Stop ransomware at the lookup on staff and research networks
Universities run open networks for thousands of staff, researchers and students, and attackers know it. Shield answers each DNS lookup before a connection starts, blocking phishing, ransomware domains and C2 callbacks from infected machines. Staff and research networks get threat-first policy, students on eduroam-style BYOD get their own, and lab IoT shows up by internal IP through a relay.
What is at stake
An open campus that attackers treat as a target
Ransomware through a phishing link
One staff login handed to a fake sign-in page can give an attacker the foothold for ransomware across finance, HR and research systems.Unmanaged student devices
Thousands of personal laptops and phones join through eduroam-style BYOD. One infected device calling its C2 server shares the network with research kit.Research kit and lab IoT
Instruments, sensors and lab servers sit on segmented VLANs that rarely get patched, and few teams can see what those devices look up.
How Shield fits
A policy for each network on campus
- Staff and corporate LANThreat-first policy with new-domain blocking, set per user or group through Microsoft Entra ID or Active Directory.
- Research VLANs and lab IoTA relay shows each instrument's internal IP, so you can trace a suspicious lookup to the device that made it.
- Student BYOD and residencesThreat defense plus a light acceptable-use policy, with nothing to install on students' own laptops and phones.
- Visitor and conference WiFiThreat blocking, content categories and Safe Search for visitors and delegates, with nothing to install on their devices.
See everything Shield stopsHigher education WiFi on Purple Access
- Staff and head officeThreat defense firstOffice LAN and staff WiFi, by directory group
- Guest WiFiStrict, family-safeVisitors and customers, nothing to installGuest network tiersFree WiFiAd blocking on, streaming limited at busy timesPaid WiFiIts own rules, separate from the free tier
- IoT and branchesLocked downTills, cameras and sensors behind a relay
Schedule, per site
Proof
Earlier warning, with evidence your security team can use
- 10 days
- earlier warning of new malicious domains than standard blocklists
- 62%
- fewer DNS queries once ads and trackers are blocked, in Purple's own measurements
- ISO 27001certified, alongside Cyber Essentials, GDPR and CCPA
FAQ
Questions we hear from teams like yours
Will students get round it with a VPN or encrypted DNS?
Shield blocks VPN and proxy apps with one click, and it answers lookups for each device on the networks it protects. Add firewall rules on outbound DNS and you close the common routes round it.
Can it feed our SIEM?
Yes. Shield streams logs to Splunk, Microsoft Sentinel, Elastic, IBM QRadar, CrowdStrike, Amazon S3 or syslog, and has an open API. Your security team can drill from a domain to each device that looked it up, then take that into an investigation.
Can research groups have different rules from administration?
Yes. Policy can follow a network, SSID, VLAN or site, or a user or group through Microsoft Entra ID or Active Directory. A research group can reach tools that administration blocks, and each keeps its own allow and block lists.
Do we need new hardware on each campus?
No. You point your routers, firewalls or DHCP at Shield, with no hardware to buy. For segmented research VLANs and IoT, a relay passes each device's internal IP, so reports show the real source of a lookup.
Can we see which AI tools staff and students use?
Yes. User behavior analytics show shadow IT and generative AI tool use by network or group. You can then block specific AI apps with one click, or allow approved ones for research while blocking the rest.
Other industries
Schools
Filtering that helps you meet KCSIE, the DfE standards or CIPA, on pupil, staff and visitor networks.Colleges
Filtering that helps you meet KCSIE for learners, threat-first policy for staff, and BYOD with nothing to install.Student accommodation
Threat defense for residents, a policy per block or VLAN, and safeguarding where halls house under-18s.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.