Cisco Secure Access: What Umbrella Customers Are Really Migrating Into (and the Fly-Direct Alternative)

Cisco Secure Access is the cloud SSE platform Cisco wants every Umbrella customer to migrate to, and the migration fixes Umbrella's DNS blind spot by routing your users' traffic through Cisco's cloud proxy. That trade swaps a visibility gap for a permanent latency tax and a control-plane dependency. dope.security is the alternative for Umbrella customers who have to move anyway: full SSL inspection, URL filtering, tenant control, and AI-powered DLP run on the device itself, so traffic flies direct and nothing detours through a data center.

If you run Cisco Umbrella, you have probably received the email. Umbrella is "evolving," Secure Access is the future, the migration takes about an hour, and if you upgrade now Cisco will throw in an extra year of Umbrella and credit your unused subscription balance. It is a well-run transition program. It is also a decision point that most IT teams will only get once this decade, and the default path deserves more scrutiny than a one-hour upgrade wizard implies. Our honest comparison of the top Cisco Umbrella alternatives covers the broader replacement market. This post is about the specific choice Cisco is putting in front of you.

The short version: Secure Access is a real upgrade over DNS-only Umbrella. It is not an upgrade over the architecture problem that made Umbrella's SIG tier slow in the first place. Understanding the difference is the whole game.

What is Cisco Secure Access?

Cisco Secure Access is Cisco's cloud-delivered Security Service Edge (SSE) platform. Cisco describes it as a zero-trust access service that combines Zero Trust Network Access (ZTNA), a Secure Web Gateway (SWG), a Cloud Access Security Broker (CASB), Firewall-as-a-Service (FWaaS), Data Loss Prevention (DLP), Remote Browser Isolation (RBI), Digital Experience Monitoring built on ThousandEyes, and a set of AI-app and AI-agent guardrails. It is managed through Security Cloud Control, Cisco's unified cloud security console.

Architecturally, it is the successor to Umbrella SIG (Secure Internet Gateway), which was itself the proxy layer Cisco bolted onto the original OpenDNS DNS-filtering service. In other words, Secure Access is what you get when Cisco takes the Umbrella SIG cloud proxy, adds Duo-derived ZTNA and a private-access fabric, and rebrands the whole thing as a full SSE. That lineage matters, because the thing customers disliked most about SIG (every request detours through a Cisco data center and back) is the thing Secure Access is built on. If you have not read our plain-language explainer on what Cisco Umbrella actually is, start there, because Secure Access inherits nearly all of it.

Why is Cisco pushing Umbrella customers to Secure Access?

Because Umbrella as a standalone product is being wound down. Cisco has published an end-of-sale and end-of-life transition for Umbrella, with existing subscriptions renewable through January 2028 and support continuing through January 2029. Cisco's own migration pages tell Umbrella DNS customers to move to "Secure Access - DNS Defense" and tell Umbrella SIG customers to move to full Secure Access, and they lead with an automated upgrade manager that "typically" completes the policy migration in an hour or less.

The commercial lever is the "Elevate Offer": one extra year of Umbrella free plus investment credit for the full unused balance of your Umbrella subscription applied to Secure Access, with the explicit caveat that you have to upgrade now to get it. That is a good deal if Secure Access is the right destination. It is a sunk-cost trap if it is not, because the credit locks you into a new multi-year SSE commitment before you have evaluated the alternatives.

There is also a quieter reason. The base tier of Umbrella is a DNS product in an HTTPS world. Roughly 95 percent of web traffic is encrypted, and a DNS resolver cannot read URLs, payloads, or the HTTP headers that distinguish a corporate ChatGPT login from a personal one. Cisco's own documentation (article 225162) is explicit that allowing a private ChatGPT tenant while blocking others requires the intelligent proxy, SSL decryption, and a root certificate installed on every device. DNS-only Umbrella structurally cannot do modern AI governance, and Cisco knows that is the conversation every CISO is having. Secure Access is Cisco's answer to that gap. It is just an answer that lives in Cisco's cloud rather than on your endpoints.

What actually changes when you migrate from Umbrella to Secure Access?

For a DNS-only Umbrella customer, the change is bigger than the marketing implies. You are not upgrading a DNS resolver. You are moving from a lightweight DNS redirect to a full cloud proxy architecture in which the Cisco Secure Client tunnels your users' web traffic to a Cisco point of presence, where it is decrypted, inspected, and re-encrypted before continuing to its destination, and the response makes the same trip back. Every request. Every user. Every day.

Three things follow from that:

• You inherit the latency tax. A cloud proxy adds a fixed detour to its nearest PoP on every request. Measured cloud-proxy overhead runs roughly 40 to 80 milliseconds when a user is close to a PoP and 150 to 400 milliseconds when they are far from one, and modern SaaS applications chain dozens of requests per page load. Umbrella SIG customers already lived with this. DNS customers are about to meet it for the first time.
• You inherit the root-certificate and cert-pinning problem. Full inspection in the cloud requires a Cisco root CA in every device trust store, and cert-pinned applications and developer tools break under any man-in-the-middle proxy, which is why every cloud SWG ships with a bypass list. Umbrella SIG already needed a root cert and already documented TLS 1.3 failures and high CPU on the roaming client (Cisco bug CSCvy78761). Secure Access does not remove that requirement; it standardizes it.
• You take on a new control-plane dependency. Umbrella's January 19, 2025 global disruption came from a DNS failover misconfiguration on Cisco's side (Field Notice FN74221). A DNS outage is bad. A cloud-proxy outage is worse, because when the proxy is unreachable users either lose the internet or fail open with no inspection at all. Secure Access moves more of your traffic into that blast radius, not less.

None of this is a criticism of Cisco's engineering. It is a description of the cloud-proxy architecture that Cisco, Zscaler, Netskope, and Forcepoint all share. The point is that the migration is an architecture change, and architecture changes deserve an architecture evaluation, not an hour in an upgrade wizard.

Where does the latency come from, and can you measure it?

The detour is the whole story. When a laptop in Austin talks to a SaaS application hosted in Virginia through a cloud proxy, the packets first travel to the proxy's nearest PoP, wait to be decrypted and inspected, travel to Virginia, and then reverse the entire route. dope.security removes the detour by doing the inspection on the laptop. The traffic goes from Austin to Virginia and back, which is the shortest path physics allows.

Want to see what the detour costs your own users? The Fly-Direct Speed Test measures your real round-trip latency in the browser and shows how common business apps would load flying direct versus through a legacy cloud proxy. See how the Fly-Direct SWG inspects traffic on the device, or book a 20-minute demo and we will run it live on your network.

Takeaway: a cloud proxy adds the same detour to every request, so the more requests a page makes, the more the tax compounds. On-device inspection adds no network hop at all.

Our deeper breakdown of Umbrella SIG versus an endpoint SWG walks through the same math with the SIG tier specifically, and it applies unchanged to Secure Access because the traffic path is the same.

Cisco Secure Access vs dope.security: the head-to-head

Both products solve the problem DNS-only Umbrella cannot: they inspect encrypted traffic, filter by full URL, and can tell a corporate SaaS tenant from a personal one. The difference is where that work happens and what it costs you in latency, complexity, and dependency. Here is the comparison, line by line.

• Inspection location: Cisco Secure Access decrypts and inspects traffic in Cisco's cloud points of presence; dope.security decrypts and inspects on the endpoint itself with an on-device SSL proxy, so plaintext never leaves the device.
• Traffic path: Secure Access tunnels every web request to a Cisco PoP and back before it reaches its destination; dope.security sends traffic straight to its destination with no detour, which is why we call it Fly Direct.
• Latency: Secure Access adds the cloud-proxy round trip on every request, which Cisco's own SIG-to-Secure-Access materials acknowledge by promising "four times faster" access than SIG; dope.security adds no network hop and delivers up to 4x performance over legacy proxy SWGs because there is no PoP to wait for.
• Agent footprint: Secure Access relies on the Cisco Secure Client, the successor to the Umbrella roaming client that Cisco itself documented for high CPU and TLS 1.3 issues; dope.security's agent runs natively on Mac and Windows in under 100 MB of RAM.
• Console: Secure Access is managed in Security Cloud Control alongside the rest of Cisco's security portfolio, a console that has to reconcile Umbrella, Duo, Secure Firewall, and ThousandEyes lineages; dope.security has a single console built from scratch for SWG, CASB Neural, and Dopamine DLP.
• AI governance: Secure Access offers AI-app guardrails as part of its SSE bundle, delivered through the cloud proxy and, per Cisco's Umbrella documentation, only with SSL decryption and a root certificate in place; dope.security governs AI in three native layers on the device: Shadow AI discovery, SWG policy, and Cloud Application Control that allows corporate ChatGPT while blocking personal ChatGPT on the same domain.
• Data loss prevention: Secure Access includes DLP as one module among many in the cloud path; dope.security's Dopamine DLP intercepts file uploads and AI prompts on the endpoint and classifies them through zero-retention OpenAI APIs (US Patent 12,464,023), with no data retained and no training on your data.
• Outage exposure: Secure Access puts more traffic behind a cloud control plane that has already produced a global Umbrella disruption (FN74221); dope.security keeps enforcement on the device with cached policies in fallback mode, so a cloud incident does not take down browsing.
• Migration path: Secure Access migration is one hour into a new multi-year Cisco commitment; a dope.security migration is a silent agent push through Intune or Jamf, and one Umbrella customer moved 2,000 machines in two days.

dope.security is the clear pick for an Umbrella customer whose users are distributed, whose applications are SaaS, and whose real requirement is inspection and AI control without a data center in the middle. Secure Access is the reasonable pick for an organization that also needs Cisco's private-access fabric for legacy internal applications and has already standardized on Duo and Cisco firewalls. Be honest about which one you are.

Is Secure Access enough for AI governance?

It is far more than DNS-only Umbrella, and that is the honest baseline. Cisco's materials promise genAI tool protection and AI-agent guardrails in Secure Access, and they should be taken at face value as a roadmap. The structural question is the same one every cloud-proxy vendor faces: to distinguish a corporate ChatGPT session from a personal one, the proxy has to inspect an HTTP header inside a decrypted TLS session. In Cisco's own words, that needs the intelligent proxy, SSL decryption, and a root cert. Once you accept that requirement, the only remaining question is whether you want the decryption to happen in a Cisco PoP or on the laptop that generated the request.

dope.security does it on the device. The agent sees the process that generated the request, the full URL, the tenant header, and, with Dopamine DLP, the prompt text itself, then applies policy before a single byte leaves the machine. That is what the three-layer model looks like in practice: the roaming client versus an endpoint SWG is the clearest illustration of why the location of that inspection changes what you can govern.

What should an Umbrella customer do before accepting the migration?

Three things, in order.

First, separate the deadline from the decision. Renewals run through January 2028 and support through January 2029. You have time to run a real evaluation, and the Elevate Offer's "upgrade now" framing is a sales incentive, not a technical constraint.

Second, measure the detour on your own network. Run a cloud-proxy trial on a handful of laptops in your farthest office and time your top five SaaS applications with and without it. If your users are mostly remote, mostly on SaaS, and mostly not in the same metro as a Cisco PoP, the number will surprise you.

Third, run dope.security side by side. The production trial converts straight to a paid tenant with no reconfiguration, the agent deploys silently through your MDM, and you will know within a week whether on-device inspection gives you the AI control and full-URL visibility you were promised without the hop. Greylock Partners went from first proposal to signed contract in 27 days after exactly this kind of comparison, and the deciding factor was that Umbrella's SWG component still backhauled through Cisco data centers. Our complete guide to replacing Cisco Umbrella lays out the full 14-day playbook.

The bottom line on Cisco Secure Access

Cisco built a competent cloud SSE and is giving Umbrella customers a generous, well-tooled path onto it. But the migration solves Umbrella's DNS blind spot by moving your traffic into a cloud proxy, which means it buys visibility with latency, a root certificate on every device, and a deeper dependency on a control plane that has already had a global bad day. An Umbrella customer who is being forced to change anyway should compare the on-device alternative before taking the default, because dope.security delivers the same full inspection and tenant-level AI control with the detour removed entirely. Start a free trial at dope.security/dope-swg or book a 20-minute demo.

Frequently Asked Questions

Is Cisco Umbrella being discontinued?

Cisco has announced an end-of-sale and end-of-life transition for Cisco Umbrella as a standalone product, with existing subscriptions renewable through January 2028 and support continuing through January 2029. Cisco is directing Umbrella DNS customers to Secure Access - DNS Defense and Umbrella SIG customers to full Cisco Secure Access. dope.security is the on-device alternative for Umbrella customers who want full inspection without moving into a cloud proxy.

What is the difference between Cisco Umbrella and Cisco Secure Access?

Umbrella began as a DNS-layer filtering service with an optional SIG cloud proxy add-on. Cisco Secure Access is a full cloud SSE platform that bundles ZTNA, SWG, CASB, FWaaS, DLP, RBI, and AI guardrails, all delivered through Cisco's cloud points of presence and managed in Security Cloud Control. The practical difference for a DNS-only customer is that Secure Access routes web traffic through Cisco's proxy, which adds inspection depth and adds a network detour on every request. dope.security provides the same inspection depth on the endpoint with no detour.

Does Cisco Secure Access add latency?

Yes, like every cloud-proxy SSE, Secure Access adds a round trip to the nearest Cisco point of presence on each request. Measured cloud-proxy overhead is roughly 40 to 80 milliseconds near a PoP and 150 to 400 milliseconds far from one, and Cisco's own migration materials promise Secure Access is "four times faster" than the Umbrella SIG proxy it replaces, which is an acknowledgment that SIG's detour was significant. dope.security inspects on the device, so it adds no network hop at all.

How much does Cisco Secure Access cost compared to Umbrella?

Cisco does not publish list pricing for Secure Access, and it is sold in tiered SSE packages rather than as a single SKU. Cisco's Elevate Offer credits the unused balance of an Umbrella subscription toward Secure Access and adds a free year of Umbrella for customers who upgrade immediately, which effectively converts the remaining Umbrella term into a new multi-year Secure Access commitment. dope.security publishes transparent pricing and offers a free production trial that converts directly to a paid tenant.

Can Cisco Secure Access block personal ChatGPT while allowing the corporate account?

Cisco's documentation states that distinguishing a private ChatGPT tenant from others requires the intelligent proxy, SSL decryption, and a root certificate on every device, so it is possible in Secure Access but only with full decryption in Cisco's cloud. dope.security performs the same tenant check on the device through Cloud Application Control, allowing the corporate tenant and blocking personal logins on the same domain without sending traffic to a data center.

Does dope.security work for Cisco Umbrella customers in China or restricted regions?

Yes. Cisco has no mainland China data center, and cloud-proxy SSE products generally struggle behind the Great Firewall because every request has to reach a PoP outside the country. dope.security inspects on the device and sends traffic directly to its destination, so it works for users in China and other restricted geographies without a paid regional uplift.