What’s the difference between the three deployment modes for NetworkShield?

The on-site appliance and cloud proxy have the capability to decrypt HTTPS network traffic, which allows NetworkShield to read search engine queries and detect harmful search intent at the moment it happens. This decryption capability is optional and not all organisations choose to activate it. When decryption is not enabled, these modes operate in the same way as the DNS service, detecting access to known harmful websites rather than search intent. The DNS service operates at the domain level only, without decryption. DNS is the simplest to deploy. All three modes deliver the same Ripple technology intervention experience to users.