We Built One Engine Instead of Five: Inside LUMINATE by DNSFilter™

Today LUMINATE by DNSFilter™ launches from the Nasdaq MarketSite in Times Square. My product and engineering teams built it, and I want to share how, because the decisions we made along the way explain why it works the way it does.

We started with one rule: Nothing we added could give up the position DNSFilter already holds. Everything on the internet has to ask for directions first. A person clicking a link, an application calling a service, an AI agent reaching for a tool, malware looking for its command and control. None of them can move until they ask where the thing actually is, and we’re the ones they ask.

That’s why DNS First isn’t a feature we added. It’s where we decided to stand. If we don’t give the directions, there’s no connection, no payload and no incident. Pre-emptive protection is the foundation of every suite in LUMINATE by DNSFilter™, and every decision starts at or before DNS.

So we started with what we already had. We looked at every product surface, including the two companies we acquired along the way, and rearchitected them to work together. Guardian, in 2022, brought firewall and VPN technology. Zorus, in 2025, brought endpoint filtering that works before a DNS query ever leaves the device, along with user behavior analytics. Both came with their own apps, their own agents, and customers who depended on them.

The quick path would have been to keep selling them next to DNSFilter with one logo printed over three products. Instead, we rebuilt them into one. For Zorus, that meant bringing its capabilities into the DNSFilter roaming client, which is where DNS PreCheck and Behavior Analytics came from. For Guardian, it meant taking encrypted private connections out of a separate app and building them into the platform, which is what Encryption & Privacy delivers today. Every piece now runs on the same agent, reports into the same console, and feeds the same intelligence model. At the moment someone asks us the way, every suite knows who they are, what device they’re on, where they’re going and what we know about that place.

What changed is what our customers asked us to do from the same position. They wanted to see what users actually do, not just what they look up. They wanted to govern the AI tools and agents showing up across their organizations. Lastly, they wanted to protect people, and encrypt their traffic, on networks they don’t control. We could have answered each of those with a new product: Five agents, five consoles, five sets of policy, each with its own idea of what’s happening. That would have been faster to ship but much harder for our customers to live with.

It would also have rebuilt the problem our customers already have: Tools that don’t share signals, with attackers working in the gaps between them.

So we built one engine instead of five. One agent on the device, one console for the admin, and one intelligence model underneath it all, so every suite works from the same picture. Every outcome feeds back into that model, so the platform keeps getting smarter as it runs.

We didn't set out to build a platform for its own sake. We set out to solve the problems our customers kept bringing us, and we shipped the answers one at a time. Here is where each of the five suites sits today:

• Advanced Filtering is our bread and butter and the backbone of the platform. We’ve invested in it for ten years, and it runs on the fastest resolver in North America, because slow security is security people switch off. It works in two modes: classic DNS filtering at the resolver, and DNS PreCheck, which makes the decision on the device before a query ever leaves. AppAware adds control over which applications people can reach. Unblock Requests, Investigate Mode and SIEM export put every decision in front of the people who need to act on it.
• Behavior Analytics, built on CyberSight, starts with the hardest part: telling the person apart from the machine. An endpoint chatters all day with no humans near it. Separate that out and you get a fingerprint of intent. Connect that intent to the application, the full URL and the IP, and you can see how an attack spawns and where each step sits in the chain.
• Encryption & Privacy starts with encrypted DNS: because we’re the ones being asked, policy still applies and the traffic stays private. SecureTransit, which we built, adds encrypted transport on any network and privacy from trackers and data brokers, enforced as company policy, even from DNSFilter.
• AI Governance & Controls started where we already were: blocking at DNS and controlling apps with AI-specific categories. CyberSight AI Usage brought shadow AI into view. AgentShield goes further, attributing AI activity to the agent that called it, so the agent gets its own policy, distinct from the rest of the network, machine and user.
• Threat Intelligence powers the whole engine, and now security teams can use it directly. Six trillion queries a month means we see a domain resolve for a real person long before it surfaces anywhere else. Teams can triage indicators during a live incident, assess exposure after a breach and find compromised endpoints their stack missed. It’s available from a dashboard, an API and an MCP server, so a threat hunter can query it live in the middle of an investigation, and so can their agents.

Every one of them is built on the same pre-emptive foundation, at or before DNS, and each makes the others stronger. LUMINATE by DNSFilter™ is where they come together.

For anyone already running DNSFilter, LUMINATE by DNSFilter™ layers on top of what you have. Existing deployments keep working as they are, and adding a suite later doesn’t mean redeploying anything.

The way people work is going to keep changing, and so is what needs protecting. Our job is to stay ahead of that from the place we know best, and to keep building against the real problems you bring us. LUMINATE by DNSFilter™ is a big milestone, and it's one stop on a much longer road.

To the beta testers who ran early builds and told us what needed fixing, and to the product and engineering team who built all of this: Thank you. I’m proud of what we have made together.

Want to see the platform in action? Join us for Falling Into Place: DNSFilter's Fall Product Webinar on Thursday, Oct. 29 at 1 p.m. ET. Barnaby Wood, Serena Raymond, and I will walk through what we shipped this year, how it all works together, and where the platform goes from here.

Can't make it on the 29th? Register anyway and we'll send you the recording.

Save your seat

If you'd rather see it sooner, we're happy to show you. Explore LUMINATE by DNSFilter™.