Phishing & malicious links
Block access to domains used in phishing campaigns before the connection is established.
Block threats before connections begin
Zen DNS Defence helps protect users, devices and locations by identifying and blocking malicious or unwanted domains before a connection is established.
It gives you a simple way to add cloud-delivered DNS-layer protection across your organisation.
Zen DNS Defence · powered by Cisco Secure Access – DNS Defense
The problem it solves
Threats start at the first connection
Most attacks rely on a device reaching a domain it shouldn’t, such as a phishing site, malware host or ransomware callback. DNS Defence checks that request before the connection is made.
Ransomware callbacks
Cut off command-and-control communication at the DNS layer, before payloads can act.
Roaming & distributed users
Apply the same protection whether people are in the office, at home or on the move.
How DNS defence works
Protection that happens before the connection
DNS Defence checks each domain request against live threat intelligence and your security policies before any connection is opened.
1
Connection initiated
A user or device tries to reach a website or cloud service. This DNS lookup is the very first step before any internet connection is established.
2
Request evaluated
The destination is instantly checked against Cisco Talos global threat intelligence and your organisation's custom security policies.
3
Threat blocked
Destinations linked to malware, phishing or ransomware are blocked immediately at the DNS resolution stage, stopping payloads before they ever reach your network.
4
Safe traffic resolved
Legitimate requests resolve instantly, with no latency or disruption for the end user.
What it protects
One layer of protection, everywhere your people work
DNS Defence is cloud-delivered, so it isn't tied to a single office or a piece of on-site hardware. It extends across the places and devices your organisation actually uses.
Sites and branches · consistent policy across every location.
Roaming users · protection that travels with the person.
Managed devices · applied wherever they connect.
Hybrid environments · office, home and on the move, treated the same.
The vulnerability
Attacks start at the click
Leaving DNS resolution to a standard internet connection leaves a critical gap in your perimeter. Most attacks rely on the DNS layer — which is exactly where they can be stopped.
90%1
of successful cyber-attacks begin with a malicious web link or webpage.
80-90%2
of cyber-threats actively use the Domain Name System to reach and infect endpoints.
90%3
of command-and-control malware uses DNS to exfiltrate data, download payloads or run ransomware.
The Zen solution: stop threats at the DNS layer
By securing the DNS layer, you can block malicious domain requests before a connection is established. DNS Defence can protect users across branch offices, roaming devices and guest WiFi. In one customer deployment, this approach reduced active security alerts by 50%4.
1 CISA (U.S. Cybersecurity and Infrastructure Security Agency), cited in Cisco Secure Access — DNS Defense datasheet: cisco.com/…/secure-access-dns-defense-ds.pdf
2 Canadian Centre for Cyber Security, cited in Cisco Secure Access — DNS Defense collateral. See also the DNS Defense At-a-Glance: cisco.com/…/secure-access-dns-defense-aag.pdf
3 Cisco Talos threat intelligence telemetry. DNS-layer efficacy independently validated in the Miercom SSE Benchmark Report: cisco.com/…/miercom-sse-benchmark-report.html
4 Customer outcome (Texas A&M University System), documented in Cisco DNS Defense decision-maker briefings. Result reflects one organisation's deployment and is not a guaranteed outcome.
AI in DNS Defence
How AI strengthens DNS protection
DNS Defence uses AI to improve threat detection and give you greater visibility of how AI applications are being used across your organisation.
Essentials & Advantage
See how staff use AI tools
Automatically spots and risk-scores the AI tools your people use, so you can catch any unapproved use before data is exposed.
Advantage
Stop hidden data theft
Attackers can sneak data out through DNS. AI built into Cisco’s network spots and blocks these hidden channels instantly, with no slowdown for users.
Advantage
Block malware before it calls home
Malware keeps inventing new web addresses to reach its operators. AI predicts and blocks them early — faster than traditional block-lists can react.
Why Zen
More than just a licence subscription
Zen supports DNS Defence from initial design and onboarding through to ongoing technical support and service reviews, reducing the day-to-day work for your team.
Onboarding & design
We design the service around your organisation and existing network.
- Solution architects design your network and policy layout
- We handle subscription and tenant setup
- Branch tunnel and identity provider integration
Support & escalation
One team to call, whatever the issue.
- First-line triage for connectivity and block events
- We own critical incidents end to end
- We raise and manage Cisco support cases for you
Reviews & lifecycle
We keep the service current as your needs change.
- Regular technical reviews of policy and software
- A dedicated security expert on Signature Support
- Reporting and planning as your estate evolves
Already a Cisco Umbrella customer?
Move from Cisco Umbrella to DNS Defence
DNS Defence is the direct, cloud-delivered evolution of Cisco Umbrella DNS. Zen can help you plan a
phased transition around your renewal date, while maintaining DNS-layer protection for users across
office and remote locations.
Cloud data protection
Scan sanctioned cloud apps for malicious files and data leaks — without redirecting your traffic.
AI-enhanced threat intelligence
Real-time detection of stealthy DNS-based attacks and command-and-control callbacks.
No new desktop software
Devices already running the Cisco Secure Client need no new deployments to gain the upgraded protection.
If you’re approaching an Umbrella renewal, talk to us about how a phased move to DNS Defence could work for your organisation.
Where it fits
Cloud security that works around your network
Zen Secure Access lets you add the cloud-delivered security capabilities your organisation needs, from DNS-layer protection to secure internet access and Zero Trust access to private applications. It can also form the security element of a wider SASE architecture.
Start here You’re viewing this
DNS Defence
Block online threats before they reach your network
A simple first layer of protection across your organisation. Deployed in minutes, without installing software on every device.
- Block malicious and unwanted domains at the DNS layer
- Protect users, devices and locations
- Fast to deploy, light to run
Broaden
Secure Internet Access
Deeper control over web and cloud traffic
As your requirements grow, SIA gives you more detailed protection and visibility. It can help you:
- Inspect encrypted web traffic
- Control access to websites and URLs
- Apply cloud-based firewall policies
- Protect sensitive information with data loss prevention
- Manage traffic to SaaS applications
Includes DNS-layer security — you move up to SIA rather than adding it on top of DNS Defence.
Extend
Secure Private Access
Give users access to applications, not the whole network
Traditional remote-access VPNs can give users broad access to your network once they sign in. Secure Private Access uses Zero Trust Network Access (ZTNA) to grant access only to the applications people need, keeping your internal network hidden.
- Reduce unnecessary access
- Keep internal IP addresses hidden
- Limit the risk of threats moving between systems
- Apply more precise access policies
Architecture
SASE
Your network and cloud security, combined
SASE is what you get by adding Secure Access (SSE) to Zen-managed SD-WAN — Catalyst or Meraki.
- SD-WAN moves traffic; Secure Access protects it
- One consistent policy across sites, remote users and cloud
- Works with Catalyst, Meraki or a third-party WAN
- Adopt at your pace, with the level of Zen management that suits you
Try before you commit · up to 60 days, at no cost
See what’s reaching your users, then decide
See the domains and destinations your people are actually reaching — and block the malicious and unwanted ones before a connection is made. Zen deploys DNS Defence for up to 100 users, surfaces risky and policy-relevant activity, and hands you a findings pack to keep, whether or not you proceed.
A useful step towards Cyber Essentials, too — see where you stand before your assessment does.
Week 0
Agree what success looks like, in writing.
Weeks 1-2
We build, configure and go live — monitor-only first if you prefer.
Weeks 3+
Weekly evidence against your criteria.
Day 45-60
Findings pack, value review and your decision.
No payment details to start, and it doesn’t roll into a contract. At the end we
decommission the tenant — the findings are yours to keep.
Related services
Part of a wider security picture
Managed Firewalls
Protect your business from unauthorised access and internet security threats.
Cyber Triage
A monthly review and analysis service that flags issues affecting your security.
Managed SD-WAN
Resilient, cloud-ready networking that can combine with Secure Access as part of a SASE architecture.
Can't find your answer?
Get in touch with our dedicated support team via phone or email.
Opening times
Sales - Billing - Web Hosting
09:00 - 17:00
Mon - Fri
Technical Support
08:00 - 20:00
Mon - Fri
Order Management
08:00 - 18:00
Mon - Fri
The questions buyers actually ask
