Cloud-based gateways protect remote users without routing their traffic back through the office. Compare TLS inspection, performance, and whether DNS filtering alone would meet your needs.
Why it works
Blocking known-bad destinations stops many phishing and malware infections at the network layer.
What to look for
It should protect remote users and office users alike.
It should inspect TLS traffic with sensible privacy exemptions.