A UTM firewall can cost twenty thousand zloty plus subscription. A sensible EDR for a 30-person company is a few hundred zloty a month and a month of rollout. Backups save your skin, but only after something has already happened. There's one layer of protection that costs a few zloty per user per month, deploys in two days, and blocks the majority of common malware before it even runs on the user's computer. It's called DNS filtering, and most Polish SMEs simply don't have it.
They don't have it not because it's expensive or hard. They don't have it because nobody sells it as a "wow product". You won't put it on a trade show slide. And it works better than plenty of things that do end up on trade show slides.
What this actually is
When an employee clicks the link "invoice_PolishPost_2026.pdf.exe" or an ad for "free Photoshop", their computer first does one unremarkable thing: it asks a DNS server for the IP address of the domain it wants to reach. That is the first second of every connection on the internet — turning pay-now.example.com into 185.243.115.42.
DNS filtering is simply setting up a DNS server in the company that knows a list of bad domains and refuses to resolve them. Instead of an IP it returns "no such domain". The user's computer never connects anywhere — so the malware has no way to pull down the real payload or phone home to its command server. The click ends on a blank "unknown site" page, not on a week of restoring from backups.
This is not antivirus. Antivirus reacts when the file is already on disk. DNS filtering reacts earlier — when the computer is only just asking where to fetch that file from.
Why it works better than you'd expect
Modern malware is almost 100% dependent on the internet. It rarely arrives "fully packaged" in one file. Usually the first stage is a tiny dropper that, once launched, connects to the attacker's server for stage two — the actual payload. Without that connection, the dropper is deaf and blind.
Ransomware works the same way. Before it encrypts data, it almost always contacts a C2 (command and control) server to fetch a key and check in. Block the DNS lookup, you block the connection, no encryption happens.
Phishing too. Ninety percent of the links in suspicious emails point to domains that have existed for a week and already show up on several reputation lists. DNS reputation databases update faster than users learn not to click.
A real example
At one of our clients — a 35-person logistics company in Wielkopolska, two locations, Comarch Optima as ERP, standard Microsoft 365 — we rolled out cloud-based DNS filtering. Cost: about 4 zloty per user per month. Deployment: two working days, mostly configuring policies and the router in the branch office.
After six weeks we looked at the logs. Blocked DNS queries: around 2,100. Most of it was grey-area — tracking ads, telemetry, some movie streaming sites someone poked at during a break. But among them we found three real incidents.
The worst: someone in accounting clicked a fake "Polish Post — missed parcel" link in an email. The domain had been registered six days earlier and had been on the reputation list for 20 hours. The DNS filter refused the lookup. Without that filter, the accountant would most likely have downloaded the archive, opened the file, launched the dropper, and the company would have been down for 2–5 days. Cost of blocking: 4 zloty. Cost if not blocked: hundreds of thousands.
This is not a "could have happened" slide from a vendor deck. It's three lines in a log file, with a specific date and a specific employee who to this day has no idea anything happened. That's what good protection is supposed to look like: invisible, cheap and effective.
Three ways to deploy it
Cloud service (the easiest). Cloudflare Gateway, NextDNS, DNSFilter, Cisco Umbrella. You register an account, get your own DNS server address, put it in the company router or in DHCP config. Done. A web panel shows logs, blocks, lets you write policies (accounting can reach banks, production only its suppliers). Price: from free (Cloudflare Gateway up to 50 users) to around 15 zloty per user per month for enterprise tiers.
Local server (for companies that like to own things). Pi-hole or AdGuard Home on a small server or a Raspberry Pi. Free, full control over blocklists, everything stays inside the company. Requires an administrator willing to look after it — one person, an hour a week. No commercial-grade reputation feed, so it catches less.
Filtering in the firewall (if you already have UTM). Fortinet, Sophos, WatchGuard — all of them have a category and domain filter module. If you already pay for that firewall, just turn it on. If you don't have one — don't buy it just for this, because a cloud service does the same thing for a fraction of the price.
For most SMEs up to 100 people, the practical recommendation is a cloud service. Simplicity of deployment and maintenance beats any other argument.
What DNS filtering doesn't do
It's not a silver bullet. It won't replace EDR, backups or phishing training. It blocks domains that are already on the lists — but a freshly registered, dedicated attack aimed at your company (a few hours after the domain was set up) can slip through. It doesn't see the content of the traffic — if malware connects directly to an IP rather than a domain, DNS never happens. It doesn't protect an employee working from home on their own line with the company VPN turned off.
Treat it as one layer among many. An external, cheap one that blocks 90% of the mass-scale stuff. The other layers — EDR on endpoints, MFA on accounts, 3-2-1 backups, team training — cover the rest. No single defence is enough. But without this one specific piece, the whole stack is much less stable.
What it actually costs
The bill for a 30-person company looks roughly like this. Cloudflare Gateway or NextDNS on the business plan: about 3 USD per user per month, which comes out to around 4,500 zloty per year. Deployment through a consultant: 1–2 working days, so 3,000–6,000 zloty one-off. Maintenance: a few minutes a week to review logs and unblock the occasional false positive.
Total: first year around 10,000 zloty. Each following year 4,500 zloty.
For comparison: one day of downtime in a 30-person company is usually well over 30,000 zloty in lost margin and production. That doesn't even count the cost of recovery and lost trust. DNS filtering pays for itself if it prevents one incident every ten years. In practice it prevents several a year — and most of the time you don't even know it did.
Where to start in your company
Start with a small pilot. Pick one service (Cloudflare Gateway has a free tier up to 50 users — plenty for a start). Configure it for one department or one site. Collect a week of logs. See how many queries got blocked, in what categories, whether there are any false positives for legitimate business. Then roll it out across the whole company.
The full operation shouldn't take more than two calendar weeks from decision to full coverage. If your current IT provider tells you it's a complex, multi-month project — they most likely just don't have it in their price list.
The best protection is the one the user never notices. DNS filtering works exactly like that — quietly, cheaply, and before anything has a chance to happen.