Moving off Cisco Umbrella? Compare Purple Shield first
Cisco has announced end of sale for Umbrella SIG and DNS, and its DNS security now continues as Secure Access DNS Defense. If your next renewal means a migration anyway, it is worth comparing. Purple Shield blocks the same threats at the lookup, strips ads and trackers, and sets a policy per SSID, VLAN and site from the platform that runs your WiFi.
- news.exampleGuestAllowed
- casino-bonus.exampleGuestBlocked
- ads.tracker.exampleGuestStripped
- c2-callback.exampleHQ LANBlocked
- bookings.exampleBranchAllowed
- phish-login.exampleBranchBlocked
- video.exampleBranchAllowed
- malware-cdn.exampleGuestBlocked
- news.exampleGuestAllowed
- casino-bonus.exampleGuestBlocked · Gambling
- ads.tracker.exampleGuestStripped · Ads
- c2-callback.exampleHQ LANBlocked · Command and control
- bookings.exampleBranchAllowed
- phish-login.exampleBranchBlocked · Phishing
- video.exampleBranchAllowed
- malware-cdn.exampleGuestBlocked · Malware
- 241k
- threats blocked a week at St George's
- 10 days
- earlier warning than standard blocklists
- 500%
- faster page loads with ads stripped
Why teams choose Shield
Why teams choose Shield instead of Umbrella
One platform for WiFi and DNS
Shield sets a policy per SSID, VLAN, site and time of day from Purple Access, the platform that already runs your guest and staff WiFi.
Ad and tracker blocking built in
Shield strips ads and trackers at the lookup. In Purple's own measurements that means up to 44% less data used and up to 500% faster page loads.
Guest WiFi standards covered
Filtering meets the Internet Watch Foundation bar and the Friendly WiFi standard, so guest and public networks stay family-safe with nothing to install on guest devices.
Side by side
Purple Shield and Cisco Umbrella, side by side
| What matters | Purple Shield | Cisco Umbrella |
|---|---|---|
| Product lifecycle | Purple ShieldCurrent product, sold standalone or added to Purple Access, Purple's WiFi platform. | Cisco UmbrellaUmbrella SIG and DNS move to Cisco Secure Access. End of sale 31 January 2027, support ends 31 January 2029. |
| Threat blocking | Purple ShieldPhishing, malware, ransomware, botnet and C2 domains, with new threats flagged up to 10 days before blocklists. | Cisco UmbrellaPhishing, malware, botnets and high-risk categories such as cryptomining and newly seen domains, backed by Cisco Talos. |
| Content filtering | Purple Shield40+ categories, Safe Search on Google, Bing and YouTube, and one-click app blocking. | Cisco Umbrella100+ content categories, with custom block and allow lists. |
| Ad and tracker blocking | Purple ShieldBuilt in. Up to 62% fewer DNS queries and 20 to 40% less web traffic, by Purple's measurements. | Cisco UmbrellaAn Advertisements content category that you can block like any other category. |
| Policy by WiFi network | Purple ShieldPer SSID, VLAN, site and time of day, set from the platform that runs your WiFi. | Cisco UmbrellaPolicy by network and identity, with integrations for Meraki, Cisco routers and Cisco Secure Firewall. |
| On-network deployment | Purple ShieldPoint the router, firewall or DHCP at Shield, with no hardware. A relay shows internal IPs on VLANs. | Cisco UmbrellaPoint any router or DHCP server at the DNS Defense address. Virtual appliances add internal IP and AD visibility. |
| Roaming devices | Purple ShieldNo endpoint client. Shield covers every device on the networks you run, with nothing to install on it. | Cisco UmbrellaRoaming module in Cisco Secure Client. The standalone Umbrella roaming client reached end of support in April 2025. |
| Integrations | Purple ShieldSSO with Okta, Entra ID or OIDC. Logs to Splunk, Sentinel, Elastic, QRadar, CrowdStrike, S3 or syslog. Open API. | Cisco UmbrellaFull API, log export and identity-based policy. Integrates with Splunk, Cisco XDR and Security Cloud Control. |
| Pricing and trial | Purple ShieldNo published price. 30-day free trial. | Cisco UmbrellaNo published price. Free trial offered. Cisco Secure Access is licensed per covered user. |
Competitor details from Cisco's public product, ordering and end-of-life pages, checked October 2026.
Switching
How moving from Umbrella to Shield works
Run Shield beside Umbrella
Point one site, SSID or VLAN at Shield while the rest stay on Umbrella. Compare what each one blocks on live traffic.
Mirror your policies
Recreate your Umbrella categories, block and allow lists and group rules in Shield. Entra ID or Active Directory groups carry across.
Cut over site by site
Change the resolver on each router, firewall or DHCP scope in turn. Each site moves on its own, so you can switch one back in minutes.
Retire the old resolver and client
Once every site points at Shield, stop sending DNS to Umbrella and remove the Umbrella module from Cisco Secure Client. Shield needs no client, so devices away from your networks rely on your endpoint protection.
Questions about Shield and Cisco Umbrella
Is Cisco Umbrella being discontinued?
Cisco has announced end of sale for Umbrella SIG and DNS on 31 January 2027. The last renewals are on 31 January 2028 and support ends on 31 January 2029. Cisco's DNS security continues as Secure Access DNS Defense, and existing subscriptions run to Cisco's published milestones.
What happened to the Umbrella roaming client?
Cisco ended support for the standalone Umbrella roaming client on 2 April 2025. Its features now live in the Umbrella roaming security module of Cisco Secure Client. Shield has no roaming client. It protects every device on the networks you run, with nothing to install, so devices away from those networks need the endpoint protection you already run.
Does Shield block the same threats as Umbrella?
Shield blocks phishing, malware, ransomware and botnet domains, and C2 callbacks, at the lookup. Its machine learning flags new malicious domains up to 10 days before standard blocklists. You can also block domains registered in the last 7 or 30 days, block by country or top-level domain, and validate DNSSEC.
Can we keep policy by Active Directory group?
Yes. Shield applies policy per user or group through Microsoft Entra ID or Active Directory, and supports single sign-on with Okta, Entra ID or OIDC. You can also set policy per SSID, VLAN, site and time of day, which suits sites that run guest and staff WiFi side by side.
Can we run Shield and Umbrella at the same time?
Yes. Point one site, SSID or VLAN at Shield while everything else stays on Umbrella, then compare results on real traffic. The 30-day free trial covers that test, and nothing needs installing on guest devices on the network.
Other comparisons
Shield vs Cloudflare Gateway
Purple Shield vs Cloudflare Gateway for protective DNS
Gateway is sold as part of Cloudflare's Zero Trust plans. See how Shield compares for DNS on every network.Shield vs Infoblox
Purple Shield vs Infoblox Threat Defense, formerly BloxOne
Threat Defense pairs with Infoblox DDI. See how Shield compares, starting with one resolver change.See how Shield compares
Shield against a firewall on its own
Not replacing a DNS filter? See what Shield adds behind the firewall you already run.
Sources
- Cisco: Umbrella SIG and DNS end-of-sale and end-of-life announcement
- Cisco: plan for Umbrella roaming client end of life
- Cisco: Secure Access DNS Defense at a glance
- Cisco Umbrella: DNS Security Essentials package
- Cisco Umbrella: enterprise security packages
- Cisco Secure Access ordering guide
- Cisco Umbrella docs: content category changes
- Cisco Secure Access docs: AD integration with virtual appliances
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.