In short: Cisco Umbrella is Cisco's cloud security service, built on OpenDNS, that blocks malicious and unwanted domains at the DNS layer and, in its SIG packages, adds a secure web gateway, cloud-delivered firewall and CASB. It is sold in four packages until its end of sale on 31 January 2027; Cisco Secure Access is the successor.
What Cisco Umbrella does
Cisco Umbrella is a cloud-delivered security service. Almost every connection to the internet starts with a DNS lookup, and Umbrella answers those lookups. If a domain is known to host malware, phishing or command-and-control infrastructure, or falls into a content category your policy blocks, Umbrella refuses to hand over the address and the connection never starts.
That DNS-layer protection is the foundation. The higher packages add an intelligent proxy for risky domains and, in the Secure Internet Gateway (SIG) packages, a full web proxy, a cloud-delivered firewall and a cloud access security broker. Threat intelligence comes from Cisco Talos.
Umbrella grew out of OpenDNS, which Cisco bought in 2015. The free consumer OpenDNS services still exist, but they are not the same thing as a business Umbrella subscription; our OpenDNS guide explains the difference. For a fuller plain-English explanation, read what is Cisco Umbrella?
The four Umbrella packages
Umbrella is sold in four packages, and each builds on the one below it. The table summarises the headline differences and the Cisco Secure Access product Cisco maps each one to. Our Cisco Umbrella packages page has the full comparison, including add-ons and Education versions.
| Package | What it adds | Maps to in Cisco Secure Access |
|---|---|---|
| DNS Security Essentials | DNS-layer security, more than 100 content categories, allow and block lists, on- and off-network protection, reporting and log export to Amazon S3 | DNS Defense Essentials |
| DNS Security Advantage | Intelligent proxy for URL blocking and file inspection on risky domains, plus the Umbrella Investigate console and on-demand enrichment API | DNS Defense Advantage |
| SIG Essentials | Full secure web gateway, cloud-delivered firewall, CASB, file inspection and sandbox, IPsec tunnels | Secure Internet Access Essentials |
| SIG Advantage | Layer 7 firewall and IPS, and data loss prevention, included | Secure Internet Access Advantage |
Remote Browser Isolation is an add-on to both SIG packages, and the layer 7 firewall with IPS, and DLP, are add-ons to SIG Essentials. The Secure Access names in the right-hand column are the migration products Cisco lists in its end-of-life notice. Umbrella is licensed per Covered User; see Cisco Umbrella pricing for how licensing works. For pricing, ask us for a quote.
How Umbrella is deployed
Most organisations combine several of these methods. Our Cisco Umbrella deployment guide covers each one in order.
- Network DNS: point your router, firewall or DNS server forwarders at the Umbrella DNS servers and register the network as an identity.
- Internal DNS and Active Directory: deploy the Umbrella virtual appliance so internal names keep resolving locally and reports show internal IP addresses and users.
- Laptops off the network: install the Umbrella Roaming Security Module in Cisco Secure Client (formerly AnyConnect).
- Chromebooks: use Cisco Security for Chromebook, the extension that replaced the legacy Umbrella Chromebook clients.
- Sites on SIG: build Umbrella IPsec tunnels from firewalls, routers or SD-WAN, including Cisco Meraki.
- Users and groups: connect Active Directory, Microsoft Entra ID (formerly Azure AD) or Okta so policy and reports follow people, not just IP addresses. See Umbrella identities and SAML.
Umbrella features
- Umbrella SIG: how the Secure Internet Gateway fits together
- Umbrella secure web gateway: full proxy with HTTPS inspection and URL filtering
- Umbrella CASB: App Discovery, risk scoring and app controls
- Umbrella cloud-delivered firewall: outbound firewall rules for connected sites
- Umbrella Remote Browser Isolation and Umbrella DLP
- Umbrella content filtering and the Umbrella content and security categories
- Umbrella Investigate: threat intelligence console and API
- Umbrella reporting: the dashboard, scheduled reports and log export
Umbrella for schools and multi-site organisations
Umbrella suits education because DNS filtering works the same on site and off, on Windows laptops, Macs and Chromebooks. Cisco has sold Education versions of the DNS and SIG packages. In its end-of-life notice, the migration product for Umbrella DNS for Education is Cisco Secure Access DNS EDU Essentials, and Umbrella SIG for Education moves to Secure Internet Access Essentials. Read Cisco Umbrella for schools, and our guide to appropriate filtering for schools for what the DfE and the UK Safer Internet Centre expect. Schools must satisfy themselves that any filtering provider meets those expectations; we help you assess and configure Umbrella against them.
Groups with many sites, multi-academy trusts and franchises can manage several Umbrella organisations from one place. See Umbrella multi-org and MSP consoles.
End of sale and the move to Cisco Secure Access
Cisco announced the end of sale and end of life of Umbrella SIG and DNS on 1 September 2026, as Umbrella evolves into Cisco Secure Access. The milestones are:
| Milestone | Date |
|---|---|
| End-of-life announcement | 1 September 2026 |
| End of sale, last ship and end of software maintenance | 31 January 2027 |
| Last day to renew or add to a subscription | 31 January 2028 |
| Last date of support | 31 January 2029 |
Customers with active, paid subscriptions keep their service and Cisco support under their subscription terms. Any new or renewed Umbrella term must end on or before the last date of support, so every Umbrella customer now needs a plan.
Cisco is running a special offer for Umbrella customers who upgrade to Secure Access (ask us for the current terms), and provides a no-cost, automated Upgrade Manager that moves Umbrella DNS and SIG policies into Secure Access. Some items have no migration product, including the Umbrella L7 Cloud Firewall add-on, Umbrella Reserved IP, Remote Browser Isolation - Isolate Web Apps, the Investigate Integration API and the Umbrella bundles sold with Cisco SD-WAN and DNA licences.
Read Cisco Umbrella end of life for the full list of what is affected, and migrating from Umbrella to Secure Access for the step-by-step plan.
Buying Umbrella now
If you are buying for the first time, weigh up Umbrella against going straight to Secure Access: a new Umbrella order can be placed until 31 January 2027, but the term must end by 31 January 2029 and you will need to migrate before then. Existing customers can renew or add licences until 31 January 2028.
- Cisco Umbrella pricing: how per-user licensing, bandwidth terms and support tiers work
- Cisco Umbrella free trial: what Cisco's 14-day trial covers and what to test
Forever Systems supplies Umbrella licences, designs policy, runs the deployment and supports you afterwards, and plans your migration when you are ready. Contact us for a quote or a review of your current set-up.
Explore Cisco Umbrella
How Forever Systems supplies and supports Cisco Umbrella
We supply, deploy and support Cisco Umbrella, and plan the move to its successor, Cisco Secure Access.
- Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
- Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
- Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
- Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
- Ongoing support: reporting, policy tuning, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Umbrella quote, deployment or migration plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Cisco Umbrella still available?
Yes, until Cisco's end-of-sale date of 31 January 2027. Existing subscriptions can be renewed or added to until 31 January 2028, and Cisco supports Umbrella until 31 January 2029. New buyers should also evaluate Cisco Secure Access, which is Cisco's successor to Umbrella.
What is replacing Cisco Umbrella?
Cisco Secure Access. Cisco maps Umbrella DNS packages to Secure Access DNS Defense and Umbrella SIG to Secure Access Secure Internet Access. Secure Access also adds Secure Private Access for zero trust access to private applications. See our migration guide.
Does Umbrella work for remote workers?
Yes. The Umbrella Roaming Security Module in Cisco Secure Client protects Windows and Mac laptops on any network, and Cisco Security for Chromebook covers Chromebooks. See Umbrella roaming client.
Is Cisco Umbrella free?
No. Umbrella is a paid subscription, licensed per user. Cisco offers a 14-day free trial, and the separate consumer OpenDNS Home and FamilyShield services are free, but those are not covered by Umbrella's terms or service levels. See OpenDNS and Cisco Umbrella.
Does Umbrella help with Cyber Essentials?
It can support your approach to malware protection by blocking connections to known-malicious domains, but it does not replace the controls the scheme requires on each device. See Cyber Essentials requirements.