We use DNS mode. Are there gaps in our protection?

In DNS mode, NetworkShield can detect and intercept visits to known harmful websites, but it cannot detect harmful search queries because that requires reading the content of HTTPS traffic. The recommended way to close this gap is to deploy BrowserShield on managed machines alongside NetworkShield DNS. The two products are designed to work together in this configuration.