In short: Cisco Umbrella Remote Browser Isolation (RBI) is an add-on for the Umbrella SIG packages that runs web sessions in a cloud surrogate browser and sends only safe rendered content to the user. It is sold as Isolate Risky, Isolate Web Apps and Isolate Any. In Secure Access the successors are RBI Risky and RBI Advanced; Isolate Web Apps has none.
What browser isolation is
Most web filtering makes a yes-or-no decision: a site is allowed or blocked. That leaves a grey area of uncategorised, newly registered or just-suspicious sites that you cannot block without frustrating staff, but would rather they did not open directly.
Browser isolation handles the grey area. Instead of the user's browser loading the page, a browser in the cloud loads it, runs its code, and sends a safe rendering back. The user can read and interact with the site, but scripts, exploits and drive-by downloads run in a disposable cloud session rather than on the laptop. When the session ends, it is thrown away.
Cisco describes Umbrella RBI as creating a surrogate browser in the cloud that visits the site on the user's behalf, and says it works with any device, browser and operating system because nothing extra runs on the endpoint.
How Umbrella RBI works
Umbrella RBI is built on the Umbrella secure web gateway, so it needs a Umbrella SIG package and traffic reaching the SWG through a tunnel, the roaming module or a PAC file.
- A user requests a website that matches a web policy rule with an isolate action.
- The secure web gateway opens the page in a surrogate browser in Cisco's cloud instead of passing it straight through.
- The surrogate browser runs the page's code; the user's browser receives a safe rendering and passes clicks and typing back.
- When the user leaves the site, the cloud session is discarded along with anything it picked up.
Because isolation is applied by policy rule, you can isolate a small set of destinations or user groups rather than everything, which keeps the user experience good where it matters.
The three Umbrella RBI options
Cisco sells RBI as three add-on options, available with both SIG Essentials and SIG Advantage. None is included in either package by default.
| Option | Scope, as the name indicates | Secure Access migration product |
|---|---|---|
| Isolate Risky | Isolation aimed at risky destinations | Secure Access RBI Risky |
| Isolate Web Apps | Isolation for web apps | None listed by Cisco |
| Isolate Any | Isolation for any destination your policy chooses | Secure Access RBI Advanced |
The right option depends on who you are protecting. Isolate Risky suits a general workforce, where the aim is to let people open risky links safely. Broader isolation suits high-risk roles, such as finance teams who open links from suppliers, or executives who are frequent phishing targets. We will confirm the exact scope of each option against Cisco's current terms when we quote.
Who Umbrella RBI suits
- Organisations that see frequent phishing and want a safety net for links that get past email filtering
- Teams that must open external links as part of their job: finance, HR, procurement, legal
- Sectors that want to reduce blocking without accepting more risk, such as education and research
- Security teams that want to treat uncategorised and newly seen domains more cautiously than a plain allow
RBI does not replace user awareness. It reduces the damage a malicious page can do, but a user can still be tricked into typing a password into an isolated phishing page. Pair it with phishing awareness training. Other approaches to browser protection exist too, such as browser-extension security like Check Point Harmony Browse, and we can compare them honestly.
End of sale and migration
All three RBI options are on Cisco's end-of-life notice for Umbrella. The last day to order is 31 January 2027, renewals and additions are possible until 31 January 2028, and support ends on 31 January 2029.
Cisco lists Secure Access RBI Risky and RBI Advanced as the migration products for Isolate Risky and Isolate Any. Isolate Web Apps has no migration product, so customers using it should review how the same protection will be delivered in Cisco Secure Access before renewal. Cisco's notice also maps some RBI bundles sold with SIG Advantage under enterprise agreements to Secure Internet Access Advantage. Read the Umbrella end of life guide and the Umbrella to Secure Access migration guide.
How we help
Forever Systems helps you decide whether isolation is worth it, which option fits, and which users and destinations to isolate. We build the web policy rules, pilot with a high-risk group and check the user experience before wider roll-out. If you are already on Isolate Web Apps, we plan the replacement in Secure Access. Contact us for advice or a quote.
How Forever Systems supplies and supports Cisco Umbrella
We supply, deploy and support Cisco Umbrella for UK organisations, and plan the move to its successor, Cisco Secure Access.
- Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
- Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
- Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
- Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
- Ongoing support: reporting, policy tuning, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Umbrella quote, deployment or migration plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Cisco Umbrella Remote Browser Isolation?
An add-on for the Umbrella SIG packages that opens chosen websites in a surrogate browser in Cisco's cloud and sends only a safe rendering to the user, so malicious code on the page never runs on the device.
Is RBI included in Umbrella SIG Advantage?
No. Remote Browser Isolation is an add-on with both SIG Essentials and SIG Advantage. It is not available with the DNS packages because it depends on the secure web gateway.
What are the Umbrella RBI options?
Cisco sells three until 31 January 2027: Isolate Risky, Isolate Web Apps and Isolate Any. As the names suggest, Isolate Risky targets risky destinations, while the broader options extend isolation to web apps or to any destination your policy chooses. We confirm the exact scope against Cisco's current terms when quoting.
What replaces Umbrella RBI in Cisco Secure Access?
Cisco lists Secure Access RBI Risky and RBI Advanced as migration products for Isolate Risky and Isolate Any. Isolate Web Apps has no migration product.
Does browser isolation need software on the device?
No. Cisco says Umbrella RBI works with any device, browser and operating system, because the isolated browser runs in the cloud. Traffic does need to reach the Umbrella secure web gateway.