
 
     assertThat(getDbUser().getDisabled()).isFalse();
     assertComputeNotSuspended();
@@ -212,7 +220,7 @@ public void testRemediateEgressEvent_noMatchingEscalationPolicy() {
     workbenchConfig.egressAlertRemediationPolicy.escalations =
         ImmutableList.of(disableUserAfter(10));
 
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
 
     assertThat(getDbUser().getDisabled()).isFalse();
     assertComputeNotSuspended();
@@ -225,7 +233,7 @@ public void testRemediateEgressEvent_activeBypassWindow() {
         .thenReturn(new EgressBypassWindow());
 
     long eventId = saveNewEvent(newGCEEvent().setEgressMegabytes((float) (200)));
-    egressRemediationService.remediateEgressEvent(eventId);
+    sumologicEgressRemediationService.remediateEgressEvent(eventId);
 
     assertThat(getDbUser().getDisabled()).isFalse();
     assertComputeNotSuspended();
@@ -240,7 +248,7 @@ public void testRemediateEgressEvent_activeBypassWindowButExeceedHardLimit() {
 
     long eventId = saveNewEvent(newGCEEvent().setEgressMegabytes((float) (110 * 1024)));
 
-    egressRemediationService.remediateEgressEvent(eventId);
+    sumologicEgressRemediationService.remediateEgressEvent(eventId);
 
     assertComputeSuspended(Duration.ofMinutes(1));
   }
@@ -250,7 +258,7 @@ public void testRemediateEgressEvent_firstIncident() {
     workbenchConfig.egressAlertRemediationPolicy.escalations =
         ImmutableList.of(suspendComputeAfter(1, Duration.ofMinutes(1)), disableUserAfter(2));
 
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
 
     assertThat(getDbUser().getDisabled()).isFalse();
     assertComputeSuspended(Duration.ofMinutes(1));
@@ -265,7 +273,7 @@ public void testRemediateEgressEvent_intermediateEscalation() {
             disableUserAfter(3));
 
     saveOldEvents(Duration.ofDays(1));
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
 
     assertThat(getDbUser().getDisabled()).isFalse();
     assertComputeSuspended(Duration.ofMinutes(2));
@@ -285,7 +293,7 @@ public void testRemediateEgressEvent_maxEscalation() {
             .mapToObj(Duration::ofDays)
             .collect(Collectors.toList())
             .toArray(new Duration[] {}));
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
 
     assertThat(getDbUser().getDisabled()).isTrue();
     assertComputeNotSuspended();
@@ -298,7 +306,7 @@ public void testRemediateEgressEvent_simpleIncidentMerge() {
     // Two events within an hour of each-other should merge
     saveOldEvents(Duration.ofHours(22), Duration.ofHours(23));
 
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
 
     // 2 "incidents" == 2 minute suspension
     assertComputeSuspended(Duration.ofMinutes(2));
@@ -309,7 +317,7 @@ public void testRemediateEgressEvent_incidentIncludesActiveEvent() {
     workbenchConfig.egressAlertRemediationPolicy = suspendXMinutesOnXIncidentsPolicy();
 
     saveOldEvents(Duration.ofMinutes(1), Duration.ofMinutes(2));
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
 
     // All 3 events should merge into a single logical incident.
     assertComputeSuspended(Duration.ofMinutes(1));
@@ -324,7 +332,7 @@ public void testRemediateEgressEvent_noIncidentMergeAcrossWorkspaces() {
         oldEvent(Duration.ofHours(3)).setWorkspace(dbWorkspace2),
         oldEvent(Duration.ofHours(4)).setWorkspace(dbWorkspace2));
 
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
 
     // The two events in workspace 2 merge, the other old event and new event do not merge.
     assertComputeSuspended(Duration.ofMinutes(3));
@@ -339,7 +347,7 @@ public void testRemediateEgressEvent_noIncidentMergeMissingWorkspace() {
         oldEvent(Duration.ofHours(3)).setWorkspace(null),
         oldEvent(Duration.ofHours(3)).setWorkspace(null));
 
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
 
     // None of the events merge
     assertComputeSuspended(Duration.ofMinutes(4));
@@ -351,7 +359,7 @@ public void testRemediateEgressEvent_incidentMergeIsNonAssociative() {
 
     // events 1, 2 should be merged but 3 should not
     saveOldEvents(Duration.ofMinutes(300), Duration.ofMinutes(250), Duration.ofMinutes(200));
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
 
     // 1 merged old incident, 1 standalone, and the active event
     assertComputeSuspended(Duration.ofMinutes(3));
@@ -364,7 +372,7 @@ public void testRemediateEgressEvent_incidentsExcludeFalsePostives() {
     saveOldEvents(
         oldEvent(Duration.ofHours(3)).setStatus(DbEgressEventStatus.VERIFIED_FALSE_POSITIVE));
 
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
 
     // Only the active event is considered
     assertComputeSuspended(Duration.ofMinutes(1));
@@ -376,7 +384,7 @@ public void testRemediateEgressEvent_suspendCompute() throws Exception {
         ImmutableList.of(suspendComputeAfter(1, Duration.ofMinutes(1)));
 
     long eventId = saveNewEvent();
-    egressRemediationService.remediateEgressEvent(eventId);
+    sumologicEgressRemediationService.remediateEgressEvent(eventId);
 
     assertThat(getDbUser().getDisabled()).isFalse();
     assertComputeSuspended(Duration.ofMinutes(1));
@@ -395,7 +403,7 @@ public void testRemediateGKEEgressEvent_suspendCompute() throws Exception {
         ImmutableList.of(suspendComputeAfter(1, Duration.ofMinutes(1)));
 
     long eventId = saveNewGKEEvent(AppType.RSTUDIO);
-    egressRemediationService.remediateEgressEvent(eventId);
+    sumologicEgressRemediationService.remediateEgressEvent(eventId);
 
     assertThat(getDbUser().getDisabled()).isFalse();
     assertComputeSuspended(Duration.ofMinutes(1));
@@ -415,7 +423,7 @@ public void testRemediateGKEEgressEvent_skipCromwellApp() {
         ImmutableList.of(suspendComputeAfter(1, Duration.ofMinutes(1)));
 
     long eventId = saveNewGKEEvent(AppType.CROMWELL);
-    egressRemediationService.remediateEgressEvent(eventId);
+    sumologicEgressRemediationService.remediateEgressEvent(eventId);
 
     assertThat(getDbUser().getDisabled()).isFalse();
     assertComputeNotSuspended();
@@ -428,7 +436,7 @@ public void testRemediateEgressEvent_disableUser() throws Exception {
         ImmutableList.of(disableUserAfter(1));
 
     long eventId = saveNewEvent();
-    egressRemediationService.remediateEgressEvent(eventId);
+    sumologicEgressRemediationService.remediateEgressEvent(eventId);
 
     assertThat(getDbUser().getDisabled()).isTrue();
     assertComputeNotSuspended();
@@ -448,7 +456,7 @@ public void testRemediateEgressEvent_auditOnRemediation() {
     workbenchConfig.egressAlertRemediationPolicy.escalations =
         ImmutableList.of(suspendComputeAfter(1, Duration.ofMinutes(1)));
 
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
     verify(mockEgressEventAuditor).fireRemediateEgressEvent(any(), notNull());
   }
 
@@ -458,7 +466,7 @@ public void testRemediateEgressEvent_notify_skipIfRecentEvent() {
         ImmutableList.of(suspendComputeAfter(1, Duration.ofMinutes(1)));
 
     saveOldEvents(oldEvent(Duration.ofMinutes(30L)).setStatus(DbEgressEventStatus.REMEDIATED));
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
 
     verifyNoInteractions(mockMailService);
   }
@@ -473,7 +481,7 @@ public void testRemediateEgressEvent_notify_sendIfRecentUnrelatedEvents() throws
             .setStatus(DbEgressEventStatus.REMEDIATED)
             .setWorkspace(dbWorkspace2),
         oldEvent(Duration.ofHours(2L)).setStatus(DbEgressEventStatus.REMEDIATED));
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
 
     verify(mockMailService)
         .sendEgressRemediationEmail(
@@ -487,7 +495,7 @@ public void testRemediateEgressEvent_noJiraTicketWhenJiraDisabled() throws Excep
     workbenchConfig.egressAlertRemediationPolicy.escalations =
         ImmutableList.of(suspendComputeAfter(1, Duration.ofMinutes(1)));
 
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
 
     verifyNoInteractions(mockJiraApi);
   }
@@ -502,7 +510,7 @@ public void testRemediateEgressEvent_createJiraTicketNoExisting() throws Excepti
     workbenchConfig.egressAlertRemediationPolicy.escalations =
         ImmutableList.of(suspendComputeAfter(1, Duration.ofMinutes(1)));
 
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
 
     ArgumentCaptor<IssueUpdateDetails> captor = ArgumentCaptor.forClass(IssueUpdateDetails.class);
     verify(mockJiraApi).createIssue(captor.capture(), anyBoolean());
@@ -537,7 +545,7 @@ public void testRemediateEgressEvent_commentExistingJiraTicket() throws Exceptio
     workbenchConfig.egressAlertRemediationPolicy.escalations =
         ImmutableList.of(suspendComputeAfter(1, Duration.ofMinutes(1)));
 
-    egressRemediationService.remediateEgressEvent(saveNewEvent());
+    sumologicEgressRemediationService.remediateEgressEvent(saveNewEvent());
 
     ArgumentCaptor<Comment> captor = ArgumentCaptor.forClass(Comment.class);
     verify(mockJiraApi).addComment(captor.capture(), eq("123"));