Cisco Umbrella End of Life: Your Options for 2025 (Complete Guide)

Cisco has announced end of life for Cisco Umbrella SIG and DNS. The product is evolving into Cisco Secure Access, the last day to order Umbrella is January 31, 2027, and the last day to renew is January 31, 2028. If you run Umbrella today, you have a deadline and a decision. This guide covers the exact dates, what they mean in practice, what moving to Secure Access involves, and how to choose between migrating, switching, or changing architecture.

Disclosure: dope.security makes an on-device secure web gateway and competes with vendors discussed in this post. We've linked independent sources so you can check our claims.

Facts current as of October 2026, based on Cisco's published bulletin.

The Cisco Umbrella end-of-life dates

Cisco published end-of-life bulletin EOL15975 on September 1, 2026. The milestones for Umbrella SIG and DNS subscriptions:

• January 31, 2027: end of sale. The last day to order new Umbrella subscriptions.
• January 31, 2027: end of software maintenance releases. The last date Cisco engineering may release product enhancements. Cisco says customers still receive maintenance releases and bug fixes through the last date of support.
• January 31, 2028: end of change and renewal. The last day to renew or add to an existing subscription.
• January 31, 2029: last date of support. After this, subscription and support services end and the product becomes obsolete.

Two fine-print rules matter. A new subscription has to start on or before the end-of-sale date, and a renewal or change has to start on or before January 31, 2028. And the projected term of any new or changed subscription has to end on or before January 31, 2029. In other words, you can't sign a long renewal in 2028 to push the problem out.

What Cisco Umbrella end of life means for you

• Nothing breaks on February 1, 2027. Existing deployments keep running and stay supported until January 31, 2029.
• The product stops getting better. With enhancements ending January 31, 2027, new capabilities (think AI app controls) land in Secure Access, not Umbrella.
• Your real deadline is your renewal date. For most teams, the decision needs to be made before the subscription that would carry you past January 2028.
• You're re-platforming either way. Secure Access has its own console, policy model and SKUs. Moving there is a migration, even if it's a Cisco-to-Cisco one.

Where Cisco wants you to go: Cisco Secure Access

Cisco Secure Access is Cisco's Security Service Edge platform. It combines secure internet access (SWG, cloud firewall, CASB, DNS security) and secure private access (ZTNA and VPN as a service) in one dashboard, and it's sold in Essentials and Advantage tiers plus a DNS Defense option. The bulletin maps each Umbrella package to a successor:

• Umbrella DNS Security Essentials to Secure Access DNS Essentials.
• Umbrella DNS Security Advantage to Secure Access DNS Advantage.
• Umbrella SIG Essentials to Secure Access Internet Access Essentials.
• Umbrella Data Loss Prevention to Secure Access Data Loss Prevention.

Check your own part numbers against Table 2 of the bulletin. A few Enterprise Agreement SKUs, such as the EA 2.0 Umbrella L7 Cloud Firewall add-on, list no migration product at the time of writing.

How the upgrade works

Cisco says most customers can migrate in an hour or less with its automated upgrade manager. Its DNS upgrade guide starts with creating a Security Cloud Control account, confirming the Secure Access instance matches your Umbrella organization ID, attaching the Umbrella organization, and closing Umbrella as the final step. Cisco recommends upgrading outside business hours and requires full admin access. Cisco partners say Umbrella and Secure Access can run in parallel, so you can move at your own pace. Our deeper look at what Umbrella customers are migrating into covers the trade-offs.

Your four options

Strip away the marketing and every path falls into one of four buckets.

Option 1: Migrate to Cisco Secure Access

• Choose it if: you're standardized on Cisco (Meraki, Duo, ISE, Cisco SD-WAN) and want the least vendor change.
• What you keep: Talos threat intelligence, Cisco ecosystem integrations, and a mapped licensing path. Cisco's SASE offering, of which Secure Access is the SSE component, was placed as a Challenger in Gartner's 2026 SASE Platforms Magic Quadrant and credited for its PoP infrastructure and sales execution, per SDxCentral.
• What you accept: the same cloud-proxy architecture. HTTPS inspection still happens in Cisco data centers, with a Cisco root certificate on every device. You also learn a new console and policy model.

Option 2: Switch to another cloud proxy SSE

• Examples: Zscaler Internet Access, Netskope One, Cloudflare One, Palo Alto Networks Prisma Access.
• Choose it if: you want a different vendor but the same cloud-inspection model, often for a broader SSE feature set.
• What you accept: a full migration, plus the backhaul and shared-control-plane trade-offs of routing traffic through a vendor's points of presence.

Zscaler Internet Access

The largest cloud-proxy SSE, and a common pick for global enterprises that want a mature platform. Zscaler was named a Leader in the 2025 Gartner Magic Quadrant for SSE and ranked first on Ability to Execute, with Gartner crediting the leaders' early embrace of cloud-delivered security, according to ISMG's BankInfoSecurity. It fits large organizations standardizing on one cloud SSE vendor across many regions. The trade-off: capabilities are split across ZIA, ZPA, and add-ons, and Zscaler doesn't publish list prices, so modeling the full cost takes work with your account team.

Netskope One

Netskope grew up on CASB and is strongest at SaaS visibility and data-centric controls. It took the top position on execution in Gartner's 2026 SASE Platforms Magic Quadrant, where Gartner praised its "broad and deep" networking and security capabilities and its PoP strategy, per SDxCentral. It fits enterprises where SaaS data protection drives the decision. The trade-off: inline DLP, threat, and AI controls are spread across tiers and add-ons, so licensing takes real effort to model and compare against your Umbrella bill.

Cloudflare One

Cloudflare One runs SWG, ZTNA, and CASB on Cloudflare's global network, with the Cloudflare One Client on the device. It was the only vendor in the Visionaries box of Gartner's 2026 SASE Platforms Magic Quadrant, applauded for its AI and post-quantum cryptography security work, per SDxCentral. It fits teams that already run DNS or app delivery on Cloudflare. The trade-off: you share Cloudflare's edge, so a Cloudflare network incident becomes your web-security incident, and DLP depth is worth testing against your requirements.

Palo Alto Networks Prisma Access

Prisma Access extends PAN-OS firewall policy to remote users through a cloud-delivered SSE. Palo Alto Networks has been a Leader in Gartner's SSE Magic Quadrant for three straight years, including 2025, alongside Zscaler and Netskope, as CRN reported. It fits organizations already running Palo Alto firewalls that want one policy model from the data center to the laptop. The trade-off: it's priced at the premium end and assumes a broader Palo Alto platform commitment, which is a bigger decision than replacing a DNS filter.

Option 3: Drop to a DNS-only filter

• Examples: DNSFilter, WebTitan (TitanHQ).
• Choose it if: you only ever used Umbrella for DNS filtering and want a simple, low-cost swap.
• What you accept: the same blind spot. DNS filtering sees the domain, not the session. It can't inspect uploads, URL paths or which account signs in. See is DNS filtering enough.

DNSFilter

DNSFilter is the closest like-for-like swap for Umbrella DNS. It's rated 4.6/5 on G2 across 274 reviews as of October 2026, with reviewers consistently praising ease of use, effective security, and responsive support, and published pricing starts at $1.15 per user per month, per G2. It fits SMBs, MSPs, and schools that only used Umbrella for DNS. The trade-off: it keeps Umbrella's core limit. It sees the domain, not the URL path, the upload, or which account signs in.

WebTitan (TitanHQ)

WebTitan is DNS-based web filtering aimed at MSPs, schools, and libraries. It's rated 4.3/5 on G2 across 85 reviews as of October 2026, with reviewers citing easy setup, DNS filtering that needs no agent on many networks, and Active Directory integration for group-based policies, per G2. It fits MSPs that want low-cost, multi-tenant DNS filtering. The trade-off: it's DNS-only, so it isn't a full SWG, and G2 now lists the vendor as CyberSentriq, so confirm branding and roadmap during evaluation.

Option 4: Move inspection onto the device

• Example: dope.security.
• Choose it if: your users are remote or hybrid, you need full HTTPS inspection, and you want to govern AI tools without a cloud detour.
• How it works: the dope.security agent performs SSL inspection, URL filtering and Cloud Application Control on the endpoint, and traffic flies direct to the internet. Dopamine DLP catches sensitive data in uploads and AI prompts: text is extracted on the device and classified by an LLM with zero data retention. Policy lands on every endpoint in under a minute from one console.
• What you accept: a younger vendor than Cisco, an endpoint agent on every managed Mac and Windows device (under 100 MB of RAM), and no built-in ZTNA today. If you were counting on Secure Access for private-app access, pair dope.security with a ZTNA tool.

How to decide: five questions

• What do you actually use today? Pull your Umbrella package list and add-ons. DNS-only customers have more options than SIG customers.
• Do you need to see inside HTTPS? If yes, rule out DNS-only filters. Then ask where decryption happens: in a vendor data center or on the device.
• Do you need to govern AI, not just block it? In any proof of concept, test allowing your ChatGPT Enterprise workspace while blocking personal ChatGPT on the same domain.
• How much migration work can your team absorb? You're changing consoles either way. Ask every vendor for references that moved off Umbrella and how long it took.
• When does your current term end? Work back from that date, and remember renewals can't start after January 31, 2028.

A practical timeline

• Now through January 2027: inventory your Umbrella SKUs, policies, integrations and the devices running Cisco Secure Client. Decide whether you need any final Umbrella orders before end of sale.
• Next, well before your renewal deadline (January 31, 2028): run proofs of concept with two or three options. Include Secure Access if you're a Cisco shop. Test HTTPS inspection, AI tenant controls, policy push speed and user latency.
• After the proofs of concept: pick a platform, pilot with one group, then roll out through your MDM.
• Before January 31, 2028: finish cutover before the renewal you'd otherwise need. Leave Umbrella running in parallel until you're confident.

Migrations don't have to take a year. Greylock Partners ditched Cisco Umbrella for dope.security and went from first proposal to signed contract in 27 days, then deployed through Intune in phases. Another Umbrella customer moved 2,000 machines in two days.

Frequently asked questions

Is Cisco Umbrella being discontinued?

Yes. Cisco announced end-of-sale and end-of-life for Cisco Umbrella SIG and DNS in bulletin EOL15975 on September 1, 2026, as the product evolves into Cisco Secure Access.

When does Cisco Umbrella support end?

The last date of support is January 31, 2029. The last day to order is January 31, 2027, and the last day to renew or add to a subscription is January 31, 2028.

Will Cisco Umbrella get new features before end of life?

Not after January 31, 2027. That's the end of software maintenance releases, the last date Cisco may release enhancements. Cisco says maintenance releases and bug fixes continue through the last date of support.

What is the difference between Cisco Umbrella and Cisco Secure Access?

Secure Access is Cisco's newer SSE platform and Umbrella's official successor. It adds private access (ZTNA and VPN as a service) alongside internet security, with its own console and packaging. Umbrella DNS customers map to Secure Access DNS packages, and SIG customers map to Secure Access Internet Access.

Do I have to move to Cisco Secure Access?

No. Secure Access is Cisco's recommended path, but you can switch to any platform before your renewal deadline. Compare the field in our top 10 Cisco Umbrella alternatives.

Make the deadline work for you

You're migrating either way, so make it count. Start a free trial at dope.security/pricing, read our Cisco Umbrella review, or book a 20-minute demo and see on-device inspection against your own traffic.