Threat defense across departmental estates and remote officials
Departments run headquarters, regional offices and agencies for thousands of officials, and each site is a phishing target. Shield blocks phishing, malware, ransomware and C2 callbacks at the lookup on every network in that estate, with policy by site, network and Entra ID group. It streams decisions to your SIEM and gives you evidence for Cyber Essentials and the NCSC Cyber Assessment Framework.
Guest WiFi policy
- Adult contentBlocked
- GamblingBlocked
- Safe Search on Google, Bing and YouTubeEnforced
- Streaming at busy timesLimited
Allow list
bookings.examplemenu.exampleBlock list
rival-venue.exampleWhat is at stake
A large estate with many ways in
Targeted phishing
Officials are sent lookalike login pages for government services, often on domains registered days earlier.Mixed estates
Departments, agencies and arm's-length bodies run different networks, firewalls and suppliers under one accountability.Building systems online
Door access, CCTV and meeting room screens sit on departmental networks, often installed by contractors and rarely watched.
How Shield fits
One standard across the department
- Official networksThreat defense first, domains registered in the last 7 days blocked, with geographic and TLD rules applied.
- Building systemsDoor access, CCTV and meeting room screens behind a relay, so each device's internal IP shows in reports.
- Groups and rolesRules by Entra ID or Active Directory group, including which generative AI tools each team can use.
- Visitor and public WiFiThreat blocking, family-safe categories and Safe Search, with nothing to install on visitor devices.
See everything Shield stopsPublic sector WiFi on Purple Access
Proof
Standards you can point to
- 10 days
- earlier warning of new malicious domains than standard blocklists
- Cyber Essentialscertified, alongside ISO 27001, GDPR and CCPA
- IWFfiltering on public networks meets the Internet Watch Foundation bar
FAQ
Questions we hear from teams like yours
How does Shield help with the NCSC Cyber Assessment Framework?
Shield gives you evidence for CAF outcomes on preventing and detecting attacks. It blocks malicious domains at the lookup, logs each decision to your SIEM, and shows shadow IT and AI tool use. It supports your assessment rather than replacing it.
Can each agency keep its own policy?
Yes. Policy is set per network, SSID, VLAN and site, and per Entra ID or Active Directory group. A department can hold a common baseline while each agency adds its own allow and block lists.
What does Shield log, and can our DPO sign it off?
Shield sees the domain a device looks up, not the content of what it sends. Raw query logs are kept for 9 days, and you can stream them to your SIEM to keep them as long as your policy requires. Purple holds ISO 27001, Cyber Essentials, GDPR and CCPA, and we send the documentation your DPO and security team need before you start.
Can officials bypass it with a VPN?
One-click app blocking covers VPN and proxy apps, so consumer VPN services are blocked at the lookup. Pair that with an outbound firewall rule that sends all DNS through Shield, and the common routes round it close.
What happens if Shield goes down?
Shield runs on a dual anycast DNS network, so if one node or network fails, the next one answers. It fails closed, so an outage never leaves a departmental network unfiltered. There is no appliance at each site to maintain, because sites point their firewall or DHCP at Shield.
Other industries
Local government
Threat defense for council staff and sites, with family-safe public WiFi in libraries and the schools estate.Airports
Threat defense for airport operations and staff, with family-safe passenger WiFi proven at AGS Airports.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.