Safeguarding for 16 to 19 learners and threat defense for staff
A further education college puts 16 to 19 learners covered by KCSIE, adult learners, apprentices and staff on one campus network. Shield gives each group its own policy at the DNS lookup. Learners get safeguarding categories and Safe Search, staff get threat-first defense, and phones and laptops on BYOD are filtered with nothing to install.
What is at stake
Mixed ages, their own devices and one network
Safeguarding under KCSIE
Learners aged 16 to 19 fall under KCSIE, so harmful content needs filtering on college networks, including on the phones they bring.Phishing aimed at staff
Staff inboxes get fake login pages and invoice scams. One captured password can open the MIS, payroll or learner records.BYOD you cannot manage
Learners and apprentices bring their own phones and laptops. You cannot install software on them, but they still need filtering.
How Shield fits
A policy for each group on campus
- Learner WiFiSafeguarding categories, Safe Search on Google, Bing and YouTube, and VPN and proxy apps blocked with one click.
- Staff networkThreat-first policy with new-domain blocking and per-group rules through Microsoft Entra ID or Active Directory.
- Adult learners and visitorsThreat defense and acceptable use on a separate SSID, with a branded block page that explains why.
- By the timetableStricter rules during the teaching day, set by time of day and day of week.
- Staff and head officeThreat defense firstOffice LAN and staff WiFi, by directory group
- Guest WiFiStrict, family-safeVisitors and customers, nothing to installGuest network tiersFree WiFiAd blocking on, streaming limited at busy timesPaid WiFiIts own rules, separate from the free tier
- IoT and branchesLocked downTills, cameras and sensors behind a relay
Schedule, per site
Proof
Standards you can show your safeguarding lead
- 10 days
- earlier warning of new malicious domains than standard blocklists
- IWFfiltering meets the bar set by the Internet Watch Foundation
- Friendly WiFistandard met for family-safe filtering on learner networks
- Cyber Essentialscertified, alongside ISO 27001, GDPR and CCPA
FAQ
Questions we hear from teams like yours
Does Shield help us meet KCSIE?
It helps you meet the filtering side. Shield blocks harmful categories to the IWF bar and enforces Safe Search on learner networks. Reports show what was blocked, by network and time, which gives your safeguarding lead evidence for governors. Monitoring and your wider safeguarding process stay with you.
Can learners get round it with a VPN?
Shield blocks VPN and proxy apps with one click, and it answers the lookups of each device on the learner network, with nothing on the device to switch off. Add firewall rules on outbound DNS to close the remaining routes.
Do learners have to install anything on their phones?
No. Shield works at the DNS layer on the network, so learners' own phones and laptops are filtered the moment they join. Nothing needs installing on unmanaged or guest devices, and nothing changes in how they connect.
Can 16 to 19 learners and adult learners have different rules?
Yes. Put each group on its own SSID or VLAN and give each its own policy. Staff can follow their Microsoft Entra ID or Active Directory group instead, so the rules move with the person rather than the room.
We have several campuses. Do we need hardware at each?
No. Point each site's router, firewall or DHCP at Shield. Each campus can carry its own policy, one dashboard shows them all, and scheduled PDF reports cover each site separately.
Other industries
Schools
Filtering that helps you meet KCSIE, the DfE standards or CIPA, on pupil, staff and visitor networks.Higher education
Threat defense for staff, research and student networks, with a policy per VLAN, per group and per halls block.Student accommodation
Threat defense for residents, a policy per block or VLAN, and safeguarding where halls house under-18s.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.