Blocks threats before the connection
Malware, phishing and command-and-control destinations are refused at the DNS layer, so the connection is never made in the first place. Nothing to quarantine, nothing to clean up.
CyberProtectDNS filters DNS on the endpoint itself. Malware, phishing and the categories you choose are refused before a connection is ever opened — on the office network, at home, or on a train.
Windows endpoint agent · multi-tenant portal · Safer browsing.
Four things every MSP running network-level content control has run into. If none of them sound familiar, this probably is not for you.
Network-level filtering protects the network. The laptop leaves, and so does the policy. Most of the fleet now spends most of its time somewhere you do not control the router.
Without per-endpoint logging, a blocked page is a support call with no evidence behind it. The question is not whether filtering works, it is whether you can show what happened on one machine at one time.
A home page or a hardening setting applied by hand lasts until the next reinstall, the next new starter, or the next person who changes it. Nothing tells you it has drifted.
Tools that were built for one company and had tenancy added later make you switch logins, re-learn scope, and trust that a policy in one customer cannot reach another.
One agent on the endpoint, one portal for every customer you manage, and the controls to answer "can you block that?" without a change window.
Malware, phishing and command-and-control destinations are refused at the DNS layer, so the connection is never made in the first place. Nothing to quarantine, nothing to clean up.
Enforcement runs on the endpoint, not on the office router. The policy applies the same way at a desk, at home, and on hotel wi-fi — with no VPN to keep running.
Sixty-plus subcategories across ten groups, each allowed or blocked individually, plus your own allow and block lists and per-country rules. Import and export as CSV.
Partners, customers, sites and endpoints are separate from the first migration. Switch customers from the top bar; role grants apply at a scope and inherit downward, never sideways.
A blocked user sees a branded page and can ask for access in one click. The request lands in the Service Center with the endpoint, the user and the reason already filled in.
Threat detections, block summaries by category, per-endpoint activity and installed software — on screen or exported as CSV, scoped to one customer or across the whole book.
No appliance, no network change, no forwarding rules on somebody else's firewall.
Add the customer in the portal and generate a deployment token scoped to them. The token is shown once and only its hash is stored.
Run the installer through your endpoint deployment system with that token. The agent enrolls itself, takes over the machine's resolver, and starts reporting within a minute.
New policies start in monitor mode: you see exactly what would have been blocked before anything is. Flip to enforcing when the logs look right.
Tenancy is not a column bolted onto a single-customer product. Every query, policy and log line is scoped to a customer, and the authorization check that keeps them apart lives in one tested module rather than being re-derived in every query.
Grant Technician at one customer or across a whole partner. A role applies to the node it was granted at and everything beneath it — never upward, never to a sibling.
Policy changes, isolation, access decisions and user administration are written to an audit log with the actor, the address they came from, and the before and after.
DNS logs are browsing history. Retention is a per-customer setting, and a minimal privacy mode records counts without per-user detail.
The same agent and the same policy tree, pointed at whichever of these a customer is asking about this week.
Written for someone evaluating this against what they already run.
Enforcement runs on the endpoint, so it applies wherever the machine is. A firewall protects traffic that crosses it; a laptop at home never does.
No. The agent installs through your endpoint deployment system, takes over the machine resolver and reports outbound over HTTPS. There is nothing to forward and no inbound rule on anyone else’s firewall.
DNS queries with the decision and category, hardware and OS details, installed applications, installed browsers and read-only Windows security state. Retention is a per-customer setting, and a minimal privacy mode records counts without per-user detail.
Yes. Settings are written as native Windows policy, so they hold with no extension present. One caveat worth knowing up front: Chrome, Edge and Brave deliberately ignore home page, new tab and startup page policy on devices that are not domain joined, Entra joined or MDM enrolled. Every other control applies either way, and the console tells you which settings the browser is honouring on each endpoint.
It is designed to. The agent filters DNS and reports state; it does not replace endpoint protection and does not compete for the same hooks.
Tenancy is in the first database migration, not bolted on. Partners, customers, sites and endpoints are separate objects, and the authorization check that keeps them apart lives in one tested module.
In active development and running on live endpoints. We would rather show you the console and the limits on a call than publish a feature matrix that ages badly.
A walkthrough of the console against real data, then a deployment token for your own test machine so you can watch a policy land on an endpoint you control.
Tell us roughly what you manage and we will come back within one business day.