What Is Secure Web Gateway?

A secure web gateway is the product category built around forward proxy egress control, combining URL filtering, malware scanning, application control and data inspection into a managed service.

Its recent shift has been from appliance to cloud delivery, driven by the same change that produced SASE: when users are not in the office, an appliance in the office cannot inspect their traffic.

What it does beyond blocking categories

Category filtering is the visible function and the least interesting. More useful capabilities include blocking newly registered domains, which are disproportionately used in phishing; identifying and controlling cloud applications rather than just sites; scanning downloads; and providing the egress record that makes investigation possible.

Isolation is the capability worth understanding. Rather than allowing or blocking an uncertain site, the gateway can render it remotely and deliver only a visual stream — the user sees the page, and no code from it reaches the endpoint.

The coverage question decides its value

A gateway inspects the traffic that reaches it. Users on personal devices, mobile connections or networks where the agent is not enforced are outside it, as is any application that does not honour the configured path.

Cloud-delivered gateways address much of this through an endpoint agent that forwards traffic regardless of location, which is the main practical advantage over an appliance and the reason most deployments have moved that way.

Where it overlaps and where it does not

There is genuine overlap with next-generation firewall capability and with CASB, which is why these are converging into single platforms. The distinction worth maintaining is that a gateway governs traffic to the internet generally, while a broker governs interaction with specific cloud applications, including activity inside them.

Categorisation is imperfect and needs an appeal path

URL categorisation is automated and wrong often enough to matter. Legitimate business sites are miscategorised, newly created sites are uncategorised, and staff blocked from something they need will find another route — a personal device, a mobile connection, a proxy.

A fast, low-friction way to request review is therefore a security control rather than a convenience. Where unblocking takes days and a ticket, the workaround becomes the norm and visibility is lost entirely.

Block pages that explain the reason and offer a one-click request path resolve most of this, and they convert an adversarial relationship with the control into a manageable one.

Privacy and employment considerations belong in the deployment decision rather than after it. Inspecting staff traffic is lawful in most contexts with appropriate notice, and the notice is the part frequently missing — which converts a reasonable control into an employee relations problem and, in some jurisdictions, a compliance one.

A common mistake worth avoiding

Where to start

Check what proportion of your workforce currently has traffic inspected at all. For most organisations with substantial remote working, the honest answer is considerably less than they assume.

See DNS security. GuardsArm delivers managed security.