Threat defense for branches, trading floors and remote advisers
Financial firms are a favorite phishing target, and one compromised laptop can reach client data and payment systems. Shield blocks phishing, malware, ransomware and C2 callbacks at the lookup across branches, trading floors and head office networks. It streams logs to your SIEM and gives you evidence for FCA operational resilience rules, DORA in the EU and PCI DSS.
What is at stake
Where attackers aim first
Credential phishing
Lookalike domains for client portals and Microsoft 365 are registered and used within days, often before blocklists catch them.Ransomware and C2
A device beaconing to a command-and-control server is the step before encryption, and before a call to the regulator.Branches with customer WiFi
Branches carry payment terminals, staff PCs and customer WiFi on one line, often with nobody from IT on site.
How Shield fits
Policy by desk, branch and device
- Trading floor and head officeThreat defense first, domains from the last 7 days blocked, and generative AI apps limited by Entra ID group.
- Payment networksCard terminals on their own VLAN with a strict allow list, part of your evidence for PCI DSS.
- Branch staff networksThreat-first rules on adviser PCs and branch staff WiFi, with new domains blocked and a relay naming each device.
- Branch customer WiFiThreat blocking, content categories and Safe Search in waiting areas, with nothing to install.
Blocked at the lookup
- Command-and-control callback
- Phishing domain
- Malware domain
- Newly flagged domain
Proof
Earlier warning on the domains that target you
- 10 days
- earlier warning of new malicious domains than standard blocklists
- 62%
- fewer DNS queries once ads and trackers are blocked, by Purple's own measurement
- ISO 27001certified, alongside Cyber Essentials, GDPR and CCPA
FAQ
Questions we hear from teams like yours
How does Shield help with FCA operational resilience and DORA?
Shield does not make you compliant, but it gives you evidence. It blocks threats at the lookup, fails closed during an outage, runs on a dual anycast DNS network and streams each decision to your SIEM, so you can show the control working when a supervisor asks.
How does Shield fit PCI DSS?
Shield helps you meet PCI DSS by giving payment networks their own policy. Put card terminals on a separate VLAN with a strict allow list, and the logs show which domains they reached. Your QSA still decides scope.
Can we stream logs to our SIEM?
Yes. Shield streams to Splunk, Microsoft Sentinel, Elastic, IBM QRadar, CrowdStrike, Amazon S3 or syslog, with an open API. Analysts can drill from one domain to each device that looked it up.
What about advisers working from home?
Shield protects devices while they are on your networks: branches, head office and the trading floor. Advisers' laptops away from them, at home or in a client's office, need the endpoint protection you already run. Back on a firm network, they pick up the Shield policy again, with nothing to install.
Does Shield replace our firewall?
No. Shield is a layer behind it. It stops a lookup to a malicious domain before a connection starts, shows which device made it, and catches new domains up to 10 days before standard blocklists.
Other industries
Corporate offices
Threat defense at the lookup for HQ, branches and staff networks, with Entra ID group policy and SIEM logs.Manufacturing
Ransomware and C2 blocked at the lookup on OT, IoT and office networks, with each device visible by internal IP.Small business
Phishing and ransomware blocked at the lookup on the office router and customer WiFi, with no IT team needed.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.