Question 1

Do we need to change our network topology?

Accepted Answer

No. ThreatOrigin is designed as a "plug & play" overlay. You don't need to rip and replace your existing firewalls or switches. You simply point your DNS forwarders to our secure resolvers, and you're live in minutes.

Question 2

How do we deploy protection for roaming users?

Accepted Answer

We provide a lightweight roaming agent for Windows, macOS, iOS, and Android. You can push it silently via your MDM (like Intune or Jamf) or RMM tools, so users get protected instantly without needing to configure anything themselves.

Question 3

Will this break our internal domain resolution?

Accepted Answer

No. We use a "Smart Forwarding" approach. You configure your internal domains (like `.local` or `.corp`) in the dashboard, and our roaming agent will bypass the cloud for those requests, ensuring your intranet and file servers keep working perfectly.

Question 4

How long does SIEM integration take?

Accepted Answer

It's typically done in under an hour. We support standard formats (syslog, JSON, CEF) and have pre-built connectors for major platforms (Splunk, QRadar, Sentinel). You just plug in your API keys or forwarder IP, and enriched logs start flowing immediately.

Question 5

Can we test this on a small group first?

Accepted Answer

Yes. You can deploy the roaming agent to a pilot group or point a single office's DNS forwarder to us for testing. This lets you validate visibility and policies without affecting the entire organization.

Question 6

Does the roaming agent interfere with our VPN?

Accepted Answer

No. The agent is VPN-aware and works alongside most major VPN clients (Cisco AnyConnect, GlobalProtect, etc.). It detects when a tunnel is active and adjusts its routing to prevent conflicts or DNS leaks.

Question 7

What happens if the internet goes down?

Accepted Answer

Our agent has a "fail-open" or "fail-closed" option, depending on your security policy. By default, if the agent can't reach ThreatOrigin (e.g., captive portal issues), it can pause briefly to let the user connect, then resume protection automatically.

Question 8

Do we need to install hardware appliances?

Accepted Answer

For most deployments, no—it's 100% cloud-native. However, for strict compliance or air-gapped networks, we do offer on-premise virtual appliances (VA) that sync with our cloud intelligence while keeping logs local.

Question 9

How do we manage policies for different locations?

Accepted Answer

You can define "Sites" in the dashboard based on your public IPs. Each office or branch can have its own policy (e.g., Guest Wi-Fi blocks streaming, while Corporate Wi-Fi blocks only malware), all managed from a single pane of glass.

Question 10

Is there downtime during the switch?

Accepted Answer

Zero downtime. Because you are simply adding ThreatOrigin as a forwarder or updating DHCP scopes, clients will seamlessly start using the new resolvers. We recommend keeping your old DNS as a backup for a few minutes during the transition just in case.

ThreatOrigin, In Plain English

Features

Why ThreatOrigin

Compare

Resources

Company

Features

Why ThreatOrigin

Compare

Resources

Company