In short: Cisco Umbrella categories come in two kinds. Security categories, such as malware, phishing, command and control and cryptomining, block threats. Content categories, more than 100 of them aligned with Cisco Talos, filter by subject, such as gambling or social networking. Domains are classified at domain level, and misclassifications can be disputed through Umbrella or Talos.
Three kinds of category
An Umbrella DNS policy uses three separate sets of categories:
| Type | Purpose | Examples |
|---|---|---|
| Security categories | Stop threats, whatever the subject of the site | Malware, phishing, command and control, cryptomining |
| Content categories | Apply acceptable-use rules by subject | Gambling, pornography, social networking, streaming video |
| Application categories | Allow or block named cloud applications | Groups of cloud apps by function |
Security categories should be on everywhere. Content categories are a policy decision and usually differ between groups of users, which is why identities matter (see Umbrella content filtering).
Security categories
Cisco enables three security categories by default and recommends you review the rest for your organisation:
| Security category | What it blocks | Default |
|---|---|---|
| Malware | Servers hosting malware and compromised websites, over any port or protocol | On |
| Command and control callbacks | Infected devices contacting attacker infrastructure; also helps spot infected machines | On |
| Phishing attacks | Fraudulent sites built to steal credentials and personal data | On |
| Newly seen domains | Domains being looked up through Umbrella for the first time | Off |
| Potentially harmful domains | Domains showing suspicious behaviour that may be part of an attack | Off |
| Dynamic DNS | Sites hosted on dynamic DNS services | Off |
| DNS tunnelling VPN | VPN services that hide traffic inside DNS to get round policy | Off |
| Cryptomining | Mining pools and known browser mining code | Off |
Newly seen domains is a strong control, because newly created domains are often used in attacks, but it can occasionally catch a brand-new legitimate site. Start it in a pilot policy and watch the Umbrella reporting before applying it to everyone. On DNS Security Advantage and the SIG packages, analysts can look up why a domain is flagged in Umbrella Investigate.
Content categories and presets
Umbrella has moved its content categories into line with Cisco Talos, so Umbrella and Talos now share one classification. Cisco's current definitions list more than 100 content categories. New Umbrella organisations get the Talos-based set automatically; older organisations still on legacy categories are asked to migrate, and some destinations change category in the process.
Grouped by purpose, the current set covers:
- Adult and sexual content: pornography, adult, non-sexual nudity, lingerie and swimsuits, dating, and sex education, which is a separate category for factual sexual health content
- Illegal and harmful content: child abuse content, terrorism and violent extremism, extreme, hate speech, illegal drugs, illegal activities, illegal downloads, weapons, cheating and plagiarism
- Circumvention: filter avoidance, personal VPN and encrypted DNS
- Regulated activity: gambling, lotteries, alcohol, tobacco, cannabis, cryptocurrency
- Productivity and bandwidth: social networking, streaming video and audio, games, chat and instant messaging, peer file transfer, online storage and backup, web-based email
- Newer areas: generative AI, online document sharing and collaboration, Internet of Things, cloud and data centres
- Everyday business and education: education, news, government and law, finance, health and medicine, reference, search engines and portals, SaaS and B2B, safe for kids, and many more
The Low, Moderate and High presets build on each other:
| Preset | What Cisco's Talos-based preset adds |
|---|---|
| Low | Pornography, adult, extreme, filter avoidance, encrypted DNS and child abuse content |
| Moderate | Everything in Low, plus alcohol, cannabis, dating, gambling, hate speech, illegal drugs, lingerie and swimsuits, non-sexual nudity, terrorism and violent extremism, and weapons |
| High | Everything in Moderate, plus auctions, chat and instant messaging, games, online communities, online storage and backup, peer file transfer, photo search and images, social networking, streaming video and web-based email |
| Custom | Any combination, including categories that no preset includes, such as generative AI |
Presets are a starting point, not a policy. A school, for example, may want categories such as personal VPN and illegal activities blocked for students, and neither is in any preset.
One point catches people out after migrating. Cisco automatically adds the DNS over HTTPS and DNS over TLS categories during category migration, because encrypted DNS can bypass Umbrella altogether. If an application stops working afterwards, check whether it uses its own encrypted DNS before you unblock the category.
Child abuse content, the IWF and UK-specific categories
The Child Abuse Content category covers illegal child sexual abuse material, and Cisco's legacy category definitions point to the Internet Watch Foundation (IWF) for more information about it. In Cisco's current Talos-based definitions, Child Abuse Content is enforced globally in both DNS and secure web gateway security, and administrators cannot select or disable it.
The current set also includes Regional Restricted Law categories, including a new one for Great Britain, covering URLs restricted there because the content may be unlawful as determined by the government. Cisco defines these categories by URL rather than by domain, so ask how they are enforced in your deployment before relying on them, particularly if you only use DNS-layer filtering.
If you are a school or college, the DfE asks you to confirm specific things about IWF and CTIRU lists with your provider. Read appropriate filtering for schools before relying on any category for that purpose.
How to check or dispute a category
No classification is perfect, so from time to time a site will sit in a category you disagree with. Umbrella gives you two routes to fix it:
- From the Umbrella dashboard: open the destination from the Top Destinations report, or open an entry in Activity Search and view its full details, then choose Dispute Categorization.
- Select whether the problem is a content or a security categorisation, suggest the correct category and describe the site.
- Enter an email address. Umbrella passes the request to Talos, which replies to that address with its decision.
- Through Cisco Talos: submit a domain, IP address or file hash in the Talos Reputation Center and ask for the category to be reviewed.
While you wait, add the domain to an allow or block destination list so users are not held up. Remove the local entry once the category is corrected, so your lists do not grow indefinitely.
Getting categories right
Category choice is where most filtering complaints start: too strict and staff open tickets all week, too loose and the policy does not do its job. Forever Systems reviews your current categories against your acceptable-use policy and real traffic, separates policies by group, and documents every exception. With Umbrella's end of sale on 31 January 2027, the same policy thinking carries into Cisco Secure Access; our Umbrella to Secure Access migration guide explains the move. Contact us for a category review.
How Forever Systems supplies and supports Cisco Umbrella
We supply, deploy and support Cisco Umbrella for UK organisations, and plan the move to its successor, Cisco Secure Access.
- Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
- Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
- Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
- Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
- Ongoing support: reporting, policy tuning, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Umbrella quote, deployment or migration plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How many content categories does Cisco Umbrella have?
Cisco's current definitions list more than 100 content categories. They are now aligned with Cisco Talos, so Umbrella and Talos share the same classification. Older Umbrella organisations may still be on legacy categories and need to migrate.
How do I check what category a website is in for Umbrella?
Search for the domain in the Activity Search or Top Destinations report in the Umbrella dashboard, or look it up in the Cisco Talos Reputation Center. From either Umbrella report you can open the destination and raise a dispute if the category is wrong.
What is the newly seen domains category in Umbrella?
It blocks domains that are being looked up through Umbrella for the first time. Newly created domains are often used in attacks, so it is a useful control, but it can occasionally block a brand-new legitimate site, so pilot it first.
Can I turn off the Child Abuse Content category in Umbrella?
No. In Cisco's current Talos-based category definitions, Child Abuse Content is enforced globally in DNS and secure web gateway security and is not something administrators can select or disable.
Why did an app stop working after migrating Umbrella content categories?
Cisco adds the DNS over HTTPS and DNS over TLS categories automatically during migration, because encrypted DNS can bypass Umbrella. Apps that use their own encrypted DNS may break. Check the block reason in Activity Search before deciding whether to allow it.