What is a Secure Web Gateway (SWG)?

Secure Web Gateway (SWG) is a security service that inspects and controls the traffic between an organization’s users and the internet, enforcing policies such as URL filtering, SSL/TLS decryption, malware scanning, DNS filtering, and file filtering – delivered as a cloud service, an on-premises appliance, or a mix of both.

Key takeaways

• SWG inspects and filters outbound web traffic before it reaches the internet.
• Core controls: URL filtering, SSL/TLS decryption, malware and DNS filtering.
• Cloud-delivered SWGs enforce policy near users instead of backhauling traffic.
• SWG is a foundational SSE service alongside CASB, ZTNA, and DLP.
• Versa consolidates SWG within Versa Secure Internet Access (VSIA).

On this page: Why it matters · How it works · Types · SWG & Versa · FAQ

Why is SWG important?

The web is the primary path enterprise users take to reach SaaS applications, cloud services, and the open internet – and the primary path malware, phishing, and command-and-control traffic take to reach users. Without inspection, that traffic moves unchecked in both directions.

Historically, organizations enforced web policy with an on-premises proxy at the data-center edge, backhauling branch traffic to a central choke point before it reached the internet. As users spread outside the data center, that model stopped scaling.

SWG matters because it moves inspection to where traffic originates: a cloud gateway near the user, or an appliance at the branch, applying consistent policy regardless of location – the trait that makes SWG a building block of Security Service Edge (SSE) and, by extension, SASE.

What is SWG?

An SWG sits logically between users and the internet – implemented as a forward proxy, a PAC-file-directed gateway, or a client agent that redirects traffic to an inspection point. Every HTTP and HTTPS request passes through the gateway before reaching its destination.

Because most web traffic is encrypted, an SWG typically performs SSL/TLS decryption to inspect session contents, then re-encrypts before forwarding, with exceptions for privacy-sensitive categories such as banking or healthcare sites. Once visible, traffic is checked against URL filtering, malware scanning, DNS filtering, and file filtering, evaluated against the requesting user’s identity and context.

An SWG can be delivered as a cloud service, an on-premises appliance, or a hybrid of both – the deployment model changes where enforcement happens, not what is enforced.

Types of SWG

SWG deployments fall into three models. Cloud-delivered SWG routes traffic to a globally distributed network of cloud points of presence, enforcing policy without backhauling to a data center – the model most new deployments choose. On-premises (appliance-based) SWG runs the proxy on a physical or virtual appliance at the network edge, trading per-site hardware for control over data locality. Hybrid SWG mixes the two, inspecting some sites or traffic classes locally while forwarding the rest to the cloud.

The right mix depends on where users sit: a branch with local breakout might inspect low-risk traffic on-premises and forward high-risk categories to the cloud, while remote users connect straight to the nearest cloud point of presence.

SWG & Versa

Versa Secure Web Gateway is delivered from Versa Cloud Gateways – a globally distributed fabric of multitenant gateways – as one of three core components of the Versa SASE architecture, alongside Secure SD-WAN and Versa Secure Access (VSA). It evaluates each request against user, device, and location context, enforcing URL and IP reputation, DNS reputation and filtering, Layer 7 application rules, SSL/TLS decryption, next-generation IPS, antivirus, and file filtering in a single pass.

Deployment is flexible – Versa SWG runs in the cloud, on-premises, or as a mix of thin-branch/thick-cloud models. Through the Versa product catalog, managed service providers order Versa Secure Web Gateway in Essential (firewall and URL filtering) or Professional (adds antivirus, IPS, and TLS decryption) tiers. Versa also consolidates SWG within Versa Secure Internet Access (VSIA).

Frequently asked questions

What is the difference between a secure web gateway and a firewall?

A firewall filters traffic by IP address, port, and protocol at the network perimeter. An SWG inspects web traffic specifically – decrypting TLS, filtering by URL reputation, and scanning content for malware – which is why SWG capability is now commonly folded into next-generation firewalls and SASE platforms.

Is a secure web gateway the same as a proxy server?

Not exactly. A proxy server forwards and can cache requests on a user’s behalf, and an SWG is typically built on proxy technology – but SWG adds the security layer on top: URL filtering, TLS inspection, and malware scanning, none of which a plain proxy provides.

How does SWG fit into SASE and SSE?

SWG is one of the core services within Security Service Edge (SSE), alongside CASB, ZTNA, and DLP. SSE is the security half of SASE, which converges it with SD-WAN connectivity. SWG is usually the first SSE service an organization adopts.

Does a secure web gateway require decrypting HTTPS traffic?

To inspect content, yes – since most web traffic is encrypted, an SWG generally terminates and re-establishes TLS sessions to see inside them, then filters before re-encrypting. Administrators can exempt sensitive categories, such as banking or healthcare sites, from decryption.

What is the difference between SWG and CASB?

SWG protects users from threats reaching them from the open internet – malicious sites, malware, risky URLs. CASB protects data moving to and from sanctioned and unsanctioned SaaS applications, controlling uploads and sharing. The two are complementary SSE services, often deployed together.

More on SWG

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about SWG, these are worth looking at next.