In short: Cisco Umbrella packages come in two families. DNS Security Essentials and DNS Security Advantage protect at the DNS layer, with Advantage adding the intelligent proxy. SIG Essentials and SIG Advantage add a full secure web gateway, cloud-delivered firewall, CASB and tunnels. Cisco stops selling all four on 31 January 2027.
The four packages at a glance
Cisco Umbrella has two families of package. The DNS Security packages work at the DNS layer: Umbrella answers your devices' DNS queries and refuses to resolve domains linked to malware, phishing, command and control or unwanted content, so the connection never starts. The Secure Internet Gateway (SIG) packages add a full cloud web proxy, firewall and cloud-app controls, so Umbrella inspects the traffic itself as well as the DNS lookup.
- DNS Security Essentials: DNS-layer security and content filtering for every user, on and off the network
- DNS Security Advantage: adds the intelligent proxy for URL blocking and file inspection on risky domains, blocking of direct-to-IP callbacks, and Umbrella Investigate
- SIG Essentials: adds the secure web gateway full proxy, cloud-delivered firewall, CASB, sandboxing and network tunnels
- SIG Advantage: adds Layer 7 firewall and intrusion prevention (IPS) plus data loss prevention (DLP)
For a plain-English explanation of how DNS-layer security works, see what is Cisco Umbrella?. For the SIG components in depth, see our Umbrella SIG guide.
Feature comparison table
This table is built from Cisco's own Umbrella package comparison data sheet and its support document comparing the packages. Where Cisco marks a feature as partial or limited, we say what that means in practice.
| Feature | DNS Security Essentials | DNS Security Advantage | SIG Essentials | SIG Advantage |
|---|---|---|---|---|
| DNS-layer security and DNS content filtering | Yes | Yes | Yes | Yes |
| Custom allow and block lists | Domains | Domains (URLs partly, via the intelligent proxy) | Domains and URLs | Domains and URLs |
| Policy and reports by network, internal subnet, roaming device and AD user or group | Yes | Yes | Yes | Yes |
| Roaming module, virtual appliances, custom block pages | Yes | Yes | Yes | Yes |
| Umbrella API, activity search and multi-org console | Yes | Yes | Yes | Yes |
| Log export to S3 (your bucket or Cisco-managed) | Yes | Yes | Yes | Yes |
| App Discovery (shadow IT) report | By domain | By domain | By URL | By URL |
| Block direct-to-IP callbacks that bypass DNS | No | Yes | Yes | Yes |
| Intelligent (selective) proxy for risky domains | No | Yes | Yes | Yes |
| HTTPS inspection and file inspection | No | Risky domains only | All web traffic | All web traffic |
| Umbrella Investigate console and enrichment API | No | Yes | Yes | Yes |
| Secure web gateway full proxy and URL-level web filtering | No | No | Yes | Yes |
| Secure Malware Analytics sandbox | No | No | Yes (simple verdict) | Yes (detailed analysis) |
| Tenant controls, file type control, custom warn pages | No | No | Yes | Yes |
| Cloud malware detection in cloud storage apps | No | No | Limited number of apps | All supported apps |
| Cloud-delivered firewall (Layer 3/4) | No | No | Yes | Yes |
| Network tunnels (IPsec IKEv2) | No | No | Yes | Yes |
| Layer 7 firewall and IPS | No | No | Add-on | Included |
| Data loss prevention (DLP) | No | No | Add-on | Included |
| Remote Browser Isolation (RBI) | No | No | Add-on | Add-on |
Two practical points sit behind the table. First, URL-level control needs a proxy: DNS on its own only ever sees the domain name, so a block on a single page of an otherwise safe site needs the intelligent proxy or the secure web gateway. Second, the SIG packages only inspect traffic that actually reaches them, through a tunnel, the roaming module or a PAC file. Our deployment guide covers each route.
Add-ons and Education versions
Several capabilities are sold on top of a package rather than inside it:
- Remote Browser Isolation: three options (Isolate Risky, Isolate Web Apps and Isolate Any), sold with either SIG package
- L7 firewall and IPS and data loss prevention: add-ons for SIG Essentials, already included in SIG Advantage
- Umbrella Investigate: extra console users and Investigate API tiers (small, medium and large), for security teams that need more than the access bundled with DNS Security Advantage and SIG
- Reserved IP (Regional): a single-tenant egress IP address in an Umbrella data centre, mapped to your web traffic, for the SIG packages. It replaced the original Reserved IP product, which Cisco stopped selling in January 2025
The multi-org console, for groups that run several Umbrella organisations from one place, is listed in all four packages in Cisco's comparison; see Umbrella multi-org and MSP consoles.
Cisco also sells Education versions for schools, colleges and universities, including DNS Security for Education and SIG for Education, with faculty and student licensing. Our Umbrella for schools page covers how they are used.
Not every add-on has a successor. Cisco's end-of-life notice lists no migration product for the L7 Cloud Firewall add-on, Reserved IP (Regional), RBI Isolate Web Apps and some Investigate Integration API and console products. If you rely on one of these, plan for it early.
Older package names: Insights, Platform and Professional
If your renewal paperwork mentions Umbrella Insights, Umbrella Platform or Umbrella Professional, you are on a package Cisco sold before the current four. Cisco announced the end of sale of these legacy offers in June 2025, with the last order and renewal date on 30 September 2025, and named a replacement for each:
| Legacy Umbrella offer | Cisco's named replacement |
|---|---|
| Insights | DNS Security Advantage |
| Platform | DNS Security Advantage |
| Professional | DNS Security Essentials |
| Roaming | DNS Security Essentials |
| SIG Add-on | SIG Essentials |
Cisco's support document comparing Insights with the newer packages shows that Insights lacked network tunnels, the secure web gateway and the cloud-delivered firewall, and that Investigate and S3 log management were add-ons on it rather than included. The same legacy notice lists no replacement for the App Discovery add-on for Professional or the standalone L3/L4 cloud firewall.
Because the current packages are themselves now at end of sale, the safest approach is to compare what you actually use (policies, identities, reports and integrations) with both the current Umbrella packages and Secure Access. We can do that audit for you from your dashboard.
How each package maps to Cisco Secure Access
Cisco announced the end of sale of Umbrella DNS and SIG on 1 September 2026. The last day to order is 31 January 2027, renewals and additions are possible until 31 January 2028, and the last date of support is 31 January 2029. Umbrella's successor is Cisco Secure Access, and Cisco's notice names a migration product for each package:
| Umbrella package | Cisco Secure Access migration product |
|---|---|
| DNS Security Essentials | Secure Access DNS Essentials (DNS Defense) |
| DNS Security Advantage | Secure Access DNS Advantage (DNS Defense) |
| DNS Security for Education | Secure Access DNS EDU Essentials |
| SIG Essentials | Secure Internet Access (SIA) Essentials |
| SIG for Education | Secure Internet Access (SIA) Essentials |
| SIG Advantage | Secure Internet Access (SIA) Advantage |
| DLP add-on | Secure Access DLP |
| RBI Isolate Any / Isolate Risky | Secure Access RBI Advanced / RBI Risky |
| Investigate console and API tiers | Secure Access Investigate console users and API (small, medium, large) |
Secure Access also adds Secure Private Access (SPA), its zero trust network access and VPN-as-a-service capability for private applications, which Umbrella never offered. Read the Umbrella end of life guide for the full milestone table and our Umbrella to Secure Access migration guide for the steps.
Licensing, choosing a package and how we help
All four packages are licensed per Covered User: one licence for each employee, contractor or other person the service protects. The SIG packages carry an average bandwidth allowance of up to 50 kbps per Covered User, measured on a 95th-percentile basis so short peaks are allowed, and the DNS packages carry a monthly average DNS query allowance. You also choose a Cisco support tier. Our Umbrella pricing page explains these terms; for figures, ask us for a quote.
A simple way to choose:
- Mainly need malware, phishing and content blocking with almost no maintenance? DNS Security Essentials
- Worried about threats on legitimate-but-risky sites, or need Umbrella Investigate for incident response? DNS Security Advantage
- Replacing an on-premises web proxy or protecting branch sites without local appliances? SIG Essentials
- Need application-aware firewalling, IPS or DLP in the cloud? SIG Advantage
Because of the 31 January 2027 end of sale, anyone buying new should weigh Umbrella against Secure Access now. Forever Systems can review your current usage, recommend a package or its Secure Access counterpart, and run a guided Umbrella free trial. Contact us for advice.
The four Umbrella packages
How Forever Systems supplies and supports Cisco Umbrella
We supply, deploy and support Cisco Umbrella for UK organisations, and plan the move to its successor, Cisco Secure Access.
- Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
- Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
- Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
- Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
- Ongoing support: reporting, policy tuning, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Umbrella quote, deployment or migration plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What are the Cisco Umbrella packages?
There are four: DNS Security Essentials, DNS Security Advantage, SIG Essentials and SIG Advantage. Each includes everything in the one below and adds more inspection, from DNS-layer blocking up to a full secure web gateway, cloud-delivered firewall, CASB, IPS and DLP.
What is the difference between Umbrella DNS Security and SIG?
DNS Security packages block threats and unwanted content when a domain is looked up. SIG packages also proxy and inspect the web traffic itself, add a cloud-delivered firewall and CASB, and accept IPsec tunnels from your sites.
Is remote browser isolation included in SIG Advantage?
No. Remote Browser Isolation is an add-on with both SIG packages, in Isolate Risky, Isolate Web Apps and Isolate Any options.
Can I still buy Cisco Umbrella?
Yes, until the end of sale on 31 January 2027. After that you can renew or add to an existing subscription until 31 January 2028, and support ends on 31 January 2029. New buyers should compare Cisco Secure Access as well.
What was Umbrella Insights?
Insights is an older Umbrella package, sold alongside Platform and Professional. Cisco's comparison shows it without tunnels, the secure web gateway or the cloud firewall, with Investigate and S3 logging as add-ons. Cisco stopped selling it on 30 September 2025 and named DNS Security Advantage as its replacement.
Do all Cisco Umbrella packages include log export to Amazon S3?
Yes. Cisco's package comparison lists S3 log export in all four packages, to your own bucket or a Cisco-managed one. Cisco-managed storage keeps logs for 7, 14 or 30 days, while your own bucket keeps them as long as you choose.