DNS security for IoT and OT devices that can never run an agent
Cameras, payment terminals, building management controllers and plant sensors run firmware you cannot patch on your schedule and accept no software you install. Shield protects them at the DNS lookup instead. The relay sits on your segmented VLANs so you see each device by internal IP, lock-down policies allow only the domains a device needs, and command-and-control callbacks are blocked before they connect.
What is at stake
Devices you cannot patch or install on
Compromised cameras
An IP camera with default credentials joins a botnet and calls home. Shield blocks the C2 lookup and names the device by its internal IP.Payment terminals and tills
A card terminal should talk to its payment provider and little else. Any other lookup is a warning sign worth blocking.Building and plant systems
Building management, medical and plant equipment often runs old firmware. A new-domain rule stops it reaching domains registered last week.
How Shield fits
Lock each device class down to what it needs
- Cameras and NVRsAn allow list of the vendor's cloud and update domains. All other lookups are blocked and logged by device.
- Tills and payment terminalsPayment provider and ePOS domains only, on their own VLAN, to support your PCI DSS segmentation.
- Building management and OTBMS, HVAC and plant controllers reach named vendor domains only, with domains under 30 days old blocked.
- Medical and sensor fleetsThreat defence, DNSSEC validation and geographic blocking for patient monitors and environmental sensors.
- Staff and head officeThreat defence firstOffice LAN and staff WiFi, by directory group
- Guest WiFiStrict, family-safeVisitors and customers, nothing to installGuest network tiersFree WiFiAd blocking on, streaming limited at busy timesPaid WiFiIts own rules, separate from the free tier
- IoT and branchesLocked downTills, cameras and sensors behind a relay
Schedule, per site
Proof
Earlier warning and certified controls
- 10 days
- earlier warning of new malicious and C2 domains than standard blocklists
- ISO 27001certified at Purple, alongside GDPR and CCPA
- Cyber Essentialsheld by Purple, the UK government-backed scheme for baseline security controls
FAQ
Questions we hear from teams like yours
How does Shield see individual devices on a segmented network?
Deploy the relay on your segmented VLANs. It forwards lookups to Shield with each device's internal IP, so reports and drill-downs show the camera or terminal that made a query, not just the network's public address.
Will an allow list break firmware updates?
Not if the vendor's update domains are on it. Use the reports to see which domains each device class looks up, build the allow list from that, and add the update domains before you lock the class down. Drill-down shows you any device that hits a block.
Does Shield replace our OT firewall or segmentation?
No. Shield is a layer behind your firewall and your segmentation. It stops a device resolving a malicious or unexpected domain, so a C2 callback fails before a connection starts, and it gives your SOC the lookup trail through Splunk, Microsoft Sentinel or syslog.
What happens if Shield is unavailable?
Shield runs on a dual anycast DNS network, so if one node or network fails, the next one answers. It fails closed, so an outage never leaves a device network unfiltered. Plan that with your OT engineers, because a device that cannot resolve a domain cannot reach its vendor cloud either.
Does it help with PCI DSS for payment terminals?
It helps you meet the network controls around them. Lock terminals to their payment provider's domains on a dedicated VLAN, block everything else, and stream the logs to your SIEM as evidence. Shield supports the controls you already run rather than making you compliant on its own.
Other use cases
Offices and branches
Threat defence for head office and branch networks, wired and wireless, under one policy.Guest WiFi
Family-safe, faster guest WiFi for any venue, with nothing to install on guest devices.School web filtering
Filtering for schools and colleges that helps you meet KCSIE, the DfE standards and CIPA.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.