What Is Cisco Umbrella? How It Works, and What Changes in 2026

Cisco Umbrella is a cloud-delivered security service that filters internet requests at the DNS layer and, in its higher SIG tiers, adds a cloud secure web gateway, firewall, CASB, and DLP that run in Cisco's data centers. It grew out of OpenDNS, which Cisco acquired in 2015. The big news heading into 2027: Cisco has announced end-of-sale and end-of-life for Umbrella SIG and DNS as the product evolves into Cisco Secure Access. If you run Umbrella today, you now have a deadline and a decision.

Updated for 2027. Facts current as of October 2026.

What is Cisco Umbrella, in plain terms?

Every time a laptop opens a website, it first asks a DNS resolver, "where does this domain live?" Umbrella answers that question for you. If the domain is malicious (phishing, malware, command-and-control) or blocked by your policy, Umbrella sends the user to a block page instead. If the domain is fine, the request goes through.

That's the core product, and it's good at it. Cisco Talos threat intelligence powers the block lists, and DNS filtering deploys quickly because you only need to point DNS at Umbrella.

On top of DNS, the Secure Internet Gateway (SIG) packages add a full cloud proxy: HTTPS inspection, a cloud-delivered firewall, CASB, DLP, and remote browser isolation. Those features work by routing traffic through Cisco's data centers for inspection, the same backhaul model Zscaler, Netskope, and Forcepoint use.

Cisco Umbrella packages: DNS vs. SIG

Cisco sells Umbrella in four main packages:

• DNS Security Essentials: DNS-layer filtering and threat blocking. No HTTPS inspection.
• DNS Security Advantage: adds the intelligent proxy for risky domains and file inspection.
• SIG Essentials: adds the full cloud secure web gateway, cloud-delivered firewall, and CASB. This is the lowest tier that inspects encrypted web traffic.
• SIG Advantage: the top tier, adding capabilities such as IPS and DLP.

The practical takeaway: if you bought Umbrella for DNS filtering, you are not inspecting what happens inside HTTPS sessions. Google's HTTPS Transparency Report shows the vast majority of Chrome page loads now use HTTPS, so that gap covers most of the web.

How Cisco Umbrella works

Umbrella has three deployment patterns.

Network DNS forwarding. Point your DNS servers at Umbrella's resolvers and every device on that network gets DNS filtering. Simple, but it only protects devices on a managed network.

Roaming module on the endpoint. For laptops off the corporate network, Cisco's endpoint software forwards DNS to Umbrella from anywhere. The standalone Umbrella Roaming Client reached end of software maintenance on April 2, 2025. Cisco moved that functionality into the Umbrella Roaming Security Module in Cisco Secure Client, and says future development happens there only.

SIG cloud proxy. For full web inspection, traffic travels to Umbrella's cloud data centers through tunnels, PAC files, or the Secure Client agent. Cisco decrypts and inspects it there, which requires a Cisco root certificate on every device. This is the part of Umbrella that backhauls.

Cisco Umbrella is becoming Cisco Secure Access

This is the biggest change since the last version of this guide. In September 2026, Cisco published end-of-life bulletin EOL15975 for Umbrella SIG and DNS, describing the product as evolving into Cisco Secure Access, Cisco's Security Service Edge (SSE) platform. Cisco's own Umbrella site now says, "Cisco Umbrella has evolved to Cisco Secure Access."

The milestones from Cisco's bulletin:

• January 31, 2027: last day to order affected Umbrella SIG and DNS products.
• January 31, 2028: last day to renew or add to an existing subscription.
• January 31, 2029: last date of support.

Cisco positions the move as an upgrade. Umbrella DNS customers map to Secure Access DNS Defense, and SIG customers map to full Secure Access. Cisco says most customers can migrate in an hour or less with its automated upgrade manager, and it's offering migration incentives.

Here's what that means for you. Existing Umbrella deployments keep working and stay supported through January 2029. But every Umbrella customer now faces a platform decision before their 2028 renewal: migrate to Secure Access, or use the forced change as a chance to re-evaluate the architecture. A migration is a migration either way. New console, new policy model, new contract.

What Cisco Umbrella does well

Credit where it's due:

• Fast DNS-layer protection. Blocking known-bad domains at resolution time is cheap, fast, and effective against a large class of threats.
• Talos threat intelligence. Mature, well-regarded research behind the block lists.
• Easy start. DNS-only deployments take minutes.
• Cisco ecosystem fit. If you run Meraki, Cisco SD-WAN, or Duo, Umbrella plugs in natively.

If your requirement is "block malicious domains everywhere, cheaply," Umbrella and its DNS Defense successor do that well.

Where Cisco Umbrella falls short

DNS can't see inside encrypted traffic

DNS filtering decides on the domain name. It can't see the URL path, the file being uploaded, or the account signing in. Closing that gap means moving up to SIG and routing traffic through Cisco's cloud proxy. Our explainer on URL filtering vs DNS filtering walks through the difference.

The SIG proxy backhauls

Once you inspect HTTPS with SIG, every inspected request takes a detour through a Cisco data center. Cloud-proxy latency typically runs 40 to 80 ms near a point of presence and 150 to 400 ms when users are far from one. Modern SaaS pages chain dozens of requests, so that detour adds up.

Global policy updates fail globally

Cloud-delivered category updates are convenient until one goes wrong. Two 2026 examples from Cisco's own status page:

• July 25, 2026: DNS policies blocking the "M365 Copilot" and "Microsoft Copilot" app categories incorrectly matched legitimate Microsoft 365 hostnames, disrupting access to services including Outlook and Office for about six hours.
• September 21, 2026: an update to the Generative AI app category misclassified Oracle domains, including oracle.com, blocking access over both DNS and SWG for about 41 minutes until Cisco reverted it.

Neither was catastrophic. Both show the trade-off of a shared cloud control plane: one bad definition reaches every customer at once.

AI governance stops at the domain

The hardest control in web security right now is tenant-level separation: allow your corporate ChatGPT workspace, block personal ChatGPT on the same domain. Tenant identity lives inside the encrypted session, so DNS can't make that call. Umbrella can block or allow ChatGPT as a domain; anything finer requires the SIG proxy, SSL decryption, and the root certificate.

Cisco Umbrella vs. an on-device secure web gateway

The architectural alternative is to run the secure web gateway on the laptop itself. That's how dope.security works. Same jobs, two approaches:

• HTTPS visibility: Umbrella DNS tiers never see inside the session; full inspection requires SIG plus cloud decryption. dope.SWG performs SSL inspection on the device in every deployment.
• Traffic path: SIG sends inspected traffic to a Cisco data center first. dope.security inspects locally and flies direct to the destination, with up to 4x performance over legacy proxy SWGs.
• Corporate vs. personal accounts: DNS can't tell a corporate tenant from a personal one. dope.security Cloud Application Control blocks personal ChatGPT, Claude, Google, and Microsoft 365 logins while allowing enterprise accounts.
• Data in motion: Dopamine DLP intercepts file uploads and AI prompts on the endpoint. Text is extracted on the device and classified by an LLM with zero data retention, covering ChatGPT, Claude, Perplexity, Abacus, and Copilot (US Patent 12,464,023).
• Footprint and rollout: the dope.endpoint agent runs on Mac and Windows in under 100 MB of RAM. One Cisco Umbrella customer migrated 2,000 machines to dope.security in two days.

Want to put a number on the detour? The Fly-Direct Speed Test measures your real round-trip latency in the browser and compares a cloud-proxy path with on-device inspection. Run it from the dope.SWG page, or book a 20-minute demo.

Should you migrate to Secure Access or switch?

Use the Cisco deadline to ask three questions:

• Do you need HTTPS inspection everywhere, not just DNS filtering? If yes, compare where each option decrypts traffic: in a vendor data center or on the device.
• Do you need to govern AI, not just block it? Test the corporate-vs-personal ChatGPT case live in any proof of concept.
• How much migration work can your team absorb? You're changing consoles either way. Greylock Partners went from first proposal to signed contract with dope.security in 27 days and deployed through Intune in phases.

If you're weighing the field, start with our top 10 Cisco Umbrella alternatives for 2027.

Frequently asked questions

What is Cisco Umbrella used for?

Cisco Umbrella blocks malicious and unwanted internet destinations at the DNS layer before a connection is made. Higher SIG tiers add a cloud secure web gateway, firewall, CASB, and DLP that inspect traffic in Cisco's data centers.

Is Cisco Umbrella being discontinued?

Cisco has announced end-of-sale and end-of-life for Umbrella SIG and DNS as the product evolves into Cisco Secure Access. The last day to order is January 31, 2027, the last day to renew is January 31, 2028, and support ends January 31, 2029.

Is Cisco Umbrella the same as OpenDNS?

Umbrella grew out of OpenDNS, which Cisco acquired in 2015. Cisco says the OpenDNS brand remains for its free consumer offerings, while Umbrella, and now Secure Access, is the enterprise product.

Can Cisco Umbrella inspect HTTPS traffic?

Only on the SIG tiers, and only when traffic is routed through Cisco's cloud proxy with SSL decryption enabled and a Cisco root certificate installed. DNS-only tiers do not inspect HTTPS content.

What is the best alternative to Cisco Umbrella?

It depends on what you need. Staying in the Cisco ecosystem means Cisco Secure Access. If you want HTTPS inspection and AI governance without backhauling, an on-device SWG like dope.security is the architectural alternative. Compare options in our Cisco Umbrella alternatives guide.

Try dope.security

Your Umbrella renewal clock is running. Start a free instant SSO trial at dope.security/pricing, or book a 20-minute demo and see on-device inspection against your own traffic.