Every few years, school IT directors face the same high-stakes decision: which web filter should we trust with student safety?

It's a decision that affects thousands of students, dozens of teachers, and your entire compliance posture. Get it right and it runs quietly in the background. Get it wrong and you're drowning in support tickets, angry teachers, and a board that wants answers.

After talking to hundreds of school IT teams, we've identified the 10 most important factors that separate a great web filter from one that'll make your life miserable. This isn't a product pitch — it's a framework you can use to evaluate any vendor, including us.

1. Filtering Architecture: Agent vs. Proxy vs. DNS

This is the single most important technical decision, and most buyers don't even know to ask about it.

DNS-Based Filtering

DNS filters (like OpenDNS or CleanBrowsing) block at the domain level. They're cheap and easy to deploy, but they're blind to HTTPS content. A DNS filter can block pornhub.com but can't distinguish between a clean YouTube video and an explicit one — it's the same domain.

Best for: Home networks, very small schools with zero budget

Agent-Based Filtering (GoGuardian, Securly)

Agent filters install software on each device. The agent inspects traffic locally and reports back to a cloud dashboard. This gives good visibility but comes with tradeoffs:

Battery drain (10-20% on iPads and laptops)
Per-device installation and update management
Students can sometimes disable browser extensions
Platform-dependent — an agent built for Chromebooks may struggle on iPads

Best for: Chromebook-heavy districts that want tight Google integration

Proxy-Based Filtering (KyberGate)

Proxy filters route all web traffic through a cloud inspection point. The device connects to the proxy via a PAC file pushed through MDM — no per-device software required. Traffic is inspected, filtered, and logged server-side.

Zero battery impact — filtering happens in the cloud
Full HTTPS inspection — sees inside encrypted connections
Can't be uninstalled by students (it's a network configuration, not an app)
Platform-agnostic — works on any device that supports PAC

Best for: iPad-heavy or mixed-device environments, districts that want deep content inspection

For a technical deep dive on this, read our iPad filtering architecture comparison.

2. Device Coverage: Test Your Actual Fleet

Don't trust a vendor's "supported platforms" page. Test on your actual devices.

The questions to ask:

Does it work on iPads without killing battery?
Does it work on managed Chromebooks and BYOD Chromebooks?
Does it filter Windows and macOS with the same depth?
Can BYOD devices be filtered without requiring an app install?
Does it handle shared/cart iPads (no individual user sign-in)?

Many vendors excel on one platform and are mediocre on others. GoGuardian is strongest on Chromebooks. KyberGate was built iPad-first. Securly works broadly but lacks deep HTTPS inspection on some platforms.

Pro tip: Set up 20 test devices with your top 2-3 vendors. Run them side-by-side for 2 weeks. You'll learn more in those 2 weeks than from 10 sales demos.

3. Pricing: Total Cost of Ownership

Sticker price is meaningless. Total cost of ownership (TCO) is what matters.

Hidden Costs to Watch For

Module unbundling: Some vendors sell filtering, safety monitoring, and classroom management as separate products. A $6/device filter becomes $16/device when you add Beacon + Teacher.
Implementation fees: Some charge $5,000-$15,000 for "onboarding" — which is just configuring what your IT team could set up in a day.
Renewal increases: Year 1 pricing is often a loss leader. Ask for the Year 2 and Year 3 rates in writing.
Minimum seat counts: Some vendors won't sell to schools under 500 devices, or charge a premium for small deployments.
Training costs: Is training included, or is it $2,000/day for "professional development"?

Price Comparison (2,000 devices, 3-year contract)

Vendor	Year 1	3-Year TCO	Includes Safety Monitoring?
GoGuardian (full suite)	~$30,000	~$90,000	Separate product (Beacon)
Securly (full suite)	~$24,000	~$72,000	Separate product
Lightspeed (full suite)	~$28,000	~$84,000	Separate product (Alert)
KyberGate Pro	$18,000	$54,000	✅ Included (KyberPulse)

All four vendors are E-Rate eligible, which can reduce costs by 20-85% depending on your discount rate.

For a deeper financial analysis, see our ROI calculation guide.

4. CIPA Compliance (Table Stakes)

Every web filter claims CIPA compliance. The real question is: does it make compliance easy or just possible?

Look for:

Automated compliance reports you can hand to auditors
Pre-built policy templates for different grade levels
Audit logs showing policy changes with timestamps and who made them
E-Rate documentation support — does the vendor help with your Form 470/471?

CIPA compliance is the floor, not the ceiling. Read our CIPA compliance checklist to understand what's actually required.

5. Game Blocking: The Teacher Satisfaction Test

Here's a secret that web filter vendors don't like to talk about: teacher satisfaction with a web filter is almost entirely determined by how well it blocks games.

Teachers don't care about CIPA compliance or HTTPS inspection. They care about whether little Timmy is playing Retro Bowl during math class.

What to Test

Block sites.google.com/view/unblocked-games-* — this is where 70% of school gaming happens
Block games embedded in Google Sites, GitHub Pages, and Replit
Block the Chrome Dino game (chrome://dino)
Search "unblocked games" on Google — does the filter catch it?
Try 5 random gaming proxy sites — how many get through?

Most filters rely on domain blocklists and miss games hosted on legitimate platforms. KyberGate uses an 8-layer game detection engine that catches games hidden on Google Sites, detects game rendering via canvas fingerprinting, and blocks gaming search patterns in real time.

6. Student Safety Monitoring

Web filtering blocks access. Safety monitoring saves lives.

Since 2018, there's been a growing expectation (and in some states, a legal requirement) that schools monitor student online activity for signs of self-harm, bullying, violence, and exploitation.

Three Levels of Safety Monitoring

Level 1: Browsing alerts only The filter flags visits to concerning websites (suicide hotline, weapons forums, etc.). This is basic and most filters include it.

Level 2: Content scanning The system scans content students create — Google Docs, Gmail, search queries — using NLP to detect concerning language. KyberPulse operates at this level, monitoring 17 danger categories across Google Workspace.

Level 3: 24/7 human review A team of human reviewers monitors flagged content around the clock. Securly, Bark, and GoGuardian Beacon offer this. It's expensive and adds latency — a flagged alert may not reach a counselor for 20-40 minutes.

Our take: Level 2 (AI-powered content scanning) hits the sweet spot of speed, coverage, and cost. Human review adds cost and delay without proportional safety improvement for most schools.

7. Classroom Management Integration

Teachers need to be able to:

See what students are doing in real time
Push a URL to every student device at once
Lock devices during tests or lectures
Restrict browsing to specific sites during a lesson

Some vendors (GoGuardian, Securly) sell classroom management as a separate product at an additional cost. Others (KyberGate) include it in the base platform.

The question to ask: Can teachers use classroom tools without IT admin intervention? If a teacher needs to submit a helpdesk ticket to start a focus session, the tool has failed.

8. Reporting That Administrators Actually Use

Every vendor has a "reporting" page with impressive screenshots. The real question: will your principal actually open these reports?

Look for:

Weekly email digests that summarize key metrics automatically
One-click PDF export for board presentations
Student risk scoring that highlights who needs attention (not just raw data)
Incident timelines that show a student's browsing history in context

Reports that require logging into a dashboard and running queries are reports that nobody will ever read. The best reporting is proactive — it comes to you.

KyberGate's weekly report card and student risk scoring are designed to surface actionable insights without requiring admin time.

9. Deployment and Ongoing Management

Deployment questions:

How long does initial setup take? (Should be under 1 day for most districts)
Does it require MDM? Which MDMs are supported?
Is there a guided setup wizard?
Can you deploy to 10 test devices before going district-wide?

Ongoing management questions:

How are policy changes made? (UI? API? Support ticket?)
How quickly do policy changes propagate? (Seconds? Minutes? Hours?)
Can individual schools within a district have different policies?
Is there an API for automation and integration?

KyberGate deploys in under 30 minutes via MDM profile push, and policy changes propagate in real-time via Firestore. For a step-by-step walkthrough, read our deployment guide.

10. Vendor Stability and Support

This one is underrated. Your web filter vendor needs to be around in 3 years.

Red flags:

Vendor has been acquired twice in 5 years (priorities shift with each acquisition)
Support is email-only with 48-hour SLAs
No documentation or knowledge base
Contract requires 3-year commitment with no exit clause
Pricing increases aren't capped in the contract

Green flags:

Named support contact (not just a ticket queue)
Active product roadmap shared with customers
Transparent pricing published on website
Month-to-month or annual contracts (no multi-year lock-in)
Active community or user forum

The Evaluation Checklist

Here's a one-page checklist you can print and use when evaluating vendors:

[ ] Architecture matches your device fleet (agent vs. proxy vs. DNS)
[ ] Tested on your actual devices — iPads, Chromebooks, Windows, BYOD
[ ] Total cost calculated — including modules, implementation, renewal increases
[ ] CIPA compliance with automated reporting
[ ] Game blocking tested with real student bypass techniques
[ ] Safety monitoring included (not a $4/device add-on)
[ ] Classroom management available to teachers without IT intervention
[ ] Reporting is proactive (email digests, not just dashboards)
[ ] Deployment under 1 day for your district size
[ ] Contract terms are fair (annual, capped increases, exit clause)
[ ] E-Rate eligible with SPIN number available

Bottom Line

The web filter market is crowded, but the differences are real. Architecture matters. Total cost matters. Game blocking matters way more than most vendors admit.

Don't buy based on a sales demo. Buy based on a 2-week pilot with your actual devices, your actual students, and your actual teachers.

If you want to see how KyberGate performs in your environment, start a free 30-day pilot — no contract, no credit card, no sales call required.

How to Choose a Web Filter for Your School District: The 2026 Buyer's Guide