Threat defence for head office, branches and every staff network
Your staff work across head office, regional branches and shared floors, and each network is a way in for phishing. Shield checks each DNS lookup against your policy before a connection starts, blocking phishing, malware and command-and-control callbacks. A relay names each device on segmented VLANs, Entra ID groups set the rules, and the logs stream to your SIEM.
- Staff
- Guest
- IoT
Staff, guest and IoT devices, nothing to install
What is at stake
One estate, spread across offices, floors and networks
Phishing outside the mail filter
A link sent by text, Teams chat or LinkedIn message never passes the mail gateway. The first control it meets is the DNS lookup.Office IoT nobody watches
Printers, meeting room screens and door access controllers run old firmware, and few teams can see what they look up.Branches with no IT on site
Regional offices run on a small router with nobody local to check it, so an infected device can call home unnoticed.
How Shield fits
A policy per network, group and device
- Staff LAN and WiFiThreat defence first: phishing, malware, ransomware and C2 blocked, and domains registered in the last 30 days held back.
- Printers and office IoTMeeting room screens, printers and door access behind a relay, so each device's internal IP shows in reports.
- Entra ID groupsFinance, engineering and contractors each get their own rules, including which generative AI apps they can use.
- Visitor WiFiThreat blocking, content categories and Safe Search, with nothing to install on visitor devices.
See everything Shield stopsCorporate offices WiFi on Purple Access
Blocked at the lookup
- Command-and-control callback
- Phishing domain
- Malware domain
- Newly flagged domain
Proof
Earlier warning, and standards you can point to
- 10 days
- earlier warning of new malicious domains than standard blocklists
- 62%
- fewer DNS queries once ads and trackers are blocked, by Purple's own measurement
- ISO 27001certified, alongside Cyber Essentials, GDPR and CCPA
FAQ
Questions we hear from teams like yours
We run Cisco Umbrella today. What does moving to Shield involve?
Point your DNS forwarders or DHCP at Shield and map your Entra ID or Active Directory groups to policies. Logs go to the same SIEM. Shield covers devices on your networks, so laptops away from the office stay with the endpoint protection you already run. The 30-day free trial lets you run one office in parallel first.
Does Shield replace our firewall?
No. Shield is a layer behind the firewall. It stops a lookup to a phishing, malware or C2 domain before any connection starts, and the relay shows which device on a segmented VLAN made the lookup.
Can we send Shield logs to our SIEM?
Yes. Shield streams DNS logs to Splunk, Microsoft Sentinel, Elastic, IBM QRadar, CrowdStrike, Amazon S3 or syslog, and has an open API. Your analysts can drill from a domain to each device that looked it up.
Can staff get round it with a VPN or a proxy?
One-click app blocking covers VPN and proxy apps, so you can block the consumer services staff use to route round the policy. Pair it with an outbound firewall rule that sends all DNS through Shield.
What happens to our offices if Shield has an outage?
Shield runs on a dual anycast DNS network, so if one node or network fails, the next one answers. It fails closed, so an outage never leaves a network unfiltered. There is no appliance at each office to maintain or replace, because each site points its firewall or DHCP at Shield.
Other industries
Financial services
Threat defence for branches, trading floors and remote advisers, with evidence for FCA, DORA and PCI DSS.Manufacturing
Ransomware and C2 blocked at the lookup on OT, IoT and office networks, with each device visible by internal IP.Small business
Phishing and ransomware blocked at the lookup on the office router and customer WiFi, with no IT team needed.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.