Shield vs Cisco Umbrella: choosing protective DNS for guest WiFi

Choose Shield for guest WiFi across multi-site estates requiring rapid deployment without hardware, agents, or per-seat fees. Choose Cisco Umbrella when protecting corporate endpoints and building a SASE stack. Purple integrates with platforms like Cisco Meraki and aligns with standards such as Keeping Children Safe in Education, supported by ISO 27001 certification.

Which should you choose: Shield or Cisco Umbrella for guest WiFi?

The right choice depends on who you protect. Ask whether they are your employees or the public walking through your doors.

Cisco Umbrella began as OpenDNS before being acquired by Cisco. It has grown into a security service edge platform for corporate networks and hybrid workforces. It protects people Cisco can count, name and attach a policy to, wherever their laptop goes.

Shield is Purple's protective DNS service for guest and public networks. You switch it on per SSID (the network name a device joins). It filters threats and unsuitable content, and it blocks ads for everyone on that network. Nobody has to install anything. Nobody has to be counted.

Both services do the same core job. Protective DNS is a resolver that checks every domain lookup against threat and content lists. It refuses to answer for blocked domains, so the device never connects. The differences sit around that core: how you buy it, how you deploy it, and what else comes with it.

If you run guest WiFi in hotels, shops, stations, schools or clinics, you are usually buying for a crowd, not a headcount. That is the lens for the rest of this guide.

Where Shield and Cisco Umbrella genuinely differ

Where the filtering happens, and what a firewall misses

Both services act at the DNS lookup. When a phone wants to open a site, it first asks a resolver for the domain's IP address. A protective DNS resolver checks the domain before it answers. If the domain is malicious or blocked by policy, the lookup fails and no connection opens. For the mechanics, see What Is a DNS Lookup and Why Networks Use It.

A firewall works later in the sequence. It inspects traffic after a connection has started. Most web traffic now uses TLS encryption, so a firewall without decryption sees an IP address and little else. Decrypting guest traffic is impractical in any case. You cannot install a root certificate on a visitor's personal phone.

IP-based blocking also struggles with shared hosting. Multiple domains can sit behind one content delivery network address. Block the IP and you break legitimate sites. Allow it and the malicious domain gets through.

DNS sees the domain name itself, before any data moves. That is why protective DNS suits open networks you do not own the devices on.

Be clear about the limits too. DNS filtering decides per domain, not per page. It cannot block one path on an otherwise allowed site. Devices that use encrypted DNS, such as DNS over HTTPS (DoH), can try to bypass your resolver. Our explainer on DNS Over HTTPS Explained: Privacy vs Public WiFi Filtering covers how operators handle that.

Licensing unit: seats versus networks

This is the difference that matters most for guest WiFi.

Cisco does not publish list pricing for Umbrella. You buy through Cisco sales or a reseller, against a quote. Packages include DNS Security Essentials, DNS Security Advantage, SIG Essentials and SIG Advantage, each with different capabilities and term options.

Umbrella is licensed per seat. That model fits a business with a known employee count. It fits poorly when your network serves a small crowd on a quiet day and thousands of visitors on a peak event day. Ask your reseller how guest networks count against seats. The answer shapes the whole quote.

Shield is scoped to the network instead. You enable it on the SSIDs you want protected. A busy weekend does not change what you count.

Deployment effort

Umbrella offers several deployment paths. You can point network DNS at Umbrella and register your egress IP addresses. You can add virtual appliances to attribute internal IP addresses. You can deploy the roaming module in Cisco Secure Client on managed laptops. That flexibility is a strength for corporate IT. It is also more to design, document and maintain.

Shield deploys per SSID in minutes with no hardware and no agents. Purple is hardware-agnostic and runs as a cloud overlay. It works with Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. Your existing access points stay in place.

Ad blocking and guest experience

Ad blocking is a guest-network feature, not a corporate one. Shield blocks ad and tracker domains at the lookup, so pages load lighter on shared bandwidth.

By blocking ads and tracking domains at the resolver level, Shield delivers faster page load times, reduced data usage, and fewer DNS queries while lowering overall web traffic volume. On a congested hotel network or a train running on cellular backhaul, that is capacity you get back without new hardware.

Umbrella is not positioned as an ad-blocking product. You can block chosen domains through its destination lists, but that is a manual list you maintain.

Threat detection

Umbrella draws on Cisco Talos, one of the largest commercial threat intelligence teams. That depth is a genuine strength.

Shield flags emerging phishing and malware domains early, helping protect unmanaged guest devices that you cannot patch. For a wider view of the options, see Phishing Protection Software Options for Shared WiFi.

Family-safe filtering standards

Public WiFi in places where children connect carries extra duties. Schools in England must meet the Department for Education's filtering and monitoring standards under Keeping Children Safe in Education. Venues often look to the UK's Friendly WiFi scheme as a public signal of safe browsing.

Both services filter by content category. Ask each vendor how its categories map to the standard you answer to. Ask for evidence, not a yes.

Side-by-side comparison

Criterion	Shield	Cisco Umbrella
Design centre	Guest and public WiFi	Corporate endpoints and hybrid workforce
Where filtering happens	DNS lookup, before connection	DNS lookup, plus web proxy in SIG packages
Published pricing	Scoped to sites and SSIDs, quoted by Purple	No list pricing; quote via Cisco or reseller
Licence unit	Per SSID	Per seat
Deployment for a guest SSID	Minutes, per SSID	Register networks and DNS; appliances optional
Extra hardware	None	None for DNS; virtual appliances for internal attribution
Agents on devices	None	Cisco Secure Client for off-network protection
Ad blocking	Built in	Manual, through destination lists
Off-network protection	Not applicable to guest devices	Yes, through the roaming module
Wider security stack	DNS layer, with Purple SecurePass and Verify add-ons	SWG, CASB, FWaaS, ZTNA in higher packages
Best fit	Multi-site guest estates with variable footfall	Organisations protecting named staff everywhere

When is Shield the right call?

Shield fits when your network serves people you do not employ and cannot count in advance. Several situations make the case clearly.

You run guest WiFi across many sites

A multi-site estate needs the same policy everywhere and one place to manage it. With Shield, the unit of deployment is the SSID. Rolling out to a new hotel, store or station is a configuration change, not a procurement event. You see every site through the same Purple platform that runs your Guest WiFi.

Your footfall swings by season or by event

Holiday parks, stadiums, shopping centres and visitor attractions see attendance multiply on peak days. Seat-based licensing forces you to guess that peak and pay for it all year. Network-scoped protection removes the guess.

You cannot touch the devices

Guests, shoppers, passengers and patients bring their own phones. You cannot install an agent on them and should not try. DNS-level protection works for every device that joins the SSID, with nothing to install.

Bandwidth is tight or metered

Ad blocking pays for itself where backhaul is scarce. Trains on cellular links, temporary event sites and rural venues all fit. Reducing unnecessary web traffic reclaims capacity without requiring new circuits.

When is Cisco Umbrella the right call?

Umbrella is the stronger choice in several situations, and an honest comparison should say so.

You are protecting a corporate workforce

If your priority is staff laptops in the office, at home and on the road, Umbrella is built for that. The roaming module keeps policy in place off-network. Policy ties to identities from your directory, including Microsoft Entra ID and Okta.

You want a path to SASE

Secure access service edge (SASE) combines networking and security in one cloud service. Umbrella's higher packages extend from DNS security into a secure web gateway (SWG) that proxies and inspects web traffic. They add a cloud access security broker (CASB), which governs use of cloud apps. They also include firewall as a service (FWaaS) and, through Cisco's wider portfolio, zero trust network access (ZTNA) for private applications. If you are consolidating that stack, a guest-only DNS service will not replace it.

You are standardised on Cisco security

Organisations already running Cisco security tooling gain from shared threat intelligence through Talos. They also gain from single-vendor support and an existing reseller relationship.

You need page-level inspection on managed devices

DNS decides per domain. If policy requires inspecting individual URLs or file downloads on corporate devices, you need a proxy. Umbrella's SIG packages provide one. That makes sense on devices you own and manage. It rarely makes sense on guest phones.

What do Shield and Cisco Umbrella cost to run?

List price is only one line. Total cost comes from several components.

Licence cost

Umbrella's cost depends on package, seat count, term and reseller margin. Because pricing is quote-only, you cannot forecast it from a website. You need a sales conversation and a defensible seat number. For guest WiFi, that number is the hardest thing to produce.

Shield's cost scales with the sites and SSIDs you protect. You can forecast it from your estate list. Request current pricing from Purple through the Shield page.

Deployment and maintenance time

Umbrella's network deployment is straightforward for DNS alone. Each additional component adds design and upkeep: virtual appliances, roaming clients, proxy chaining and certificate management. For corporate IT with a security team, that is normal work. For a venue operator with one network administrator, it is a real cost.

Shield adds no hardware and no agents. You configure it per SSID and manage policy centrally.

Bandwidth recovered

Ad blocking shows up on your bandwidth bill. Ad blocking reduces overall data consumption and web traffic volume with Shield. On metered links, compare that against your monthly overage spend.

Risk carried

Count the risk you carry when filtering is missing. That includes malware reaching the network, complaints about unsuitable content, and failed safeguarding reviews. Both services reduce that risk. The question is which one you can afford to run on every guest SSID, at every site, all year.

How do you decide for your estate?

Start with key questions. Who connects: staff you can name, or the public? Where do they connect: managed laptops anywhere, or personal devices on your premises? What do you need beyond DNS: a SASE roadmap, or protection and faster pages on guest networks?

Decision matrix

Your situation	Recommendation
Guest WiFi only, multi-site, variable footfall	Shield
Corporate laptops off-network, named staff	Cisco Umbrella
Guest and staff networks, separate SSIDs	Shield on guest SSIDs, Umbrella on corporate
Consolidating SWG, CASB and FWaaS	Cisco Umbrella
Metered or cellular backhaul	Shield, for ad blocking
Children present, family-safe filtering needed	Shield on public SSIDs, mapped to your standard
MSP managing many small venues	Shield, per-SSID scoping per client site

Worked scenario: hotel group with seasonal occupancy

Situation. A hotel group ran Umbrella for head-office laptops. Its security lead asked the reseller to extend it to guest WiFi. The quote required a guest seat estimate. Occupancy varied widely from low season to peak summer, plus conference peaks. Nobody could defend a single number.

What was done. The group kept Umbrella on corporate devices. It enabled Shield on the guest SSID across all hotels during one change window, using the same Purple platform that runs its captive portal. The captive portal is the sign-in page guests see when they join. No hardware shipped to any site and no guest installed anything.

Outcome. The group protected its guest networks with zero agents and zero new hardware. It removed the seat forecast from the guest budget entirely. Its network team established a baseline for guest web traffic and measured noticeable bandwidth savings. The result gave the network team clear evidence to report at the next capacity review.

Worked scenario: council libraries and leisure centres

Situation. A local council ran public WiFi across its libraries and leisure centres. Children used both. The council needed family-safe filtering and wanted every site under one policy. Its network administrator could not maintain roaming clients or appliances.

What was done. The council enabled Shield on the public SSID at each site and applied one family-safe policy. Staff devices stayed on a separate SSID under existing corporate controls. The network team blocked known DoH endpoints on the public VLAN, the virtual network segment that keeps public traffic apart from staff traffic. That stopped devices from bypassing the resolver.

Outcome. All sites ran one policy, managed from one place, with no software on visitors' devices. The council could show its safeguarding lead a single, documented filtering configuration. The DoH block closed the most common bypass route on the public network.

Worked scenario: festival on cellular backhaul

Situation. A festival offered attendee WiFi over bonded cellular links. Data was metered, and previous events saw links saturate during peak hours.

What was done. The organiser enabled Shield on the attendee SSID before gates opened. Ad and tracker domains were blocked at the lookup, along with known phishing domains targeting ticket and payment pages.

Outcome. The organiser compared data use against the previous baseline, achieving faster page loads and lower data consumption. Licensing a festival crowd per seat would have meant forecasting attendance before tickets sold out.

Questions to put to both vendors

• How is a guest network counted for licensing, and what happens on a peak day?
• How long does deployment take for one SSID, and what has to be installed?
• How do your content categories map to the family-safe standard we answer to?
• How do you handle devices using DNS over HTTPS?
• Where are query logs stored, for how long, and under what certification?

If DNSFilter is also on your shortlist, read Shield vs DNSFilter: a protective DNS comparison for WiFi operators. For more decision guides, browse All guides.

Frequently asked questions

Is there a Cisco Umbrella alternative for guest WiFi?

Yes. Shield is Purple's protective DNS service built for guest and public WiFi rather than corporate endpoints. You enable it per SSID in minutes, with no hardware and no agents on visitor devices. It filters threats and unsuitable content and blocks ads at the DNS lookup. Many organisations keep Umbrella on staff devices and run Shield on guest networks. Each tool then does the job it was designed for.

How is Cisco Umbrella priced for guest WiFi?

Cisco Umbrella has no published list price. You buy through Cisco sales or a reseller against a quote, across packages such as DNS Security Essentials, DNS Security Advantage, SIG Essentials and SIG Advantage. Licensing is per seat. For guest WiFi, ask how anonymous visitors count against seats before you accept a quote. Seasonal or event-driven footfall makes that number hard to forecast and harder to defend.

Is Umbrella overkill for public WiFi filtering?

Often, yes, if guest networks are all you need to protect. Umbrella's strengths are roaming protection for managed laptops, identity-based policy and a path into SWG, CASB, FWaaS and ZTNA. Guest devices use none of those. For public WiFi, the core need is DNS-level threat and content filtering on every device that joins. Shield delivers that per SSID without seat counts or agents.

Does Shield work with our existing access points?

Yes. Purple is hardware-agnostic and runs as a cloud overlay on the network you already own. It works with Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. Shield acts at the DNS layer, so you configure it per SSID with no new hardware. Your access points, switches and controllers stay in place.

Can we run Shield and Cisco Umbrella side by side?

Yes, and for mixed estates it is often the cleanest design. Keep Umbrella on corporate SSIDs and managed laptops, where seat licensing and roaming protection fit. Run Shield on guest and public SSIDs, where the people connecting are anonymous and variable. Separate SSIDs and VLANs keep the two policies apart. Each network then uses the resolver suited to the people on it.

How long does Shield take to deploy?

Minutes per SSID. Shield needs no hardware and no software on visitor devices, so deployment is a configuration change rather than a project. A multi-site estate can protect every guest network in one change window. Purple's support documentation covers the configuration steps for your hardware. Policy is managed centrally once each SSID is live.

How does protective DNS affect GDPR and data handling?

Treat DNS query logs as personal data where they can be linked to a device, and set retention to match. Purple holds ISO 27001 certification and is GDPR compliant, and Shield sits within that framework. For any vendor, ask where logs are stored, how long they are kept and who can access them. Then record the answers in your data protection impact assessment.

Can visitors bypass DNS filtering on guest WiFi?

Some can try, mainly by using DNS over HTTPS or a VPN that sends lookups to another resolver. You reduce this by blocking known DoH endpoints and public resolvers on the guest VLAN. That forces lookups through your protective DNS service. No DNS filter stops every determined bypass. Combined with network controls, it covers most visitors on most devices.