Resources > Security Terms Glossary > What is a Secure Web Gateway?

What Is a Secure Web Gateway?

What Is an SWG in Cybersecurity?

A secure web gateway (SWG) is a security solution that prevents unsecured internet traffic from entering an organization’s internal network. It’s used by enterprises to protect employees and users from accessing or being infected by malicious websites and web traffic, internet-borne viruses, malware, and other cyberthreats. It also helps to ensure regulatory compliance.

According to Gartner, a secure web gateway must, at a minimum, include URL filtering, malicious code detection and filtering, and application controls for popular cloud applications such as Microsoft 365. More recently, Gartner identified CASB as a critical component of a security architecture based on the secure access service edge (SASE) framework, which we’ll get to later.


What Do SWGs Do?

An SWG is designed to block access to or from malicious websites and links. It enforces granular use policies and stops threats from accessing web applications by acting as a security gateway, and it does so by filtering web and internet traffic at the application level.


Is a Firewall an SWG?

Firewalls and SWGs perform similar tasks, but they’re not one and the same. Firewalls review the contents of incoming packets and compare their findings against a signature of known threats at the network level only. SWGs operate at the application level, and they can block or allow connections or keywords according to an organization’s web use policy.


Is a Web Gateway a Proxy?

Web gateways and proxies have key differences. A proxy server and a gateway both route traffic from a network to the internet, but a proxy server filters which connections are allowed, while a gateway doesn't do any filtering. In this sense, a gateway more closely resembles a door to get to the internet, and a proxy server a wall that bars the inside of the network from being exposed to the internet.


Why Are SWGs Important?

The days of accessing data and applications solely through the corporate data center are over. Today, employees can work from just about any location, and they need to access applications from their laptops, smartphones, or other endpoint devices. The apps they access are in the cloud instead of your data center, which traditional network security controls are unable to secure.

Organizations that rely on such traditional infrastructure to secure internet-bound traffic must backhaul it over expensive MPLS links back to a legacy SWG in the data center. This slows the flow of traffic, resulting in frustrated and altogether less productive employees.

Moreover, these legacy solutions can’t provide adequate cybersecurity in today’s cloud-based landscape. Cybercriminals are launching new security threats by developing malicious code and attack methods at a blistering pace. With such high costs and time commitments required to update legacy hardware to stand up to new threats, many organizations don’t—or can’t—do the updates at all, leaving them vulnerable. 


Zscaler is a strong choice for midsize and larger enterprises looking for a cloud-based SWG service.
Gartner Magic Quadrant for Secure Web Gateways, 2019
Zscaler’s security functionality keeps users safe regardless of what network they are on, which was great for us as more and more users are working out of the office across all government departments.
Nav Pillai, Director of digital transformation, Cenitex

Why Companies Need an SWG

Work-from-anywhere and rapid SaaS adoption are increasing the need for cloud native security solutions. In addition to intrusion prevention, organizations need advanced threat protection, anti-malware, sandboxing, and data protection in the form of a cloud access security broker (CASB), data loss prevention (DLP) and cloud DLP, and browser isolation services. Plus, they need to be able to inspect all traffic, including SSL-encrypted traffic.

To effectively secure cloud resources, security solutions must be architected following Gartner’s secure access service edge (SASE) concept. Many of today’s proposed “cloud security services” are limited by their appliance-based architectures—particularly those that require significant compute resources, such as SSL decryption and inspection. Simply moving on-premises, hardware-based functions such as VPN to the cloud would be like putting thousands of DVD players in a cluster and calling it Netflix.

In short, only a cloud-based solution enables users to have identical protection and policy enforcement no matter where they connect from or where the cloud services they're using are hosted.


web security

    2022 Gartner Magic Quadrant for Security Service Edge

    Get the report
    what is zero trust report icon

    Zscaler Security Service Edge Infographic

    Take a look
    Thanks to Gartner, We're on Cloud 9

    Zscaler Internet Access

    Read the data sheet
    Zscaler Internet Access

    Zscaler Internet Access in Action

    Watch the video
    ZIA Video

    Move to the cloud securely

    Read the ebook
    what is zero trust report icon

    Zscaler Web Security

    Learn more
    Zscaler Web Security

    How SASE Helps

    SASE’s cloud-delivered architecture combines a host of different networking and security services into one platform, including DNS security, SWG, zero trust network access (ZTNA), and data loss/data leak prevention (DLP). Additionally, SASE pairs well with an SD-WAN and works for a variety of use cases:

    • Reducing IT cost and complexity: An effective SASE solution is easy to deploy and manage as an automated cloud service, enabling digital transformation without the technical debt brought on by legacy architecture.
    • Delivering a great user experience: SASE brings security policies close to the user to eliminate unnecessary backhauling, provide optimal bandwidth, and ensure low latency.
    • Lowering risk: With SASE, all connections are inspected and secured in real time, no matter which user they are coming from, which app is being accessed, or which encryption method is being used.


    Zscaler is the magnum opus of my security stack.

    Brad Moldenhauer, Director of Information Security, Steptoe & Johnson LLP

    Zscaler and SWG

    Zscaler has been named a Leader in the Gartner Magic Quadrant for Secure Web Gateways for 10 consecutive years. In 2021, Gartner defined the security service edge (SSE)—which is an element SASE and a new category that includes SWG—and subsequently recognized Zscaler as a Leader in the 2022 Gartner Magic Quadrant for Security Service Edge, with the highest “Ability to Execute.”


    See the Difference for Yourself

    Still using appliances for your secure web gateway? Your company may be safer with cloud-based SWG. Take this security preview test to find out how well your company is protected against ransomware, phishing, and other threats. The test is safe, free, and informative.