A secure web gateway (SWG) is a security control that sits between users and the internet and inspects their web traffic. It blocks access to malicious and unwanted sites, scans downloads for malware, enforces acceptable-use rules and can stop sensitive data from being uploaded where it shouldn’t go. Secure web gateways began as on-premises proxy appliances; today most are cloud services that protect users in the office and remotely, and the SWG is a core part of Security Service Edge (SSE) and SASE.
At a glance
- An SWG filters web traffic by URL category, reputation and content, and blocks malware and phishing sites.
- Inspecting content inside HTTPS requires TLS decryption, with exemptions for sensitive categories.
- It can be an appliance, a virtual machine or, most commonly now, a cloud service.
- Remote users are covered through an agent or a proxy setting on their device.
- It is one of the core components of SSE and SASE.
What problem it solves
Almost everything people do at work passes through a web browser, so the web is one of the main ways malware and phishing reach employees. Attackers host credential-harvesting pages on new domains, compromised legitimate sites and popular file-sharing services. Companies also need to apply acceptable-use and compliance rules, such as blocking illegal or adult content, and to see where data is going.
On-premises proxies only protected people while they were in the office or on a VPN. As work moved home and applications moved to SaaS, traffic either bypassed the proxy or had to be sent back through the data center, which slowed it down. A cloud SWG applies the same policy wherever users are.
How it works
Getting traffic to the gateway. In the office, traffic can be forwarded to the SWG by a firewall or router, often over an IPsec or GRE tunnel to a cloud service. On laptops and phones, an agent sends web traffic to the service, or the device is configured with a proxy auto-configuration (PAC) file. Agents tend to be more reliable because they work regardless of network and are harder for users to bypass.
Filtering. Each request is checked against URL categories (such as gambling, newly registered domains or known phishing) and reputation data, and allowed, blocked, or allowed with a warning according to policy. Policies can differ by user, group, device and time.
Inspection. With TLS decryption enabled, the SWG can scan page content and downloads for malware, send suspicious files to a sandbox, and apply data loss prevention rules to uploads. Some SWGs open risky sites through remote browser isolation, so the page runs in the provider’s cloud rather than on the user’s device.
Application control and logging. Many SWGs recognize specific web and SaaS applications and can allow some actions (view) while blocking others (upload, post). Every request is logged, which helps with investigations and compliance reporting; logs are often sent to a SIEM.
When it matters for buyers
- When remote workers have no web filtering. A gap often found by auditors or insurers.
- When proxy appliances reach end of life. A hardware refresh is the moment to compare a cloud service.
- When starting an SSE or SASE project. The SWG is usually the first component rolled out.
- When compliance requires content filtering. Schools, libraries and some regulated industries have specific filtering obligations.
- When data leaving through the web is a concern. Uploads to personal cloud storage and AI tools are common examples.
Questions to ask vendors
- Is the SWG cloud-delivered, on-premises, or both, and where are your points of presence?
- How do remote users connect: agent, PAC file, or both? What happens if the agent is disabled?
- How does TLS decryption work, what performance impact should we expect, and how are exemptions managed?
- Is sandboxing, browser isolation or DLP included or extra?
- How do you control specific actions in SaaS and AI applications?
- How long are logs retained, and can we stream them to our SIEM?
- What does migrating from our existing proxy involve, and can policies be imported?
- How is it priced (per user, per bandwidth), and are there limits on traffic volume?
How it differs from a firewall and FWaaS
A network firewall, or firewall as a service (FWaaS), controls all kinds of network traffic by port, protocol and application. Many next-generation firewalls include URL filtering. An SWG specializes in web traffic and usually goes deeper on it: per-user policy wherever the user is, detailed URL categories, TLS inspection at scale and data controls. In SSE and SASE the two sit side by side, with the SWG handling web traffic and FWaaS handling the rest.
How it differs from DNS filtering
DNS filtering blocks a site when a device looks up its domain name. It is quick to deploy and covers every application on the device, but it only sees domain names, not pages, files or uploads. An SWG inspects the traffic itself. For rollout options and policy design, see our Secure Web Gateway guide.
Problems this helps with
- Employees visiting phishing or malware sites
- No consistent web filtering for remote workers
- Ageing on-premises proxy appliances
- Sensitive files uploaded to personal or unapproved websites
