It would be helpful to have DNS filtering without the browser extension. The agent already runs in the Windows kernel, and I feel has as much control as necessary to be able to filter at the OS level without the extension.

While I understand a lot of functionality of the software comes from the browser extension with things like browser isolation, credential protection, and download/upload protection, we may have deployments where we would prefer to filter with the agent rather than the extension. Especially with how incognito mode is treated, as easy as the instructions are when you install an agent on a new machine and it's very simple for the user to enable in incognito, some users are less tech savvy and are still going to just not read it and try to browse the web anyway, and it makes for a user experience that is not as good.