Safe Web & DNS (Managed)

Summary. Block risky sites and downloads wherever users work. We manage DNS/SWG policies, categories, and exceptions so people are protected without getting slowed down.

Who it's for. SMEs with hybrid workers, multiple sites, or frequent phishing/drive-by download attempts; great follow-on after the Secure Internet Access pilot.

Business Outcomes

Safer internet use with sensible categories and minimal false positives.
Consistent DNS/SWG posture across users, devices, and locations.
Clear process for exceptions and policy changes; monthly insights for leadership.

What’s Included

Scope	Description
Core Inclusions	DNS/SWG category policy management and tuning, incl. SafeSearch and file-type controls. Allow/deny list governance and exception handling with approvals. Alert triage and review of block events; monthly improvement actions.
Optional Add‑Ons	After-hours change windows (per Annex). Firewall/device care if web filtering is on-prem ($140/device). ZTNA or CASB uplift projects to protect critical apps and data.

Onboarding & Steady‑State

Note: timelines depend on size and current tooling.

Phase	Activities	Deliverables	Indicative Duration
01 — Baseline	Assessment; import current policies Identify risky categories and quick wins	Onboarding plan; initial policy set; first posture snapshot	0.5–1 week
02 — Stabilise	Tuning to reduce FPs; set change governance Exceptions log and owners	Stable posture; KPI dashboard; exception register (owner + expiry)	1–2 weeks
03 — Operate	Monthly report; planned changes	Monthly KPIs + next-month actions	Ongoing

Service Levels (Summary)

Plan	Coverage	Response / Restore	Governance
Bronze	Business hours (Mon–Fri 08:00–17:00 NZT, except Public Holidays)	P1: 2h / NBD • P2: 4h / 2BD	Email support • Monthly summary
Silver	Extended hours (Mon–Fri 07:00–19:00 NZT, except Public Holidays)	P1: 1h / Same day • P2: 2h / NBD	Weekly check‑in • Exceptions log
Gold	Business + after‑hours (24×7 P1 only)	P1: 30m / ASAP • P2: 1h / Same day	Executive summary • CAB-ready change notes

For pricing, terms and conditions see the Pricing Annex.

Success Criteria (from our perspective)

Core categories enforced (malware, phishing, newly-registered domains, risky file types) with no critical business disruption
False-positive rate trending down month-on-month; exceptions tracked with owners and expiries
Policy bypasses reduced (e.g., external DNS / direct-to-IP blocked); monthly posture report accepted
Incident MTTR within SLA for P1/P2 related to web/DNS threats

Prerequisites

Admin or delegated access to DNS/SWG tooling
Maintenance windows agreed
Device identities or user groups available for policy scoping
Firewall/DNS allow-list for SWG egress IPs and management endpoints
Agreed deployment mode (agent, PAC/proxy, or DNS forwarding) for the pilot/rollout cohort

Assumptions

Corporate‑managed users/devices in scope; BYOD best‑effort unless agreed
Standard change control applies; rollback plans available
Licensing for SWG/DNS is pass‑through at vendor MSRP

Risks & Mitigations

Legitimate site/app blocked: exception workflow with expiry; weekly review; staged rollouts
Agent/PAC/DNS conflicts: ringed deployment; latency checks; rollback script
Shadow bypass: block external resolvers; enforce proxy/PAC; monitor direct-to-IP access

Out of Scope

Large‑scale network re‑architecture (separate project)
Custom integration scripting beyond standard patterns
Procurement for third‑party tools (pass‑through only)

Get started

Book an Assessment Request Managed Service Request Custom Package Talk to us

Prefer to stabilise first? Run a short pilot to establish a clean baseline; then roll into this managed service.

Business Outcomes

What’s Included

Onboarding & Steady‑State

Service Levels (Summary)

Success Criteria (from our perspective)

Prerequisites

Assumptions

Risks & Mitigations

Out of Scope

Get started

Related Resources