Protective DNS for airport staff, operational and passenger networks
An airport runs dozens of networks at once: check-in desks, baggage systems, security staff, concessions and thousands of passengers a day. Shield checks each DNS lookup against your policy before a connection starts, so phishing, malware and command-and-control callbacks stop at the first step. Operational VLANs get threat-first rules, and passengers get family-safe WiFi without the ads. AGS Airports protects passengers at Aberdeen, Glasgow and Southampton with Shield.
- Anycast node 1
- Anycast node 2Offline
- Anycast node 3
What is at stake
One airport, dozens of networks to defend
Phishing aimed at airport staff
A credential lure opened on a dispatch or ground-handling device can reach the systems that keep flights moving. Shield blocks the domain before the page loads.IoT on operational VLANs
Baggage controllers, CCTV and flight information displays rarely take an agent. An infected one can call home without anyone noticing.Passengers on unknown devices
Thousands of unmanaged phones and laptops share the passenger network each day, and some arrive already infected and calling home.
How Shield fits
A policy for each network in the terminal
- Operations and staffThreat defense first, new-domain blocking and C2 callbacks stopped, with users mapped from Microsoft Entra ID or Active Directory.
- Baggage, CCTV and FIDSLocked down through the relay to the domains each system needs, with geographic and TLD blocking on top.
- Concessions and retailCard terminals and tenant back offices on their own VLAN, with threat-first rules that help you meet PCI DSS.
- Passenger WiFiFamily-safe categories, Safe Search and ad blocking, behind a branded block page. Nothing to install on passenger devices.
Ads, trackers and bloatware load on every page
Ads and trackers stripped before they load
Proof
Passengers protected at three UK airports
- 10 days
- earlier warning of new malicious domains than standard blocklists
- 62%
- maximum reduction in DNS queries once ads and trackers are blocked
- AGS Airportsprotects passengers at Aberdeen, Glasgow and Southampton with Shield
- ISO 27001and Cyber Essentials, both held by Purple, the company behind Shield
FAQ
Questions we hear from teams like yours
Can staff or passengers bypass Shield with a VPN?
One-click app blocking covers VPN and proxy apps, so you can stop them on staff and operational networks. On passenger WiFi you decide whether to allow them. Pair Shield with a firewall rule that only lets DNS reach Shield, so devices cannot quietly switch to another resolver.
What happens to the terminal if Shield has an outage?
Shield runs on a dual anycast DNS network, so if one node or network fails, the next one answers. It also fails closed, so an outage never leaves an operational or passenger network unfiltered. Your firewall stays where it is; Shield is a layer behind it, not a replacement.
Do we need new hardware in the terminal?
No. Point your router, firewall or DHCP at Shield and the network is covered. Add a relay where segmented VLANs, such as baggage or CCTV, need each device's internal IP in the reports. Nothing installs on passenger devices.
Does it help with NIS and Cyber Assessment Framework reviews?
Shield gives you evidence for them. Dashboards drill down from a domain to each device that looked it up, scheduled PDF reports go to your security lead, and logs stream to Splunk, Microsoft Sentinel or syslog. It helps you meet the NCSC Cyber Assessment Framework the CAA assesses against. It does not make you compliant on its own.
Does Shield cover staff laptops that leave the airport?
Shield protects staff laptops on every network you run at the airport, from offices to airside, with nothing to install. Once a laptop leaves your networks, it relies on the endpoint protection you already run. Policy by Entra ID or Active Directory group applies again when staff are back on site.
Other industries
Airlines
Threat defense for airline offices, crew rooms and outstations, plus family-safe lounge WiFi.Trains
Threat defense for rail staff and depots, and onboard WiFi that spends less cellular data on ads.Ferries
Threat defense for ferry crews and port offices, with passenger WiFi that spends less satellite data.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.