Stop ransomware calling home from the plant floor
A plant runs PLCs, HMIs, scanners and cameras that cannot run an agent, next to office laptops that can. Ransomware on either side stops the line. Shield blocks phishing, malware and command-and-control callbacks at the lookup, and the relay shows each OT and IoT device by internal IP, so you know which machine tried to call home.
What is at stake
Downtime starts with one lookup
Ransomware stops the line
Encrypted servers halt production scheduling, labelling and dispatch, and a plant can sit idle for days.Devices that cannot run agents
PLCs, HMIs, barcode scanners and CCTV run firmware nobody can patch on demand, and they still make DNS lookups.Suppliers and remote access
Machine builders and integrators connect in for support, and engineering laptops move between the plant and home.
How Shield fits
A policy for each zone of the plant
- OT and control networksA strict allow list through the relay, so a PLC or HMI reaches only the vendor domains it needs.
- IoT and CCTVThreat defense and new-domain blocking on segmented VLANs, with each camera and sensor visible by internal IP.
- Office and engineeringThreat defense first, ransomware and C2 blocked, with policy by Entra ID or Active Directory group.
- Shift and canteen WiFiContent categories and Safe Search for breaks, with games and streaming scheduled by time of day.
Blocked at the lookup
- Command-and-control callback
- Phishing domain
- Malware domain
- Newly flagged domain
Proof
Earlier warning on the domains ransomware uses
- 10 days
- earlier warning of new malicious domains than standard blocklists
- 62%
- fewer DNS queries once ads and trackers are blocked, by Purple's own measurement
- Cyber Essentialscertified, alongside ISO 27001, GDPR and CCPA
FAQ
Questions we hear from teams like yours
Our OT devices cannot run agents. How does Shield see them?
Nothing needs installing on them. Point the OT network's DNS at the Shield relay, and each device's lookups reach Shield with its internal IP attached. A drill-down from any domain shows which PLC, HMI or camera looked it up.
Will Shield interrupt production traffic?
Shield answers DNS lookups only, and does not sit inline with traffic between devices on the plant floor. Run an OT network on an allow list of the vendor domains it needs, review the reports during the trial, then enforce.
Do we need hardware at each plant?
No appliance is needed. Point the router, firewall or DHCP at Shield for office networks, and run the relay where OT and IoT sit on segmented VLANs. Multi-site groups manage each plant's policy from one dashboard.
Does Shield replace our OT firewall?
No. Shield is a layer behind your firewall and segmentation. It stops a lookup to a ransomware or C2 domain before a connection starts, and flags new malicious domains up to 10 days before standard blocklists.
Can we send Shield logs to our SOC?
Yes. Shield streams logs to Splunk, Microsoft Sentinel, Elastic, IBM QRadar, CrowdStrike, Amazon S3 or syslog, so a C2 lookup from a plant device lands alongside your other alerts. An open API covers the rest.
Other industries
Corporate offices
Threat defense at the lookup for HQ, branches and staff networks, with Entra ID group policy and SIEM logs.Financial services
Threat defense for branches, trading floors and remote advisers, with evidence for FCA, DORA and PCI DSS.Small business
Phishing and ransomware blocked at the lookup on the office router and customer WiFi, with no IT team needed.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.