Switch between buying licenses upfront to a pay-as--you-go monthly subscription licenses

Flexible, fast, and effective cloud-delivered security

Control desktop, laptop, and mobile device access to malicious and inappropriate websites.

Buy Now Schedule Demo Take Tour Play Video
Secure-Web-Gateway (3)
Plans DNS Security Essentials DNS Security Advantage Secure Internet Gateway (SIG) Essentials
Good for small companies or as first line of defense for any size company Good for mid-sized companies or as first line of defense for any size company Includes Ideal for companies with Cisco SD-WAN, and large companies with advanced security and web policy needs
Licensing by the number of users
Security & Controls
DNS-layer security
Block domains associated with phishing, malware, botnets, and other high risk categories (cryptomining, newly seen domains, etc.)
Block domains based on partner integrations (Splunk, Anomali, & others) and custom lists using our enforcement API
Block direct-to-IP traffic for C2 callbacks that bypass DNS
Secure web gateway
Proxy web traffic for inspection Traffic associated with risky domains via selective proxy All web traffic
Decrypt and inspect SSL (HTTPS) traffic With selective proxy
Enable web filtering By domain or domain category By domain or domain category By domain, URL, or category
Block URLs based on Cisco Talos and third party feeds, and block files based on AV engine and Cisco Advanced Malware Protection (AMP) data With selective proxy
Use Cisco Threat Grid cloud sandbox environment to analyze suspicious files (200 files/day)
Use retrospective security to identify previously-benign files that became malicious
Cloud-delivered firewall
Create layer 3/layer 4 policies to block specific IPs, ports, and protocols
Use IPSec tunnel termination
Cloud access security broker
Discover and block shadow IT (based on domains) with our App Discovery report
Discover and block shadow IT (based on URLs) with App Discovery report
Create policies with granular controls (block uploads, attachments, and posts) for select apps
Umbrella Investigate
Access Investigate’s web console for interactive threat intelligence (5 logins)
Use the Investigate on-demand enrichment API to enrich other tools/systems with domain, URL, IP, and file threat intelligence (2,000 requests per day)
Integrate with Cisco Threat Response to aggregate threat activity across Cisco AMP, Threat Grid, Email Security, NGFW, and Umbrella With enforcement API only
Deployment & management
Traffic forwarding
Forward external DNS traffic for:
On-network protection via Cisco (SD-WAN, Meraki MR, Integrated Services Router, & Wireless LAN Controller) and third party integrations (Cradlepoint, Aerohive, & others)
Off-network protection via AnyConnect, Umbrella roaming client, and Cisco Security Connector for iOS
Send outbound network traffic via IPSec tunnel, proxy chaining, or PAC filesI ●
User attribution
Create policies and view reports by:
• Network (egress IP)
• Internal subnet²
• Network device (including VLAN or SSID)
• Roaming device
• Active Directory group membership (including specific users)⁴
Create policies and view reports using SAML
Customize block pages and bypass options
Use our multi-org console to centrally manage decentralized orgs
Use our management API to create, read, update, and delete identities using own internal tools
Reporting and logs
Leverage real-time activity search and our reporting API to easily extract key events
Choose North America or Europe for log storage
Use customer or Cisco-managed AWS S3 bucket to export and retain logs as long as needed
Access domain request logs in our user interface (30 day: detail, 1yr: summary)
Access full URL logs in our user interface (30 days: detail)
Access firewall (IP, port, and protocol) logs in our user interface (30 days: detail)
Enhanced - 24 x 7 technical + on-boarding Required
Premium - 24 x 7 technical + on-boarding + Technical Account Manager (TAM) Optional upgrade
Learn More Learn More Learn More Learn More

Cybersecurity teams and tools are falling behind

Rise in risky cyberthreats

As threats rise in sophistication, the cost to identify, detect, and block threats rises, too. But attackers often reuse infrastructure in multiple attacks — leaving cyber fingerprints. What if you could use those fingerprints to uncover attacks before they launch?

Branch offices, remote users

Your users work from many locations and devices. What if you had a fast, easy way to protect remote and roaming workers, secure direct internet access at branch offices, and control the use of cloud-based apps without the need for another appliance?

Security blind spots

Your goal is keep the bad stuff out, and keep the good stuff in. Chasing security alerts from disparate tools wastes time, money, and strains resources. What if you had access to better intelligence and integrated security that exposes blind spots, while being simple to manage?

DNS-layer security benefits:

Reduce malware and alerts

Xcellhost reduces the number of infections and alerts you see from other security products by stopping threats at the earliest point. With no hardware to install or software to manually update, ongoing management is simple.

Improve internet performance

Xcellhost has a highly resilient network that boasts 100% business uptime since 2006. Our 30 plus data centers worldwide use Anycast routing so requests are transparently sent to the fastest available with automatic failover.

Proactively respond to threats

Xcellhost logs all DNS activity to simplify investigations. Xcellhost Investigate provides context to prioritize incidents and speed up response. Cisco Threat Response automates insights across Cisco products for quick answers.

use cases

Xcellhost secure web gateway functionality is a cloud-native service that can proxy all of your web traffic for a greater level of visibility and control. It enables you to log all usage, protect against viruses and malware, enforce acceptable use policies, and simplify investigations. These full proxy capabilities are part of Xcellhost SIG Essentials package which also includes DNS Security a cloud-delivered firewall, CASB functionality, and Xcellhost Investigate threat intelligence data to provide a robust, secure internet gateway.

Here’s how:

DNS & IP layer enforcement

Xcellhost uses DNS to stop threats over all ports and protocols — even direct-to-IP connections. Stop malware earlier and prevent callbacks to attackers if infected machines connect to your network.

Web security via selective proxy

Xcellhost routes requests to risky domains to a selective proxy for deeper URL and file inspection. Effectively protect without delay or performance impact.

App discovery & blocking

Xcellhost provides visibility into cloud apps used across your organization, so you can identify potential risk and block specific applications easily.

Moving to a better way


of organizations are shifting to direct internet access for some or all of their branch/remote offices


of organizations would prefer a multi-function security platform to secure their branch offices


of organizations expect that all their proxies will be cloud-based in the future

features & benefits

Features Benefits
Full URL logging/reporting Better visibility of trends and faster investigations which results in lower remediation costs
Anti-virus and anti-malware file inspection and blocking Thorough anti-virus and anti-malware scanning to reduce the number of successful attacks
SSL decryption (full/selective) Ability to decrypt and inspect encrypted web traffic and block hidden attacks to lower the number of infections
Content control (URL filtering, acceptable use enforcement) Content control (URL filtering, acceptable use enforcement)
File sandboxing and retrospective alerts Discover hidden threats and evasive malware that is used in advanced attacks to avoid breaches
Application visibility and control Reduced risk from Shadow IT apps through visibility, blocking and granular activity controls
Automated tunnel failover Faster deployment and simplified management of tunnels

Find the right solution for your business


Our packages have changed! Learn more below.

DNS Security Essentials

DNS Security Advantage

Secure Internet Gateway (SIG) Essentials

talk to our cloud expert


We have implemented Umbrella since 2 Years and I can say we have 100 % safe to any DNS name resolution. It is very good solution i ever used.

-kalpesh patre

A cyber security software like cisco umbrella, has unique resources.

-Jaron Lorso

It is fast, reliable, and easy to deploy.It has documentation and a knowledge base available.

-John Patrick


The steps for setting up Cisco Umbrella are:
  1. Setup your Cisco Umbrella portal.
  2. Set your security and content settings.
  3. Install the Cisco DNS appliance on all sites where you have internal DNS.
  4. Point your internal DNS to the appliance.
  5. Roll out the Cisco Umbrella Roaming agents.

For most Umbrella packages, we license by the total number of users with internet access. Count employees that connect IT-provisioned or user-owned devices to local or remote networks.

Cisco Umbrella offers flexible, cloud-delivered security when and how you need it. It combines multiple security functions into one solution, so you can extend protection to devices, remote users, and distributed locations anywhere. Umbrella is the easiest way to effectively protect your users everywhere in minutes.

As a Secure Internet Gateway, Cisco Umbrella provides the first line of defense against threats on the internet wherever users go. Umbrella delivers complete visibility into internet activity across all locations, devices, and users, and blocks threats before they ever reach your network or endpoints.

Accessing websites censored by Cisco Umbrella
  1. Disconnect from the ExpressVPN app or disable any manually configured VPN connections.
  2. Disable the Cisco Umbrella roaming client. Some Mac users may prefer to disable the roaming client from the Menu Bar instead.
  3. Connect to ExpressVPN.
  4. Access the sites you want to visit.

The first test (http://welcome.opendns.com) is whether your network, computer or device correctly using Umbrella for DNS resolution. The second test (http://www.internetbadguys.com) is whether your identities are correctly configured to block sites based on security settings.

Related Products & Services

Business email

Business Email

Our Business Email package comes with a storage space of 5GB per account. This is dedicated to file storage and also backs up all your mails on our state of the art infrastructure, making sure you never experience a loss of mails

Microsoft Integration_1

Microsft 365

Includes Office 365, Windows 10 & Enterprise Mobility + Security. Learn More Now. Trusted & Secure. Secure Cloud Service. Intelligent Security. Built For Teamwork. Achieve More Together.

Email signature

E-mail Signatures

Microsoft Office 365, Exchange Server and G Suite solutions for email signatures, archiving, email utilities & more.