Architecture Deep Dive
Enforcement location is the most consequential decision in K-12 filtering. This page breaks down exactly how each architecture performs across the scenarios that define whether your policy actually holds.
How Each Architecture Performs Across Critical Dimensions
This comparison maps each filtering architecture against the dimensions that matter most to K-12 districts in 2026.
| Dimension | Inline / Network-Based | Cloud-Based (DNS / Proxy) | Hybrid (Cloud + Inline + Agents) | Lightspeed Filter |
|---|---|---|---|---|
| Coverage & Enforcement | ||||
| On-Campus Coverage | Strong | Strong | Strong | Strong |
| Off-Campus Consistency | Requires tunnel / VPN | DNS routing dependent | Consistent | Consistent |
| Hotspot / Cellular Use | No visibility | Variable | Consistent | Consistent |
| BYOD / Unmanaged Devices | On-network only | Partial | Deployment dependent | Managed devices |
| Traffic Visibility & AI | ||||
| Encrypted Traffic (HTTPS) | Gateway SSL inspection (config-dependent) | Proxy-dependent; varies | Device-level inspection | Full |
| AI Platform Filtering (ChatGPT, Gemini, Copilot) | Domain-only blocking | Domain / URL blocking; gaps | Granular control | Granular |
| Non-Browser App Traffic | Limited | Not covered by DNS | Inspectable at endpoint | Covered |
| Proxy Evasion / VPN Detection | Visible on network | Blocklist dependent | Inspectable at endpoint | Covered |
| Identity & Policy | ||||
| Per-User Policy | Limited | Auth-dependent | Supported | Supported |
| Grade / Group-Level Policies | Partial | Partial | Supported | Supported |
| Time-Based Policy | Network-time dependent | Segmentation dependent | Device-level control | Supported |
| Reporting & Compliance | ||||
| Reporting Consistency | Network-dependent | Identity-dependent | Device-consistent | Consistent |
| CIPA Compliance | Supported | Supported | Supported | Supported |
| Parent Home Visibility | Limited | Policy dependent | Consistent | Supported |
| Hardware & Infrastructure | ||||
| Hardware Required | Yes — appliance or gateway | No hardware needed | Optional | Optional |
| Optional Managed Hardware | Not offered | Not offered | Vendor-dependent | Devices, APs, Routers |
| Primary Operational Risk | Blind spots off campus | Identity gaps, latency | Deployment discipline required | Deployment |
Capability ratings reflect general architectural characteristics. Specific implementations may vary by vendor.
How Each Architecture Handles Real-World Situations
Architecture tradeoffs become concrete in these five scenarios. Every K-12 IT team will encounter them.
| Scenario | Inline / Network | Cloud / DNS | Hybrid (Cloud + Inline + Agents) | Best |
|---|---|---|---|---|
| Student on cellular hotspot Bypasses school Wi-Fi with a personal hotspot. | ✗ No visibility — not supported Student is off the school network entirely | ~ DNS / proxy dependent — partial Only if device routes through proxy | ✓ Consistent enforcement — full support Agent on the device enforces policy regardless of network | Hybrid architecture wins |
| BYOD unmanaged device Personal laptop on school network. | ~ On-campus only — partial No coverage once device leaves network | ~ Partial visibility — partial Depends on browser and DNS config | ~ Limited unless agent deployed — partial Requires agent installed on device | No clear winner |
| Proxy on shared domain Student uses a proxy hosted on a trusted domain. | ✓ Visible on network — full support Traffic passes through gateway | ✗ Blocklist dependent — not supported Domain may not be flagged | ✓ Inspectable at endpoint — full support Encrypted traffic inspected at device level | Hybrid architecture wins |
| YouTube: class vs. after hours Allowing instructional content, blocking leisure use. | ~ Network-time dependent — partial Time restriction applies, not user context | ~ Policy segmentation dependent — partial Requires identity auth to segment by user | ✓ Device-level control — full support Time-of-day + user-level policies at device | Hybrid architecture wins |
| Parent requesting home visibility Activity reporting on school devices at home. | ✗ Limited — not supported No reporting once device leaves campus | ~ Possible, policy dependent — partial Varies significantly by implementation | ✓ Consistent — full support Activity reported regardless of network | Hybrid architecture wins |
real-world stress tests
Where Current Filtering Architectures Breaks
| DNS-Only Temptation | DNS filtering is the easiest to deploy in BYOD environments but provides the least visibility. Encrypted HTTPS traffic and application behavior both bypass it entirely. |
| Identity Ambiguity | Shared and unmanaged devices weaken user-based policy enforcement. When identity is ambiguous, policies revert to network-level defaults — or fail to apply at all. |
| Partial Coverage | When enforcement only applies on campus, off-campus blind spots become predictable — and students quickly learn which networks free them from school policy. |
| Reporting Fragmentation | If enforcement varies by network path, reporting will vary too. Districts end up with an incomplete picture — potentially missing safety-critical events. |
In BYOD-heavy districts, the central question becomes: Is filtering tied to the network — or to the student and device?
A hybrid approach with on-device agents ensures the policy travels with the student, regardless of what network they’re on.
How Each Filtering Approach Handles the Hardest Problems
No architecture eliminates tradeoffs. Each approach has a specific set of strengths and a predictable set of failure modes.
Inline/Network-Based Filtering
Best for on-campus simplicity. Struggles off-campus.
- Simple deployment — no client software needed
- Centralized policy management at the gateway
- Good visibility for on-campus traffic
- Zero coverage when students leave the network
- Cellular hotspot use creates complete blind spots
- Hardware appliances add cost and maintenance
- SSL inspection requires additional configuration
Operational risk: Districts relying on inline-only filtering have no visibility or enforcement for any off-campus activity.
Cloud-Based / DNS Proxy
Good reach. Dependent on identity and routing.
- No hardware — fast deployment
- Can extend some coverage off-campus
- Compatible with cloud-first IT environments
- DNS-only leaves encrypted traffic uninspected
- Identity-based policies require reliable auth
- Cellular routing may bypass proxy entirely
- Non-browser app traffic often uncovered
Operational risk: Cloud/DNS approaches create a false sense of off-campus coverage. Identity drift and DNS routing gaps leave meaningful blind spots.
Hybrid: Cloud + Inline + Agents
Most complete. Requires deployment discipline.
- Agents follow the student on every network
- Inline hardware enforces policy on-campus at the network layer
- Cloud management unifies policy across all enforcement points
- Cellular hotspot use does not bypass filtering
- Full encrypted traffic inspection at the device
- User-level, grade-level, and time-based policies
- Consistent reporting regardless of location
- Agent must be deployed on every managed device
- BYOD unmanaged devices require a separate strategy
Operational risk: The deployment requirement is the primary challenge — but this architecture has the fewest enforcement blind spots of any approach. It’s the architecture Lightspeed Filter is built on.
Lightspeed Filter: Built on the Architecture that Holds Up.
Lightspeed Filter is built on a hybrid architecture — combining cloud-based management, on-device agents, and inline hardware enforcement. The result is consistent filtering on campus, at home, on cellular, and across every AI platform students use.
And for districts that want a single vendor for everything — Lightspeed Systems can supply the devices, access points, and network hardware too.
Hybrid
Cloud + Inline + Agents
The only architecture with no blind spots
All
Networks covered
Campus · Home · Cellular
One
Vendor for everything
Devices · APs · Routers · Software · Support
🔀
Hybrid Architecture
Cloud management + on-device agents + inline hardware. Every enforcement layer working together.
🤖
Granular AI Platform Control
Block, allow, or restrict ChatGPT, Gemini and Copilot by user, grade level, and time of day.
💻
Optional Managed Hardware
Need devices, access points, or routers? Lightspeed Systems can supply and manage the full infrastructure stack.
🔎
Encrypted Traffic Inspection
Full HTTPS inspection at the device covers traffic that DNS-only solutions miss entirely.
📊
Unified Reporting Everywhere
Activity reporting is consistent regardless of where a student connects. Complete picture, always.
👪
Hybrid Parent Visibility at Home
Families get insight into their child’s activity on school-managed devices at home.
Ready to pressure-test your current architecture?
Use the full RFP evaluation checklist to see how your existing solution stacks up.