One protective DNS policy for your head office and all your branches
Each branch adds a router, a switch stack and a set of users your security team rarely sees. Shield answers the DNS lookup before a connection starts, so phishing, malware and command-and-control callbacks stop at the same layer at all your sites. Point your firewall or DHCP at Shield, with no hardware, and set policy by site, VLAN or Entra ID group.
- Staff
- Guest
- IoT
Staff, guest and IoT devices, nothing to install
What is at stake
Branches drift out of policy
Phishing that reaches a branch first
A credential phishing link lands in a branch inbox, where nobody from IT sits. Shield blocks the lookup, so the fake sign-in page never loads.Ransomware calling home
An infected laptop on the branch LAN tries to reach its command-and-control server. Shield blocks the C2 callback and shows you which device made it.Rules that differ by site
Local firewalls end up configured by whoever installed them. One central policy, with site-level exceptions, stops each office drifting into its own rulebook.
How Shield fits
Policy by site, network and Entra ID group
- Corporate LAN and staff WiFiThreat defence first, with domains registered in the last 30 days blocked and Safe Search on Google, Bing and YouTube.
- Entra ID and AD groupsFinance, engineering and contractors each get their own categories and app rules, from Microsoft Entra ID or Active Directory groups.
- Branch sitesEach site inherits the head office policy, with its own allow lists and schedules by time of day and day of week.
- Security operationsStream DNS logs to Splunk, Microsoft Sentinel, Elastic, IBM QRadar or CrowdStrike, and drill from a domain to the devices that queried it.
See everything Shield stopsCompare Shield with Cisco Umbrella
- Staff and head officeThreat defence firstOffice LAN and staff WiFi, by directory group
- Guest WiFiStrict, family-safeVisitors and customers, nothing to installGuest network tiersFree WiFiAd blocking on, streaming limited at busy timesPaid WiFiIts own rules, separate from the free tier
- IoT and branchesLocked downTills, cameras and sensors behind a relay
Schedule, per site
Proof
Earlier warning, lighter traffic and certified controls
- 10 days
- earlier warning of new malicious domains than standard blocklists
- 62%
- fewer DNS queries once ads and trackers are blocked on the network
- ISO 27001certified at Purple, alongside GDPR and CCPA
- Cyber Essentialsheld by Purple, and Shield helps you meet your own Cyber Essentials controls
FAQ
Questions we hear from teams like yours
We use Cisco Umbrella today. How hard is it to move?
You change the DNS forwarders on your firewall or DHCP at each site. Rebuild your policies by site and Entra ID group, then move one branch to Shield first. The 30-day free trial gives you time to compare the reports side by side.
Do we need hardware at each branch?
No. You point the branch router, firewall or DHCP server at Shield and filtering starts. For segmented VLANs, the Shield relay passes each device's internal IP through, so your reports show the laptop or printer that made a lookup rather than the branch's public address.
Can staff bypass it with a VPN or proxy?
One-click app blocking covers VPN and proxy apps, and new-domain rules catch the freshly registered domains that bypass services rotate through. Shield sits behind your firewall, not in place of it, so pair it with an outbound rule that sends all DNS through Shield.
How does Shield fit our SIEM?
Shield streams DNS logs to Splunk, Microsoft Sentinel, Elastic, IBM QRadar, CrowdStrike, Amazon S3 or syslog. Your analysts can match lookups against endpoint and firewall events, and the open API lets you pull data into your own tooling. Admins sign in with Okta, Microsoft Entra ID or OIDC.
What happens if Shield has an outage?
It fails closed, so an outage never leaves a branch unfiltered. Shield runs on a dual anycast DNS network, so if one node or network fails, the next one answers. Shield is a layer behind your firewall rather than a replacement for it, so your existing perimeter controls carry on as before.
Other use cases
Guest WiFi
Family-safe, faster guest WiFi for any venue, with nothing to install on guest devices.School web filtering
Filtering for schools and colleges that helps you meet KCSIE, the DfE standards and CIPA.IoT and OT
Threat defence and allow lists for cameras, tills, sensors and plant equipment that cannot run an agent.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.