When HOPLONai's Browser Security module blocks a website, triage it by threat category: malicious blocks get a prioritised investigation, policy violations get escalating reminders, and informational blocks are logged only. HOPLONai gives growing businesses a complete security operation: the tools, and the agentic AI team that operates them.
Trigger: a blocked web incident from Browser Security (DNS filtering, browser extension or EDR). Input: blocked URL, user, device, threat category, timestamp and the policy that fired.
Step 1: What type of block is it?
Malicious (phishing, malware, command-and-control): go to step 2.
Policy violation (gambling, adult content, hacking tools, unapproved apps): go to step 3.
Informational (ads, tracking, uncategorised): log it. No further action.
Step 2: How do I investigate a malicious block?
Collect context: user, device, URL, timestamp, category and the number of incidents for that user in the last 90 days.
Alert your security or IT lead by Slack or email with a summary, the user and device, and a link to the full log.
First or second incident in 90 days: notify the user and send safe-browsing guidance.
Third incident or more in 90 days: enrol the user in phishing or safe-browsing training, escalate to their manager or IT, and consider temporary restrictions if the pattern continues.
Look for a pattern: check whether other users were blocked on the same domain.
Step 3: How do I handle a policy violation?
Log the event, then count the user's policy violations over the last 90 days:
1st violation: send the user a friendly Acceptable Use Policy reminder.
2nd violation: notify the user's manager and ask the user to acknowledge the policy.
3rd violation: enrol the user in acceptable web use training and flag them for IT or security review.
4th violation or more: escalate for disciplinary or technical restrictions under your internal policy.
Who is notified at each stage?
Incident | User | Manager | Training | Security team |
Malicious, 1st or 2nd | Yes | No | Guidance only | Yes |
Malicious, 3rd or more | Yes | Yes | Yes | Yes |
Policy, 1st | Yes | No | No | No |
Policy, 2nd | Yes | Yes | No | No |
Policy, 3rd or more | Yes | Yes | Yes | Yes |
Key considerations
Track a rolling 90-day window of incidents per user to apply the thresholds.
Tune thresholds and escalations by department or risk profile.
If user or device details are missing, log the event for manual review.
Send escalations through secure internal channels.
Frequently asked questions
Why was a website blocked for my users?
The site matched a malicious category (phishing, malware, command-and-control) or a category your organisation blocks under its browsing policy. Blocked and allowed categories are managed in the Browser Security module.
How do I unblock a legitimate website?
Whitelist the domain under Web Domains, or allow its category, in Browser Security. See the Browser Security module guide.
HOPLONai is agentic MDR — the security tools a growing business needs, and the AI team that runs them.
See Browser Security in action: book a platform tour at hoplonai.com.