What is Secure Web Gateway (SWG)?
Secure Web Gateway (SWG) is an inline security checkpoint that inspects outbound and inbound web traffic and enforces policy before connections complete. It blocks malware, filters URLs by category, and controls which web destinations users and devices can reach.
What it does
An SWG sits between users and the internet, inspecting every HTTP and HTTPS request in real time. Because most traffic is encrypted, an SWG performs TLS/SSL inspection: it terminates the encrypted session, examines the content, and re-encrypts it before forwarding. Core functions include:
- URL filtering: classifying destinations into categories (gambling, malware, social media) and allowing or blocking based on policy
- Malware detection: scanning downloaded files and page content for known and unknown threats, sometimes using sandboxing for suspicious files
- Application control: identifying cloud apps and enforcing rules at the application or function level, not just the domain
- Data loss prevention (DLP): inspecting uploads for sensitive content such as credit card numbers or source code
- Identity-based policy: tying rules to user identity rather than IP address, which matters when users move between networks
Traditional SWGs were physical or virtual appliances deployed at the network perimeter. Cloud-delivered SWGs route traffic through a vendor-operated proxy, which removes the need for on-premises hardware and extends coverage to remote users without a VPN.
Why it matters
Web browsers are the primary attack surface for most organizations. Drive-by downloads, phishing pages, and malicious redirects all arrive over HTTP or HTTPS. Without inline inspection, endpoint tools are the last line of defense. An SWG adds a network-layer control that stops threats before they reach the endpoint and prevents data from leaving through the browser.
How tools address it
Products in the Security Service Edge (SSE) category often include SWG as one component alongside Zero Trust Network Access (ZTNA) and Cloud Access Security Broker (CASB) functions. Some tools run the proxy on the device itself rather than routing traffic to a cloud node, which reduces latency and keeps inspection local. Others use DNS-layer filtering as a lightweight first pass before full proxy inspection. AI-assisted URL categorization helps classify new or uncategorized domains faster than static blocklists.