GoGuardian Admin vs Lightspeed Filter: Off-Network Architecture, OS Coverage, and Program Operations Compared
Last updated
GoGuardian Admin and Lightspeed Filter take different architectural approaches to off-network filtering. Lightspeed runs a kernel-level driver agent (SmartAgent) on Windows, macOS, and iOS, with a DNS appliance (SmartShield) for agent-less devices. GoGuardian runs an on-device GoGuardian App via MDM on Windows, macOS, and iPadOS, with Chrome extension on Chromebook (same as Lightspeed on Chromebook). This page covers what each architecture is structurally best at, where each one's published gaps are, and which district profile fits which approach.
Capability Comparison
A capability comparison across GoGuardian Admin and Lightspeed Filter on the dimensions that separate them for off-network filtering. For the broader vendor comparison beyond off-network (filtering on-campus, classroom management, safety monitoring, etc.), see the full GoGuardian vs Lightspeed comparison. For the Securly head-to-head, see the sibling sub-page.
| Capability | GoGuardian Admin | Lightspeed Filter |
|---|---|---|
| Architecture family | Extension + on-device app hybrid | Kernel-level driver agent + DNS appliance |
| Chromebook delivery | Chrome extension | Chrome extension (same architecture as GoGuardian on this OS) |
| Windows delivery | On-device GoGuardian App via MDM | Kernel-level SmartAgent |
| macOS delivery | On-device GoGuardian App via MDM | Kernel-level SmartAgent |
| iPad (iPadOS) delivery | On-device GoGuardian App via MDM | Kernel-level SmartAgent |
| Android coverage | Available today via GoGuardian's Gateway deployment. Gateway is being deprecated, so Android is not part of the GoGuardian App off-network coverage set. | Not in published SmartAgent OS list |
| Off-network policy mechanism | Out-of-School Mode (time-of-day + public-IP-range scheduling, automatic off-campus detection) | After School Rules (time-of-day-driven) |
| Off-network pricing | Per-student paid; sales-gated | Included in base Filter SKU; sales-gated |
| Parent-facing app | GoGuardian Parent App on the Apple App Store and Google Play. Parents can see a summary of their student's browsing activity and can pause internet access, block specific websites, and schedule internet availability on managed devices. [CLIENT TO VERIFY: multi-language support] | None published |
| Take-home program collateral | Not currently published. | None published (no downloadable program guide on the Lightspeed marketing surface) |
| MDM platforms supported by name | Windows: AD, Intune, PDQ. iPadOS: Jamf Pro, Jamf School, Intune, Meraki, FileWave, Workspace ONE/AirWatch, Iru, Mosyle, Addigy. macOS: Jamf Pro, Jamf School, Intune, Meraki, FileWave, Iru, Mosyle. Manual also supported. | SCCM / Microsoft Endpoint Manager, Group Policy, Google Admin, generic third-party MDM; Lightspeed MDM for iOS. No comprehensive named list published. |
| Certifications | SOC 2 [CLIENT TO VERIFY: Type II designation], iKeepSafe FERPA, iKeepSafe COPPA | SOC 2 Type II, ISO 27001, PCI DSS |
| Off-network product velocity (last 24 months) | Windows stability across network interruptions (Dec 2025), DNS Precision Filtering (November 2025), an on-premises DNS filtering enhancement for devices on the school network, Theft Recovery off-campus filtering (Jul 2025) | 2024–2025 press: STOPit acquisition + connectivity assessment (adjacent product lines); Filter in steady state on off-network |
The architecture-family difference (kernel agent vs hybrid) is the main structural divide. The OS-coverage gap (Android), the parent-app gap (Lightspeed has none), and the program-operations gap (downloadable Take-Home Device Program Guide) are the specific dimensions where the two vendors diverge in published collateral. The product-velocity gap is the temporal dimension: GoGuardian has shipped four off-network-adjacent features in the last 24 months; Lightspeed's press cycle has focused on STOPit acquisition and connectivity assessment in adjacent product lines.
Architecture Deep Dive
The architectural choice between kernel agent and extension + on-device app hybrid is real and structural. Each approach has honest strengths.
Kernel-level driver agent (Lightspeed's approach on Windows, macOS, iOS)
Lightspeed's SmartAgent installs at the OS driver layer and intercepts traffic before it leaves the device. Every browser, every application, and every protocol on the device is in scope for the filter, not just web traffic in a managed browser. Because the agent operates at the OS layer, applications that do not route through a managed browser (for example third-party browsers, or application-level traffic to social media APIs) are also filtered.
The trade-offs: deployment requires admin-level OS access through MDM enrollment, which means every device in the fleet must be in MDM enrollment. The agent is per-OS-coded, so coverage depends on which OSes Lightspeed has shipped agents for (currently Windows, macOS, iOS, not Android in the published OS list). And the agent is a driver-level component, which means OS updates can require Lightspeed agent updates to maintain compatibility.
Extension + on-device app hybrid (GoGuardian's approach on Windows, macOS, iPadOS)
GoGuardian Admin uses an on-device GoGuardian App on Windows, macOS, and iPadOS (delivered via MDM enrollment, same channel Lightspeed uses for SmartAgent) plus the Chrome extension on Chromebook. The app filters web traffic across every browser on the device, on or off the network, and keeps enforcing district policy when the device leaves campus.Verified · GoGuardian product team (Jun 9)Was: “The on-device app provides system-level filtering across browsers and applications, similar in coverage scope to a kernel agent.” That browser-agnostic coverage handles the core of what K-12 districts filter for: the web content students reach through a browser. The structural strengths are broad OS coverage with iPadOS as a first-class platform, no feature degradation off the network, and lower sensitivity to OS updates than a driver-level agent.
The trade-offs: the on-device app is a user-space component rather than a driver-level component, which can mean different OS update sensitivities (typically lower OS-update sensitivity, since the app is not in the kernel). The Chrome extension on Chromebook is the same delivery channel as Lightspeed and Securly on this OS. ChromeOS architecture constrains all three vendors to extension-based delivery, so the kernel-vs-hybrid divide doesn't apply on Chromebook.
Chromebook delivery: both vendors are extension-based
A common procurement-decision misconception: Lightspeed's marketing emphasizes the kernel-level SmartAgent, which can imply Chromebook coverage is also kernel-level. It's not. ChromeOS architecture constrains all three K-12 filtering vendors (GoGuardian, Lightspeed, Securly) to Chrome extension delivery on Chromebook. The kernel-agent vs hybrid distinction applies to Windows, macOS, and iPad, not to Chromebook. A district that's 100% Chromebook will see all three vendors as architecturally equivalent on coverage, because all three deliver Chromebook filtering through the same OS-managed channel.
For the broader off-network architecture comparison across all three vendors (GoGuardian, Lightspeed, Securly), see the off-network filtering hub.
When to Choose Each
The architectural choice between GoGuardian Admin and Lightspeed Filter for off-network is district-fleet-dependent. The trade-off frames:
Choose GoGuardian Admin when…
The district runs a mixed-platform fleet that includes iPad as a first-class platform, the district places weight on take-home program collateral (parent-facing app, program guide, parent communication templates), or the district's evaluation values active product velocity on off-network filtering specifically.
GoGuardian's coverage spans Chromebook (extension), Windows / macOS / iPadOS (on-device GoGuardian App via MDM), with iPadOS as a fully-supported first-class platform. The GoGuardian Parent App is published as a parent-facing visibility layer (activity summary, pause internet, block sites, schedule availability; [CLIENT TO VERIFY: multi-language support]). Lightspeed has no published parent app analog. GoGuardian's product velocity on off-network capability is visible in the last 24 months: Windows stability across network interruptions (December 2025), DNS Precision Filtering (November 2025), an on-premises DNS filtering enhancement for devices on the school network, Theft Recovery off-campus filtering (July 2025). Lightspeed's 2024-2025 press has emphasized STOPit acquisition and connectivity assessment, with the Filter product treated as steady-state on off-network.
The trade-off: GoGuardian's on-device app is a user-space component rather than a driver-level agent. It filters web traffic across every browser on the device, on or off the network, which is the filtering job most K-12 districts are buying for. Lightspeed's SmartAgent additionally filters non-browser application traffic. Districts that have built RFP criteria specifically around driver-layer coverage can weigh that difference; for districts whose need is browser-delivered web content, GoGuardian delivers that coverage with iPad as a first-class platform, no feature degradation off campus, and lower OS-update sensitivity.
For the broader GoGuardian product portfolio beyond Admin (classroom management with Teacher, safety monitoring with Beacon, the Safety & Security solution), see the full vendor comparison at GoGuardian vs Lightspeed Systems.
Where Lightspeed Filter fitsCopy updated · competitor framingWas: “Choose Lightspeed Filter when…”
The district runs a Windows-heavy or Windows-and-macOS fleet (with no iPad or Android requirement), the district has built RFP criteria around kernel-level driver agent architecture specifically, or the district places weight on certifications that Lightspeed publishes but GoGuardian does not (ISO 27001, PCI DSS at the time of this writing).
Lightspeed's kernel-level SmartAgent on Windows, macOS, and iOS provides driver-layer filtering across every browser and application on the device. The certification stack (SOC 2 Type II, ISO 27001, PCI DSS) includes ISO 27001 and PCI DSS, which GoGuardian's current published stack does not list.Copy updated · competitor framingWas: “…is broader on the security-attestation side than GoGuardian's current published stack.”
The trade-off: Lightspeed has no published parent-facing app analog, no published take-home program guide collateral, and no Android coverage in the SmartAgent OS list. Districts that need program operations support (parent communication, AUP templates, multi-language parent kits) will source those from third-party districts (e.g., the district-side parent kits circulating from KMSD, USD263 templates that overlap with the broader Securly + Lightspeed customer base) rather than from Lightspeed directly.
Frequently Asked Questions
What's the actual architectural difference between GoGuardian Admin and Lightspeed Filter off-network?
GoGuardian runs a Chrome extension on Chromebook and an on-device GoGuardian App on Windows, macOS, and iPadOS (delivered via MDM enrollment). Lightspeed runs a Chrome extension on Chromebook and a kernel-level driver agent (SmartAgent) on Windows, macOS, and iOS. On Chromebook, the two architectures are equivalent (both extension-based; ChromeOS architecture constrains all vendors to this channel). On Windows, macOS, and iPad, the structural difference is a user-space app versus a driver-level agent. GoGuardian's app filters web traffic across every browser on the device; Lightspeed's SmartAgent additionally filters non-browser application and protocol traffic. The two differ both in implementation layer and in the scope each one covers.
Which vendor has better Chromebook off-network coverage?
The two vendors are architecturally equivalent on Chromebook. Both deliver filtering via Chrome extension through Google Admin Console. ChromeOS architecture means the Chrome extension is the OS-level managed channel for filtering, so the practical coverage is consistent regardless of vendor. The differentiating dimensions on Chromebook are policy mechanism (GoGuardian's Out-of-School Mode vs Lightspeed's After School Rules), parent-facing app visibility (GoGuardian has the Parent App; Lightspeed does not), and program operations collateral (take-home program guides, parent communication templates).
Which vendor has better Windows / macOS off-network coverage?
The two differ in coverage scope, not just implementation.Verified · GoGuardian product team (Jun 9)Was: “Both provide system-level filtering across browsers and applications on these OSes… weigh that against the practical coverage parity.” GoGuardian's user-space app filters web traffic across every browser on the device, on or off the network, with no feature degradation off campus. That handles the core of what K-12 districts filter for, the web content students reach through a browser. Lightspeed's kernel-level SmartAgent sits at the OS driver layer and additionally filters non-browser application and protocol traffic. The user-space approach also gives GoGuardian broader OS coverage, with iPad as a first-class platform, and lower sensitivity to OS updates. Districts that have built RFP criteria specifically around driver-layer coverage can weigh that against GoGuardian's OS breadth, off-network parent visibility, and unified single-app deployment.
Does GoGuardian cover Android off-network? Does Lightspeed?
Available today via GoGuardian's Gateway deployment. Gateway is being deprecated, so Android is not part of the GoGuardian App off-network coverage set.Verified · GoGuardian product team (Jun 9)Was: “[Awaiting product team — Dec 2025 press named Android; /admin lists only ChromeOS/macOS/iPadOS/Windows]” Lightspeed does not publish Android in its SmartAgent OS list. Districts that need Android off-network coverage should ask both vendors directly during procurement.
Which vendor publishes a parent-facing app for take-home device visibility?
The GoGuardian Parent App is available on the Apple App Store and Google Play. Parents can see a summary of their student's browsing activity and can pause internet access, block specific websites, and schedule internet availability on managed devices. [CLIENT TO VERIFY: multi-language support] Lightspeed does not publish a parent-facing app analog. For districts that have made parent communication a procurement criterion (particularly districts running 1:1 take-home programs where parent visibility into student device activity is a board-level expectation), the absence of a Lightspeed parent app is a material gap.
Which vendor publishes take-home program operations collateral?
A GoGuardian Take-Home Device Program Guide PDF is not currently published. Lightspeed does not publish a downloadable take-home program guide, sample AUP templates, or parent communication kits as part of the Filter marketing surface. The district-side parent kits that circulate (Bristol, KMSD, USD263) overlap with broader Securly + Lightspeed customer bases but are not authoritative Lightspeed-published collateral.
What's the certification difference between GoGuardian Admin and Lightspeed Filter?
Lightspeed publishes SOC 2 Type II, ISO 27001, and PCI DSS on its trust page. GoGuardian publishes SOC 2 [CLIENT TO VERIFY: Type II designation], iKeepSafe FERPA, and iKeepSafe COPPA on its privacy and trust page. Lightspeed's stack includes ISO 27001 and PCI DSS; GoGuardian's stack includes iKeepSafe FERPA and iKeepSafe COPPA, the K-12-specific student-data privacy attestations. The two stacks emphasize different procurement criteria: Lightspeed lists security attestations (ISO 27001, PCI DSS); GoGuardian lists K-12 student-data privacy attestations (iKeepSafe FERPA, COPPA).
Which vendor is actively shipping off-network features in 2026?
GoGuardian's last 24 months include four off-network-adjacent feature releases: Windows stability across network interruptions (December 2025), DNS Precision Filtering (November 2025), an on-premises DNS filtering enhancement for devices on the school network, Image Filtering, Theft Recovery off-campus filtering (July 2025). Lightspeed's 2024-2025 press cycle has emphasized the STOPit acquisition and connectivity assessment (adjacent product lines), with the Filter product treated as steady-state on off-network. For districts evaluating product-velocity as a procurement signal (particularly districts whose RFP criteria include vendor roadmap visibility), the off-network-specific velocity story is asymmetric in this comparison.