Cisco Umbrella is a cloud-delivered security service that provides DNS-layer security to protect users from threats on the internet. The platform operates by routing DNS queries through Cisco's global network infrastructure to block malicious domains, URLs, and IP addresses before connections are established. The service functions as a first line of defense by analyzing and filtering internet activity at the DNS and IP layers. When users attempt to access internet resources, Umbrella evaluates the requests against threat intelligence data to identify and block connections to malicious destinations including phishing sites, malware distribution points, and command-and-control servers. Umbrella provides visibility into internet activity across an organization's network, including on-premises and roaming users. The platform logs DNS requests and internet activity to enable security teams to investigate threats and understand user behavior patterns. The solution deploys without requiring hardware or software installations in many cases, as it operates through DNS configuration changes that redirect queries to Cisco's cloud infrastructure. For more granular control, lightweight agents can be deployed to endpoints to provide protection regardless of network location. Cisco Umbrella integrates threat intelligence from Cisco Talos and other sources to maintain updated protection against emerging threats. The service includes reporting and analytics capabilities to help security teams understand their security posture and respond to incidents.