In short: Cisco Umbrella SIG (Secure Internet Gateway) is the cloud security tier of Umbrella. On top of DNS-layer security it adds a full secure web gateway, a cloud-delivered firewall, CASB, file sandboxing and optional DLP and Remote Browser Isolation. It is sold as SIG Essentials and SIG Advantage until 31 January 2027, then becomes Secure Access Secure Internet Access.
What Umbrella SIG is
A DNS-only Umbrella package decides whether a device may look up a domain. That stops a great deal of malware and phishing, but it never sees the web page, the file being downloaded or the non-web traffic leaving your site. Umbrella SIG goes further: traffic is sent to Cisco's cloud, where it is proxied, decrypted where your policy allows, inspected and logged before it carries on to the internet.
The result is one security stack in the cloud rather than a proxy, firewall and filtering appliance at every site. Policy follows the identity (a network, a tunnel, a roaming computer or a user) rather than the building, so a member of staff working from home gets the same protection as one in the office.
SIG is not a separate product you bolt on: it is the name for the two upper Umbrella packages, SIG Essentials and SIG Advantage. Both include everything in the DNS packages, including the intelligent proxy explained on our what is Cisco Umbrella? page.
The components of Umbrella SIG
Cisco describes the layers as working in sequence: DNS-layer security first, then the cloud-delivered firewall, then the secure web gateway, with data loss prevention as the last check on what leaves.
| Component | What it does | Where to read more |
|---|---|---|
| Secure web gateway (SWG) | Full web proxy: URL filtering, HTTPS inspection with decryption exemptions, file inspection, file type control, tenant controls | Umbrella secure web gateway |
| Cloud-delivered firewall | Layer 3/4 rules on outbound traffic from tunnelled sites; Layer 7 application control and IPS in SIG Advantage or as an add-on | Umbrella cloud-delivered firewall |
| CASB | App Discovery, risk information, app blocking, tenant controls and cloud malware detection | Umbrella CASB |
| File inspection sandbox | Detonates unknown files from web traffic in a sandbox before they are trusted | Cisco Secure Malware Analytics |
| Data loss prevention | Inline inspection of uploads and posts for sensitive data; included in SIG Advantage, an add-on to SIG Essentials | Umbrella DLP |
| Remote Browser Isolation | Runs risky web sessions in a cloud browser so code never reaches the device; an add-on to both SIG packages | Umbrella RBI |
Cisco lists London and Manchester among Umbrella's data centres, so UK traffic can be handled close to where users are.
How traffic gets to Umbrella SIG
DNS packages only need your DNS pointed at Umbrella. SIG needs the traffic itself, which arrives in one of four ways. Most organisations use two or three of them together; our Cisco Umbrella deployment guide covers each in order.
- IPsec tunnels from sites: a firewall, router or SD-WAN device builds an IKEv2 tunnel to Umbrella and sends internet-bound traffic through it. This is the only route into the cloud-delivered firewall. See Umbrella IPsec tunnels and Umbrella and Cisco Meraki. Cisco uses an anycast design so a tunnel can move to another data centre if one fails.
- The roaming module on laptops: the Umbrella Roaming Security Module in Cisco Secure Client (formerly AnyConnect) can send web traffic to the secure web gateway from anywhere, as well as protecting DNS.
- PAC files: browsers are told to use Umbrella as their proxy through a proxy auto-configuration file, which suits managed devices where installing a client is not wanted.
- Proxy chaining: an existing on-premises proxy forwards traffic to Umbrella, useful as a stepping stone while an old proxy is retired.
Chromebooks have their own route through Cisco Security for Chromebook. To apply policy by user rather than by tunnel or IP address, connect your directory and, where needed, SAML authentication; see Umbrella identities and SAML.
SIG Essentials or SIG Advantage?
The two packages share the same core: secure web gateway, sandbox, Layer 3/4 cloud firewall, CASB and tunnels. The difference is two capabilities.
| Capability | SIG Essentials | SIG Advantage |
|---|---|---|
| Layer 7 firewall and IPS | Add-on | Included |
| Data loss prevention | Add-on | Included |
| Remote Browser Isolation | Add-on | Add-on |
The edition pages go into detail: SIG Essentials and SIG Advantage, and the full four-package comparison is on Cisco Umbrella packages.
Licensing and the SIG bandwidth term
Like every Umbrella package, SIG is licensed per Covered User: one licence for each employee, contractor or other person the service protects. The SIG packages also carry an average bandwidth allowance in Cisco's offer terms of up to 50 kbps per Covered User, worked out on a 95th-percentile basis so short bursts do not count against you.
For most offices that allowance is comfortable, but sites with heavy traffic and few licensed people (guest Wi-Fi, kiosks, labs or media-heavy teams) need sizing with it in mind before a tunnel is switched on. We cover the detail on our Umbrella pricing page. For figures, ask us for a quote.
End of sale: SIG becomes Secure Internet Access
Cisco announced the end of sale of Umbrella SIG and DNS on 1 September 2026. SIG can be ordered until 31 January 2027, renewed or added to until 31 January 2028, and is supported until 31 January 2029. Existing subscriptions keep running under their terms.
The successor is Secure Internet Access (SIA) in Cisco Secure Access, with SIG Essentials mapping to SIA Essentials and SIG Advantage to SIA Advantage. Secure Access also adds Secure Private Access (SPA) for zero trust access to internal applications, which Umbrella never offered. Two SIG-related items have no migration product: the standalone L7 Cloud Firewall add-on and RBI Isolate Web Apps. Our Umbrella end of life guide lists every milestone, and the Umbrella to Secure Access migration guide covers the steps.
If you are comparing SIG with other vendors' approaches, our vendor-neutral guide to SASE explains how secure internet gateways fit into the wider model.
How we help with Umbrella SIG
Forever Systems designs, deploys and supports SIG for UK organisations: choosing between Essentials, Advantage and add-ons; sizing against the bandwidth term; building redundant tunnels from your firewalls or Meraki appliances; rolling out the roaming module and the Umbrella root certificate; writing decryption bypasses for apps that break under inspection; and tuning policy once real traffic is flowing. With end of sale close, we also help you decide whether to renew SIG or move straight to Secure Access. Contact us for a design review or quote.
Explore Umbrella SIG
How Forever Systems supplies and supports Cisco Umbrella
We supply, deploy and support Cisco Umbrella for UK organisations, and plan the move to its successor, Cisco Secure Access.
- Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
- Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
- Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
- Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
- Ongoing support: reporting, policy tuning, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Umbrella quote, deployment or migration plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Cisco Umbrella SIG?
Umbrella SIG (Secure Internet Gateway) is the cloud security tier of Cisco Umbrella. It adds a secure web gateway, cloud-delivered firewall, CASB and file sandboxing to DNS-layer security, with DLP and Remote Browser Isolation available, so traffic from sites and remote users is inspected in Cisco's cloud.
What is the difference between Umbrella DNS and Umbrella SIG?
The DNS packages decide whether a domain may be looked up, plus the intelligent proxy for risky domains in DNS Security Advantage. SIG proxies and inspects the traffic itself: every web request, downloaded files and outbound non-web traffic from tunnelled sites.
How does traffic get to Umbrella SIG?
Through IPsec (IKEv2) tunnels from firewalls, routers or SD-WAN; through the Umbrella Roaming Security Module in Cisco Secure Client on laptops; through PAC files; or by proxy chaining from an existing on-premises proxy.
Is there a bandwidth limit on Umbrella SIG?
Cisco's offer terms set an average of up to 50 kbps per Covered User for the SIG packages, measured on a 95th-percentile basis so brief peaks are allowed. Sites with heavy traffic and few licensed users need sizing with this in mind.
What replaces Umbrella SIG?
Cisco Secure Access Secure Internet Access (SIA). SIG Essentials maps to SIA Essentials and SIG Advantage to SIA Advantage. SIG can be ordered until 31 January 2027 and is supported until 31 January 2029.