Off-Network Filtering for K-12 Take-Home Devices: Architecture, Coverage, and Evaluation

K-12 off-network filtering vendors cluster into three architecture families. Each makes a different trade-off between coverage depth, deployment complexity, and feature parity.

Family 1: Kernel-level driver agents

A driver-level agent installed on each managed device intercepts traffic at the OS layer before it leaves the device. Filtering applies to every browser, every application, and every protocol on the device, not just web traffic in a managed browser. Coverage is comprehensive when the agent is installed. The trade-off: deployment requires admin-level OS access (MDM enrollment for managed devices is the standard delivery vector), and the agent is per-OS-coded, so coverage depends on which OSes the vendor has shipped agents for.

Vendor in this family: Lightspeed Systems. Lightspeed's SmartAgent is a driver-level agent on Windows, macOS, and iOS. On Chromebooks, Lightspeed delivers filtering via a Chrome extension (a different architecture from the Windows/macOS/iOS case).

Family 2: Extension + on-device app hybrids

A web filter delivered via a browser extension on Chromebooks (the OS-level managed channel for ChromeOS) plus an on-device app on Windows, macOS, and iPadOS (delivered via MDM enrollment). The browser-extension delivery means filtering applies to managed-browser traffic only on Chromebook. ChromeOS's design constrains all student web activity to the managed browser, so the practical coverage is similar to a kernel agent. On Windows/macOS/iPadOS, the GoGuardian App filters web traffic across every browser on the device, on or off the network, and keeps enforcing district policy when the device leaves campus. It does not filter non-browser application traffic the way a kernel-level agent does.

Vendors in this family: GoGuardian and Securly. GoGuardian Admin runs Chrome extension on Chromebook + GoGuardian App via MDM on Windows/macOS/iPadOS. Securly Filter runs a Chrome/Edge extension OR SmartPAC (a PAC + DNS hybrid); buyers choose method per deployment, and the method choice forces a feature-parity trade-off (covered below).

Family 3: DNS-only models

A DNS-layer filter applied at the network or device level. Filtering works by resolving requests against an allow/block list before the device's traffic reaches the destination. The trade-off: DNS-only filters don't see inside SSL-encrypted traffic, so granular per-URL or per-keyword filtering is limited.

Where this shows up: Cisco Umbrella's K-12 offering and Lightspeed's SmartShield appliance use DNS-only models for agent-less devices (typically BYOD or guest-network use). DNS-only is rare as a standalone primary architecture for K-12 in 2026; it's more commonly a fallback layer in a hybrid stack.

The harder question than "does it work off-network" is "does the same filtering apply off-network." For some vendor architectures, off-network coverage exists but with a narrower feature set than on-network coverage. The parity-gap list:

Where parity gaps surface across the three vendors:

• Securly method-dependent gap. Securly Filter on Windows/macOS gives buyers a method choice: Chrome/Edge Extension OR SmartPAC (PAC + DNS hybrid). The two methods have different feature surfaces. SmartPAC supports SSL decryption (deeper visibility) but doesn't surface Chat scanning, full traffic logging, or YouTube controls. The Extension surfaces Chat scanning, logging, and YouTube controls but doesn't do SSL decryption. Buyers running Extension get one feature mix off-network; buyers running SmartPAC get a different mix. Securly's marketing line "filter all of your school's traffic, all of the time" papers over this trade-off; the procurement reality is that method choice constrains feature parity.
• Lightspeed Chromebook delivery is browser-extension, not kernel-agent. Lightspeed's kernel-level SmartAgent ships on Windows, macOS, and iOS, not on ChromeOS, where ChromeOS architecture constraints make extension the only viable delivery channel. The practical effect: Lightspeed's Chromebook off-network coverage is structurally similar to GoGuardian's and Securly's (extension-based), not the kernel-agent model their marketing emphasizes.
• GoGuardian feature parity statement. GoGuardian Admin filters on and off the school network with no feature degradation off-network, provided the student stays signed into a school-managed account on a managed device.✓Verified · GoGuardian product team (Jun 9)Was: [Awaiting product team — which Admin features, if any, degrade off-network per OS.]

The parity question is procurement-decision-load-bearing because off-network is where the highest-stakes student safety events happen (most after-school hours, weekend access, parent-supervised but device-mediated use). A filter that downgrades to a narrower feature surface when the student leaves campus surfaces the same content categories but may miss the contextual signals it would catch on the campus network. Buyers should ask each vendor for an explicit on-network vs. off-network feature parity statement during RFP review.

GoGuardian Admin enforces off-network filtering through the Chrome extension on Chromebook and the GoGuardian App on Windows, macOS, and iPadOS, governed by Out-of-School Mode. A fourth layer, DNS Precision Filtering, covers devices on the school network rather than off-campus use.

1. Chrome extension on Chromebook. Deployed via Google Admin Console as a managed extension. Filtering applies to managed-browser traffic; ChromeOS architecture constrains student web activity to the managed browser, so the practical coverage is consistent with the web filtering the GoGuardian App provides on other OSes.

2. GoGuardian App on Windows, macOS, and iPadOS. An on-device app delivered via MDM enrollment. The GoGuardian App filters web traffic across every browser on the device, on or off the network, and keeps enforcing district policy when the device leaves campus.✓Verified · GoGuardian product team (Jun 9)Was: The on-device app provides system-level filtering across browsers and applications, similar in coverage scope to a kernel agent. It does not filter non-browser application traffic the way a kernel-level agent does. MDM support covers the vendors with official setup guides. Windows: Active Directory, Intune, and PDQ. iPadOS: Jamf Pro, Jamf School, Intune, Meraki, FileWave, Workspace ONE/AirWatch, Iru (formerly Kandji), Mosyle, and Addigy. macOS: Jamf Pro, Jamf School, Intune, Meraki, FileWave, Iru (formerly Kandji), and Mosyle. Manual deployment is also supported, and in practice any MDM that can push apps (plus registry keys on Windows, or mobileconfigs on iPad and macOS) works.

3. Out-of-School Mode. The off-network policy mechanism. Out-of-School Mode uses time-of-day scheduling and public-IP-range detection to determine which policy set is active. During school hours and when the device is on a recognized district network, the standard filtering policy applies. Outside those windows (evenings, weekends, breaks, off-campus access), the Out-of-School policy set takes effect. District administrators configure the off-campus policy independently of the on-campus policy, so a district can apply tighter or looser filtering off-network depending on program structure.

4. DNS Precision Filtering (on-network and BYOD). DNS Precision Filtering (released November 2025) enhances GoGuardian Admin's on-premises DNS filtering to protect all devices connected to the school network, including unmanaged and BYOD devices.✓Verified · reframed as on-network/BYOD (Jun 9)Was: Filters at the DNS resolution layer; catches traffic that bypasses the device-level filtering. [Awaiting commercial model.] Administrators can apply tailored filtering policies by subnet or private IP range, with enhanced reporting, CNAME identification, and agent awareness. It is bundled with Admin, not a separate SKU. This layer covers devices on the school network; it is not part of the off-campus enforcement path.

The Out-of-School Mode mechanism is the policy layer; the Chrome extension and the GoGuardian App are the off-network enforcement layers. The combination produces a filtering posture that follows the device regardless of network location, with district-controlled policy adjustments for school hours vs. home hours.

Frequently Asked Questions

What's the difference between on-network and off-network filtering?

On-network filtering applies when the device is on a school network, typically via an appliance, proxy, or DNS server on the campus network. Off-network filtering applies when the device leaves campus and connects to home wifi, public networks, or cellular. The on-network case is the historical default for K-12 web filtering. The off-network case is the gap that emerged when 1:1 device programs sent Chromebooks, iPads, and Windows laptops home with students. Most modern K-12 filters address both via a device-level extension or on-device app that follows the device regardless of network location.

How reliable is off-network filtering on a take-home Chromebook?

Chromebook off-network coverage is consistent across the three major vendors because all three deliver Chromebook filtering via Chrome extension, which is the OS-level managed channel for ChromeOS. ChromeOS architecture constrains student web activity to the managed browser, so extension-based filtering covers the device's web traffic comprehensively. The reliability question is more interesting on Windows, macOS, and iPad, where vendor architectures diverge (kernel agent vs. on-device app vs. extension-only). Districts running mixed-OS fleets should ask each vendor for the specific delivery mechanism per OS during RFP review.

Which K-12 web filter has the best off-network protection: GoGuardian, Lightspeed, or Securly?

Each architecture has honest trade-offs. Lightspeed's kernel-level SmartAgent on Windows/macOS/iOS provides system-level filtering at the OS layer. GoGuardian's extension + on-device app hybrid filters web traffic across every browser on Windows/macOS/iPadOS via the GoGuardian App (it does not filter non-browser application traffic the way a kernel-level agent does), plus extension coverage on Chromebook. Securly's Extension or SmartPAC hybrid forces a feature-parity trade-off depending on method choice. The "best" depends on the district's device fleet and feature requirements: a Windows-heavy district may weight kernel-agent coverage; a mixed-fleet district may weight the program operations and parent communication layer. See the GoGuardian vs Lightspeed off-network comparison and GoGuardian vs Securly off-network comparison for the per-vendor head-to-head detail.

Does GoGuardian's off-network filtering actually work at home?

Yes, via the GoGuardian App on Windows, macOS, and iPadOS (delivered via MDM) and the Chrome extension on Chromebook (delivered via Google Admin Console). The GoGuardian App filters web traffic across every browser on the device, on or off the network, and keeps enforcing district policy when the device leaves campus. It does not filter non-browser application traffic the way a kernel-level agent does. GoGuardian Admin filters on and off the school network with no feature degradation off-network, provided the student stays signed into a school-managed account on a managed device. The Out-of-School Mode mechanism applies the district's off-campus policy set, which administrators configure independently of the on-campus policy.

What's Out-of-School Mode and how does it differ from After School Rules or Take-Home Policy?

Out-of-School Mode is GoGuardian Admin's off-network policy mechanism. It uses time-of-day scheduling and public-IP-range detection to determine which policy set is active. During school hours on a recognized district network, the standard policy applies. Outside those windows, the Out-of-School policy set takes effect. The analogs at other vendors: Lightspeed's After School Rules (time-of-day-driven) and Securly's Take-Home Policy. All three mechanisms serve the same purpose (applying a different filtering policy to off-campus use vs. on-campus use), with slight differences in detection trigger (time, IP range, both) and policy configuration UI.

What devices does GoGuardian filter off-network?

GoGuardian's published off-network coverage includes Chromebook (via Chrome extension), Windows (via GoGuardian App, MDM-delivered), macOS (via GoGuardian App, MDM-delivered), and iPad (via GoGuardian App, MDM-delivered). Android is available today via GoGuardian's Gateway deployment. Gateway is being deprecated, so Android is not part of the GoGuardian App off-network coverage set.✓Verified · GoGuardian product team (Jun 9)Was: [Awaiting product team — Dec 2025 press named Android; /admin lists only ChromeOS/macOS/iPadOS/Windows.]

How does parent communication work for a 1:1 take-home program?

Parent communication for a take-home device program typically includes the take-home AUP (acceptable use policy), the off-campus monitoring disclosure, parent-facing visibility into filtering events, and a process for parents to flag concerns or request policy adjustments. Vendors differ on parent-facing collateral: Securly Home is a free parent app bundled with Filter, available on iOS and Android with English/Spanish/French UI. The GoGuardian Parent App is available on the Apple App Store and Google Play.✓Verified · feature scope (Jun 9); language still openWas: GoGuardian Parent App provides parent-facing visibility. [Awaiting feature scope and language support.] Parents can see a summary of their student's browsing activity and can pause internet access, block specific websites, and schedule internet availability on managed devices. [CLIENT TO VERIFY: multi-language support] Lightspeed does not publish a parent-facing app analog.

What's the difference between the GoGuardian App, the Chrome extension, and DNS Precision Filtering?

These are three layers of the GoGuardian Admin filtering stack. The Chrome extension applies to Chromebook (the OS-level managed channel). The GoGuardian App is an on-device app for Windows/macOS/iPadOS that filters web traffic across every browser on the device, on or off the network; it does not filter non-browser application traffic the way a kernel-level agent does. The Chrome extension and the GoGuardian App are the layers that follow a device off-campus. DNS Precision Filtering, released November 2025, enhances GoGuardian Admin's on-premises DNS filtering to protect all devices connected to the school network, including unmanaged and BYOD devices; it is an on-network and BYOD capability, not part of the off-campus enforcement path. The relevant mechanism on a given device depends on its OS, how it accesses the internet, and whether it is on or off the school network.

Does GoGuardian work with our MDM platform?

GoGuardian Admin's Windows, macOS, and iPadOS deployment depends on MDM enrollment. GoGuardian App MDM support covers the vendors with official setup guides. Windows: Active Directory, Intune, and PDQ. iPadOS: Jamf Pro, Jamf School, Intune, Meraki, FileWave, Workspace ONE/AirWatch, Iru (formerly Kandji), Mosyle, and Addigy. macOS: Jamf Pro, Jamf School, Intune, Meraki, FileWave, Iru (formerly Kandji), and Mosyle. Manual deployment is also supported, and in practice any MDM that can push apps (plus registry keys on Windows, or mobileconfigs on iPad and macOS) works.

What case studies exist for GoGuardian off-network deployments in 1:1 programs?

[CLIENT TO PROVIDE: published district case studies documenting GoGuardian Admin off-network deployments in 1:1 take-home programs. These likely exist but may not be packaged for the web in the off-network framing specifically.]