The purpose of Cisco Umbrella is to secure internet access for users wherever they work. It acts as a cloud-delivered first line of defence, checking where devices are trying to connect and blocking malicious or unwanted destinations before a connection is made.
The problems it was built to solve
- Users work outside the perimeter. Laptops on home and public Wi-Fi are not protected by an office firewall.
- Threats use the internet to operate. Phishing pages, malware downloads and command and control callbacks all depend on reaching a domain first.
- Hardware does not scale well. Backhauling traffic to a central proxy adds latency and complexity.
- Organisations need visibility. IT teams need to know which sites and cloud apps are in use across every location.
What Cisco Umbrella can do, by package
| Capability | DNS Essentials | DNS Advantage | SIG Essentials | SIG Advantage |
|---|---|---|---|---|
| DNS-layer security and content filtering | Yes | Yes | Yes | Yes |
| Roaming protection and identity-based policies | Yes | Yes | Yes | Yes |
| App discovery (Shadow IT) | Yes | Yes | Yes | Yes |
| Selective proxy with URL and file inspection | No | Yes | Yes | Yes |
| Investigate threat intelligence console | No | Yes | Yes | Yes |
| Full secure web gateway with TLS decryption | No | No | Yes | Yes |
| Cloud-delivered firewall and CASB | No | No | Yes | Yes |
| Sandbox file analysis | No | No | Yes | Yes |
| Intrusion prevention and data loss prevention | No | No | No | Yes |
What Umbrella is not designed to do
- It is not endpoint detection and response (EDR) and does not remove malware from a device.
- It is not an email security gateway, although blocking phishing domains reduces the impact of phishing emails.
- It does not provide zero trust access to private applications. That capability comes with its successor, Cisco Secure Access.
- It cannot see prompts or data entered into AI tools unless traffic is decrypted and inspected by the secure web gateway and DLP.
Where it fits today
Umbrella is typically one layer in a defence-in-depth stack, alongside endpoint protection, email security and a network firewall. Cisco has announced end of sale for Umbrella on 31 January 2027, with Cisco Secure Access taking over the same purpose and adding private application access and newer AI-focused controls.