How WatchTower IT Solutions Replaced Its DNS Filter With Browser-Level Control

WatchTower IT Solutions is a managed service provider supporting small businesses across Washington state. Tony Sollars launched the company with his wife roughly three years ago, after close to a decade running and growing another MSP.

Sollars came up through enterprise IT, with network engineering, Active Directory, and Exchange work inside Fortune 500 and Fortune 200 companies, followed by consulting engagements that required federal security clearance. He built WatchTower to bring that same standard of practice to businesses that rarely get access to it: standardized equipment, standardized processes, frameworks like MITRE, and conversations held in plain language rather than jargon.

Trust is the operating principle. Sollars tells the story of a law firm that already had capable IT support, where he told the senior partner outright that switching would not get them better service. The partner now wants to refer business his way.

The browser was the next problem coming, and the available fixes all asked users to change how they work

Sollars saw browser risk building before most of his clients felt it. AI tools were about to land in every workflow, free and compromised extensions were multiplying, and users were saving passwords straight into their browsers out of habit. WatchTower already restricted admin rights on client workstations, but that control was quietly losing ground, because AI browsers install without needing admin privileges at all.

The browser security products he evaluated mostly asked for a trade he was not willing to make. Several required moving every user onto a separate, purpose-built browser, away from the one their whole company was already standardized on.

Meanwhile the DNS filtering already in WatchTower's stack covered only a narrow slice of the problem, and the team's own attempts at managing policy across different browsers had gone about as far as they could go.

An extension and agent that absorbed the DNS layer, then kept going past it

Atakama, a browser security platform, installs as a lightweight agent and browser extension on the browsers clients are already standardized on. No other product he had looked at could clear that bar. The DNS filtering tool came out of the stack, Atakama went in, and it took over that function while extending well beyond it.

Browser control was the first draw, before Atakama's AI policy features had even shipped. WatchTower could now determine which browsers were permitted to launch at all, closing the gap that admin restrictions no longer covered.

Password handling came next. Every new client onboarding now includes switching off the browser's ability to save new credentials, and deliberately leaving what is already stored in place.

Extension policy runs underneath all of it. WatchTower has Atakama's known-bad extension recommendations enforced across its client base, drawn from what Atakama sees across other environments alongside WatchTower's own research.

A rollout shaped around how each client was already set up

Clients joined to Microsoft Entra were straightforward to deploy. For the handful registered but not joined, WatchTower worked with the Atakama team to build a reusable email with an enrollment link, paired with a registry change that surfaced a prompt rather than letting the agent sit quietly unauthenticated in the background.

A credential problem nobody had measured, and AI prompts clients asked to keep running

The password policy produced the most immediate finding. When WatchTower switched on credential risk checks, tickets arrived in volume. Sollars assumed the tool was broken.

It was not a bug. Working through it client by client and user by user, the team found the flags were not dark web breaches at all. People were reusing one password across every system they touched, distinguished only by how many exclamation points they added on the end.

AI governance produced a different kind of result. WatchTower set a prompt to appear whenever a user navigates to an AI site, with paid Copilot deployments exempted because those are configured on purpose and governed already. The notable part was the reaction from clients who had written AI policies of their own and still chose to leave the prompt running.

The extension blocklist has been quiet by comparison, which is the point. It runs without attention and without generating complaints, adding a layer of protection the team does not have to manage day to day.

On the commercial side, Sollars points to contracting and billing that were straightforward to get through, and to the two-way feedback on regular calls with the Atakama team, which he notes is not something every vendor offers.