In short: Cisco Umbrella DLP is the data loss prevention capability in Umbrella SIG. It inspects web and cloud-app traffic inline as it passes through the secure web gateway, matches content against pre-built and custom data identifiers, and blocks or logs matches. It is included in SIG Advantage, an add-on to SIG Essentials, and migrates to Secure Access DLP.
What Umbrella DLP does
Data rarely leaves an organisation through a dramatic breach. More often, someone uploads a spreadsheet to a personal file-sharing account, pastes customer details into a web form, or attaches a file to the wrong webmail. Umbrella DLP watches for that at the point it happens: in the web and cloud-app traffic flowing through the Umbrella secure web gateway.
Cisco describes DLP as the last of Umbrella's layers, after DNS-layer security, the cloud-delivered firewall and the secure web gateway. By the time content reaches the DLP engine, Umbrella has already decided the destination is allowed; DLP then decides whether this content may go there.
How inline DLP works
- Traffic from a site tunnel, the roaming module or a PAC file reaches the secure web gateway.
- The gateway decrypts HTTPS (with your decryption exemptions respected), so the content of uploads and posts can be read.
- Content is checked against your DLP rules, which combine data identifiers with the identities, destinations and apps the rule applies to.
- On a match, Umbrella blocks the upload or lets it through and records the event, depending on the rule's action.
- Events appear in Umbrella's DLP reporting, so you can see who tried to send what, where, and tune rules over time.
Cisco says Umbrella DLP ships with more than 80 pre-built dictionaries and customisable data identifiers, covering common types such as personal data and payment card numbers. Cisco also describes an out-of-band mode that uses SaaS APIs to scan data already at rest in sanctioned cloud apps, without the proxy, with near real-time enforcement. Because inline DLP depends on decryption, the Umbrella root certificate must be on inspected devices.
Packages and licensing
| Package | DLP |
|---|---|
| DNS Security Essentials | Not available |
| DNS Security Advantage | Not available |
| SIG Essentials | Add-on |
| SIG Advantage | Included |
DLP is licensed per Covered User alongside the SIG package, in line with Umbrella's licensing model; see Umbrella pricing. If you need DLP and Layer 7 firewall with IPS, SIG Advantage is usually simpler than two add-ons on SIG Essentials. For figures, ask us for a quote.
DLP, CASB and UK GDPR
DLP and Umbrella CASB work as a pair. The App Discovery report shows which cloud apps people use; DLP inspects what they send to the ones you allow. Together they answer two questions UK GDPR makes organisations ask: where is personal data going, and is it protected while it gets there?
DLP supports, rather than delivers, compliance. It helps show you have appropriate technical measures to prevent unauthorised disclosure, and its event logs help when you assess whether an incident needs reporting. But rules need tuning to avoid false positives, policies must be explained to staff, and logs of what people tried to upload are themselves personal data to handle carefully. Pair DLP with GDPR training for staff so people understand why an upload was stopped.
End of sale and Secure Access DLP
Umbrella DLP is on Cisco's end-of-life notice. The last day to order is 31 January 2027, renewals and additions are possible until 31 January 2028, and the last date of support is 31 January 2029. Cisco lists Secure Access DLP as the migration product, and SIG Advantage maps to Secure Internet Access Advantage in Cisco Secure Access.
DLP rules and data identifiers are part of the policy you will need to carry across, so record them in your pre-migration audit. See the Umbrella end of life guide and Umbrella to Secure Access migration guide.
How we help
Forever Systems helps you get value from Umbrella DLP without drowning in alerts. We start in monitor mode, identify the data that really matters to you, build rules for the apps and groups where risk is highest, then move the worst cases to block. We also connect the results to your CASB review and your data protection documentation. Contact us for a DLP design or quote.
How Forever Systems supplies and supports Cisco Umbrella
We supply, deploy and support Cisco Umbrella for UK organisations, and plan the move to its successor, Cisco Secure Access.
- Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
- Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
- Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
- Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
- Ongoing support: reporting, policy tuning, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Umbrella quote, deployment or migration plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Cisco Umbrella DLP?
The data loss prevention capability in Umbrella SIG. It inspects web and cloud-app traffic inline through the secure web gateway and blocks or logs content that matches data identifiers, such as personal data or payment card numbers.
Is DLP included in Umbrella SIG Essentials?
No. DLP is an add-on with SIG Essentials and is included in SIG Advantage. It is not available with the DNS packages, because it relies on the secure web gateway.
Does Umbrella DLP need HTTPS decryption?
Yes, for inline inspection. Most uploads travel over HTTPS, so the secure web gateway must decrypt them, which means the Umbrella root certificate must be on inspected devices.
What replaces Umbrella DLP?
Cisco lists Secure Access DLP as the migration product. Umbrella DLP can be ordered until 31 January 2027 and is supported until 31 January 2029.
Does Umbrella DLP make us GDPR compliant?
No tool does that on its own. DLP is a technical measure that helps prevent unauthorised disclosure of personal data and provides evidence, but UK GDPR also needs policies, training and good handling of the DLP logs themselves.