How Purple Shield compares with other protective DNS services
Every protective DNS service blocks bad domains. The differences sit in how each one is packaged, deployed and run day to day. These pages set Purple Shield next to Cisco Umbrella, Cloudflare Gateway and Infoblox Threat Defense, using each vendor's own public pages. Where the products do the same job, we say so.
- Staff
- Guest
- IoT
Staff, guest and IoT devices, nothing to install
Choose a comparison
Shield vs Cisco Umbrella
Moving off Cisco Umbrella? Compare Purple Shield first
Umbrella DNS is moving to Cisco Secure Access. See how Shield compares before you migrate.Shield vs Cloudflare Gateway
Purple Shield vs Cloudflare Gateway for protective DNS
Gateway is sold as part of Cloudflare's Zero Trust plans. See how Shield compares for DNS on every network.Shield vs Infoblox
Purple Shield vs Infoblox Threat Defense, formerly BloxOne
Threat Defense pairs with Infoblox DDI. See how Shield compares, starting with one resolver change.
Compare
How Shield compares with Cisco Umbrella and the rest
All of them filter DNS. Shield adds ad blocking that makes the network faster, a policy per SSID and site from the platform that can run your WiFi too, and a 30-day trial on your own network.
| Compared with | Where Shield wins | What it is |
|---|---|---|
| Cisco Umbrella | Where Shield winsThreat defense, app control, directory-group policy and SIEM logs, with ad blocking included and live in minutes | What it isUmbrella DNS reaches end of sale in January 2027, moving customers to Cisco Secure Access |
| Cloudflare Gateway | Where Shield winsProtective DNS as a product in its own right, with a policy per SSID, VLAN and venue | What it isDNS filtering inside Cloudflare's wider Zero Trust platform |
| Legacy filtering appliance | Where Shield winsNo hardware, no firewall change, and it fails closed on a dual anycast network | What it isA box at every site that inspects traffic at the network edge |
Behind your firewall
A firewall on its own, or a firewall with Shield behind it
Shield does not replace your firewall. It closes the gaps a firewall leaves: the lookup before the connection, the encrypted traffic it cannot read, and the device no agent reaches.
| What matters | Firewall with Shield | Firewall on its own |
|---|---|---|
| When a bad domain is stopped | Firewall with ShieldAt the lookup, before the connection starts | Firewall on its ownOnce a connection has started |
| Encrypted traffic | Firewall with ShieldThe lookup still names the domain, so a bad one is blocked | Firewall on its ownLittle to inspect without decrypting the traffic |
| Guest and IoT devices | Firewall with ShieldCovered at the network, with nothing to install | Firewall on its ownOut of reach of an endpoint agent |
| New threats | Firewall with ShieldFlagged up to 10 days before standard blocklists | Firewall on its ownCaught when the blocklist catches up |
| Page speed | Firewall with ShieldUp to 500% faster page loads with ads stripped | Firewall on its ownAds and trackers still load |
| Policy | Firewall with ShieldPer network, VLAN, site, group and time of day | Firewall on its ownDepends on the hardware at each site |
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.