A Cisco Umbrella alternative for guest WiFi

Choose Purple Shield if you need protective DNS for anonymous guests on public WiFi. It applies a policy per SSID and VLAN, with no agent and no new hardware. It comes from the platform already running 80,000+ venues in 90 countries. Choose Cisco Umbrella if you are securing named employees and managed devices within a wider SASE programme.

The short answer on Cisco Umbrella alternatives for guest WiFi

Cisco Umbrella is a mature product that solves a different problem. It grew out of OpenDNS, which Cisco acquired in 2015. It now sits within Cisco's secure access service edge (SASE) portfolio, which delivers networking and security together from the cloud. Its home ground is a known workforce: named employees, managed laptops, branch offices and roaming staff, all tied to a directory.

Guest WiFi breaks those assumptions. The people on your network are anonymous and change by the hour. Footfall swings with events and seasons. Visitors install no agent and hold no account in your directory. A licence counted in seats has nothing stable to count.

Purple Shield is protective DNS built for that situation. Protective DNS filters threats and unwanted content when a device looks up a domain name. You set a policy per SSID, per VLAN (virtual LAN, a logically separate network segment) and per venue. Shield runs from the same platform as your captive portal, the sign-in page guests see before they get online.

The answer turns on identity. If the people you protect have accounts you manage, Umbrella's model fits. If they are visitors you cannot name, Shield's model fits. For the full head-to-head, read Shield vs Cisco Umbrella. For the wider market, start with our overview of DNS filtering alternatives.

What we compared Shield and Umbrella on, and why

Why placement comes first

Protective DNS acts when a device asks where a domain lives. That lookup happens before any connection opens. If the domain is malicious or breaks policy, the resolver refuses it and the device never connects. A firewall usually judges traffic after a session starts, and most of that traffic is now encrypted. Filtering at resolution stops phishing, malware and command-and-control domains before they reach the perimeter. The UK National Cyber Security Centre runs its protective DNS service for the public sector on the same principle.

Both Shield and Umbrella filter at the DNS layer. The difference lies in everything wrapped around that layer.

The criteria we scored

We fixed eight criteria before scoring either product. Each option is scored only from its own public material: Cisco Umbrella documentation and Purple's product information.

1. Where filtering happens in the connection.
2. Who the product is built to protect.
3. Whether visitor devices need an agent.
4. The unit a policy attaches to.
5. The licence unit.
6. Whether pricing is published.
7. Scope beyond DNS.
8. Fit with the hardware and guest stack you already run.

We show no competitor prices. Cisco quotes Umbrella through its own team and partners, so any figure would be unverifiable and quickly out of date. If you are weighing other vendors, see DNSFilter alternatives and Cloudflare Gateway vs Purple Shield.

Shield vs Cisco Umbrella: the comparison matrix

The matrix below is the quickest way to see where each product is aimed.

Read it as two products answering two different questions. Umbrella asks who is connecting. Shield asks which network the device is on.

Where Cisco Umbrella wins

If your problem is a workforce, Umbrella covers ground Shield does not attempt to cover.

Identity-led control for your own staff

Umbrella ties policy to people. It integrates with directory services, including Microsoft Entra ID, so you can set rules per person or group. You can report on each employee's activity. Cisco Secure Client carries that protection to laptops off the corporate network, at home or on the road.

Security beyond the DNS layer

DNS is one layer of Umbrella. Depending on package, Cisco adds a secure web gateway (SWG) that inspects encrypted web traffic. It also adds a cloud-delivered firewall and a cloud access security broker (CASB) to govern SaaS use. Those are the building blocks of a SASE programme.

Threat intelligence and the Cisco estate

Umbrella draws on Cisco Talos, Cisco's threat intelligence group. Cisco documents native Umbrella integrations with Cisco Meraki and other Cisco networking. If your security operations team already works in Cisco consoles, standardising on one vendor has real value.

For a managed workforce, Umbrella is a credible choice, and this guide does not argue otherwise.

Where Shield wins on guest WiFi

Built for visitors you cannot name

Shield assumes nothing about the person on the network: no account, no agent, no enrolment. The policy belongs to the network. Each SSID, VLAN and venue gets its own rules from one dashboard. A hotel could run a family-safe policy on its lobby SSID and a lighter one on its conference VLAN.

Agentless protective DNS, no new hardware

You point the network's DNS at Shield, and the policy applies to every device that joins. That covers a guest's phone, a laptop and a smart TV that could never run an agent. Shield works on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet networks. Run it standalone on any WiFi, or add it to Purple Access as a guest WiFi security add-on.

One platform for the whole guest stack

Purple already runs captive portals and Guest WiFi analytics across 80,000+ venues in 90 countries. Shield adds protection inside that same platform. The team that manages guest sign-in also sets security policy, so you replace a separate console with one dashboard.

Earlier threat flags and lighter networks

Shield flags malicious domains at DNS resolution before connections open, stopping threats before traffic reaches the network. With ad blocking enabled, Shield suppresses unwanted advertising requests and tracking queries. On a busy venue network, that capacity goes back to the guests you are serving.

What each costs to run: licensing structure, not price

This section shows no prices. What you can compare is structure: what you count, what grows the bill, and what work sits outside the licence.

Umbrella: seats sized to a workforce

Umbrella packages are licensed per seat, typically sized to your number of named employees. That suits a business with a stable headcount. It sits awkwardly on a stadium concourse or in a shopping centre. There, fan and shopper numbers rise and fall with every fixture and season.

Endpoint work adds cost of its own. Per-person policy and roaming protection depend on rolling out Cisco Secure Client to managed devices. Someone has to maintain that rollout.

Shield: no guest seats to count

Shield has no per-guest seat. You buy it as a security add-on to the Connect, Capture or Engage plans, or standalone on any WiFi. Guests install nothing, so there is no endpoint rollout. The Shield pricing page sets out current terms, so you can budget before a sales call.

How much effort is a move from Umbrella to Shield?

A move is a configuration change per guest network, not a hardware project. Most estates follow four steps.

Map what Umbrella does today

List every network that resolves through Umbrella and who uses it. Separate staff networks from guest and public SSIDs. Staff networks that rely on the web gateway or CASB usually stay on Umbrella.

Move guest networks first

Create a Shield policy for each guest SSID or VLAN. Agree the content categories with venue operations before you switch. Then change the DNS each guest network hands out, usually through DHCP on your controller or gateway. Your hardware vendor's documentation covers the exact steps for your platform.

Close the bypass routes

Run in parallel, then cut over

Test from a guest device on each SSID and check the blocks appear in the Purple dashboard. Move venues in waves, starting with a single site. Once guest traffic flows through Shield, remove the guest egress networks from your Umbrella configuration.

How to decide between Shield and Umbrella

Use one question as your decision rule: does every person on this network hold an account you manage? If yes, an identity-led product like Umbrella fits. If no, choose Shield.

Many estates run both: Umbrella on staff devices, Shield on guest SSIDs. Your next step is to price your guest networks on the Shield pricing page. Then read our enterprise WiFi security guide for the segmentation that sits beneath it. You can find more on the wider platform at Purple.