fitgap

BloxOne Threat Defense

Features
Ease of use
Ease of management
Quality of support
Affordability
Market presence
Take the quiz to check if BloxOne Threat Defense and its alternatives fit your requirements.
Pricing from
Contact the product provider
Free Trial
Free version unavailable
User corporate size
Small
Medium
Large
User industry
  1. Agriculture, fishing, and forestry
  2. Energy and utilities
  3. Transportation and logistics

What is BloxOne Threat Defense

BloxOne Threat Defense is a cloud-managed DNS security service that detects and blocks access to malicious or unwanted domains using DNS-layer policy enforcement. It is typically used by network and security teams to reduce phishing, malware command-and-control, and risky web destinations across corporate networks and roaming endpoints. The product integrates with Infoblox’s BloxOne platform and can apply security controls through recursive DNS services and policy rules. It emphasizes DNS-based visibility and control as a preventative security layer rather than endpoint-only detection.

pros

DNS-layer prevention and control

The product blocks threats at the DNS layer, which can stop many phishing and malware callbacks before a connection is established. DNS policy enforcement can apply broadly across users and devices without requiring full traffic inspection. This approach can reduce reliance on endpoint-only controls for common web-borne threats. It also supports use cases where encrypted traffic limits traditional inspection methods.

Cloud-managed policy administration

Centralized management supports consistent DNS security policies across sites and remote users. Cloud delivery reduces the need to operate on-prem DNS security infrastructure for some deployments. Policy changes can be rolled out quickly across multiple locations. This can simplify administration compared with managing disparate DNS security configurations per site.

Integrates with Infoblox ecosystem

BloxOne Threat Defense aligns with Infoblox DNS/DHCP/IPAM and related BloxOne services, which can streamline operations for organizations already using that stack. Shared telemetry and configuration models can reduce integration effort between DNS operations and security controls. It can also support workflows where DNS data is used for investigation and response. This can be useful when correlating DNS activity with other security events.

cons

Limited beyond DNS layer

DNS-layer controls do not detect threats that do not rely on DNS, use hard-coded IPs, or operate entirely within allowed domains. It also cannot replace deeper network detection, endpoint telemetry, or full packet/flow analysis for many incident response needs. Organizations typically still need complementary controls for lateral movement, credential abuse, and non-DNS protocols. As a result, it is best positioned as one layer in a broader security architecture.

Efficacy depends on DNS routing

To enforce policy, client devices and networks must consistently use the designated recursive DNS path. Misconfigurations, split DNS designs, or users bypassing DNS settings (intentionally or via apps) can reduce coverage. Roaming user protection may require additional configuration or endpoint components depending on the deployment model. These operational dependencies can add rollout complexity in heterogeneous environments.

Potential overlap with existing tools

Organizations that already operate secure web gateways, firewall DNS security features, or endpoint web protection may see functional overlap. This can complicate tool rationalization and policy ownership between network and security teams. Achieving clean integration with existing logging, SIEM, and incident response workflows may require additional engineering. Buyers often need to validate incremental value relative to current DNS and web controls.

Plan & Pricing

Pricing model: Token-based (prepaid Tokens allocated by Token Type). Details (from vendor site): Infoblox offers BloxOne / Threat Defense under a token-based licensing model (Security Tokens and Reporting/Allocation tokens) — customers prepay for a set number of Tokens which are allocated to selected Token Types; tokens expire at the end of the term and are non‑refundable unless agreed in writing. The vendor also states a legacy (licensed-capacity) model remains for some orders. (See vendor supplemental terms for Token pricing mechanics.) Free tier/trial: A product evaluation / free trial is supported via a request form (vendor-hosted evaluation page). Detection Mode is also provided as an "easy-to-try" mode to test Threat Defense without changing DNS configuration and there are Early Access / preview programs for some Detection Mode features. Example costs: Not published on the vendor website (no per-token or per-user dollar amounts are listed). How to buy / pricing visibility: Public pricing (cost per Token / Token bundles) is not published on Infoblox’s public product pages or legal terms; Infoblox requires contact with sales / a trial request to obtain pricing and to purchase Tokens. Discounts / overages: No public discount schedule published. Supplemental Terms describe quarterly usage reviews and procedures for overages and additional Token purchases (additional Tokens co‑terminate with the original Order).

Seller details

Infoblox Inc.
Santa Clara, CA, USA
1999
Private
https://www.infoblox.com/
https://x.com/infoblox
https://www.linkedin.com/company/infoblox/

Tools by Infoblox Inc.

Infoblox NIOS
BloxOne DDI
BloxOne Threat Defense

Best BloxOne Threat Defense alternatives

Infoblox NIOS
Cisco Umbrella
DNSFilter
Cisco Secure Access
See all alternatives

Popular categories

All categories