We have signed up with OpenDNS to provide VERY effective web filtering service. This is one of the few things that actually stops modern forms of ransomware such as the Cryptolocker or Cryptorbit dead in their tracks, as it blocks access to the encryption key server. It protects machines both on and off the local network. See here
for in-depth details.