Cisco Umbrella Licensing: SIG and DNS Security Tiers Explained for Enterprise

What Cisco Umbrella Does and Why Tier Selection Matters

Cisco Umbrella provides cloud-delivered security that enforces policies at the DNS resolution layer — before connections to malicious domains, phishing infrastructure, or command-and-control servers are established. Because enforcement happens at the DNS layer rather than on the endpoint, Umbrella provides coverage for environments and devices that cannot run endpoint security agents: IoT infrastructure, guest Wi-Fi, BYOD devices, and network segments where agent deployment is impractical.

In its higher tiers, Umbrella extends far beyond DNS filtering into a full Secure Internet Gateway (SIG): cloud-delivered firewall, secure web gateway, cloud access security broker (CASB), data loss prevention, and remote browser isolation. These SIG capabilities position Umbrella as a key component in SASE architecture — the convergence of network security and WAN connectivity in a cloud-delivered model.

Tier selection matters because the cost difference between DNS Security Essentials and SIG Advantage can be three to four times per user per month. Deploying SIG Advantage for users who only need DNS-layer protection is a common and expensive mistake. Equally, deploying DNS Security Essentials for branch offices that have eliminated on-premises firewalls creates security gaps that SIG capabilities would close.

For the full context on how Umbrella fits within Cisco's security portfolio — including how it interacts with Duo, XDR, and the Security EA — see our Cisco Security Licensing Guide 2026.

DNS Security Essentials: The Entry Tier

What It Includes

DNS Security Essentials is Cisco Umbrella's foundational tier, providing DNS-layer blocking of known malicious domains using Cisco Talos threat intelligence feeds. The core capability is straightforward: when a device attempts to resolve a domain that Talos has classified as malicious (malware distribution, phishing, command-and-control), Umbrella returns a block page rather than the DNS record, preventing the connection before it is established.

Beyond basic threat blocking, DNS Security Essentials includes content category filtering (allowing organisations to enforce acceptable use policies at the DNS level), reporting and analytics on DNS request patterns across the deployed base, and Cisco Investigate access for investigating suspicious domains and IP addresses. The tier covers the fundamental DNS security use case comprehensively.

Who It Is Right For

DNS Security Essentials is appropriate for organisations with a mature endpoint security stack (Cisco Secure Endpoint or equivalent) that need DNS-layer protection as an additional control layer, not a primary security control. It is also the right tier for covering device populations that cannot run endpoint agents — IoT, unmanaged BYOD, guest networks — where DNS filtering is one of the few available security controls.

It is not appropriate as the primary internet access security control for users who access cloud applications and external services without an additional secure web gateway or firewall, because DNS-layer filtering does not inspect traffic content — it only blocks at the resolution stage.

Pricing

DNS Security Essentials is one of the few Umbrella tiers where approximate published pricing is available through resellers. List price runs approximately $2.25 to $3.70 per user per month depending on user count, with volume breaks at 1,000, 5,000, and 10,000 users. Enterprise negotiated rates typically achieve 20 to 30 percent below the initial quote, landing at approximately $1.60 to $2.60 per user per month at 5,000+ users.

DNS Security Advantage: Adding Inspection and Intelligence

What It Adds Over Essentials

DNS Security Advantage adds the Umbrella intelligent proxy — the key capability that distinguishes Advantage from Essentials. The intelligent proxy intercepts and inspects HTTP and HTTPS traffic to domains that are classified as risky but not definitively malicious, allowing file scanning and content inspection at a level that pure DNS blocking cannot achieve. Without the intelligent proxy, domains in the "risky but not blocked" category pass through DNS filtering; with it, the content from those domains is inspected before it reaches the user.

Advantage also adds layer 3/4 cloud-delivered firewall capability, which enforces IP-based policies for non-web traffic — covering traffic that does not use DNS at all and therefore falls outside pure DNS-layer controls. This makes Advantage a more complete network security control for branch and remote worker deployments.

Who It Is Right For

DNS Security Advantage is appropriate for organisations that have phased out or are phasing out on-premises proxies and want cloud-delivered equivalent capability. The intelligent proxy capability is the primary driver: if your security architecture requires content inspection for web traffic, not just DNS-level blocking, Advantage is the minimum appropriate tier.

Pricing for DNS Security Advantage is quote-based, typically running 30 to 50 percent above DNS Security Essentials at equivalent user volumes. Enterprise negotiated rates at 5,000+ users typically land in the $2.80 to $4.20 per user per month range.

SIG Essentials: The SASE Entry Point

What It Includes

SIG Essentials is the first full Secure Internet Gateway tier, delivering a complete set of cloud-delivered security functions that can replace traditional on-premises firewall and proxy infrastructure for organisations adopting SASE architecture. The SIG Essentials capability set includes all DNS Security Advantage features plus a layer 7 (application-layer) cloud firewall that provides full application control and traffic inspection, a secure web gateway with full SSL inspection and content policy enforcement, CASB functionality for cloud application visibility and control over both managed and unmanaged applications, and remote browser isolation for protecting users accessing high-risk web content.

The addition of full SSL inspection at the SIG tier is significant: encrypted traffic now constitutes the majority of enterprise internet traffic, and DNS-layer or layer 3/4 controls that do not inspect SSL content have materially lower visibility into what users are actually accessing and what malicious content may be embedded in encrypted sessions.

Who It Is Right For

SIG Essentials is appropriate for organisations that are eliminating or have eliminated on-premises internet gateway infrastructure (web proxies, firewalls for internet breakout) in favour of cloud-delivered security, and for those deploying a Zero Trust Network Architecture where internet access policy enforcement moves to the cloud. Remote and hybrid workforces that access the internet directly from home or branch without backhauling through a central datacenter firewall require SIG-tier capability to maintain consistent security policy across all locations.

Pricing for SIG Essentials is quote-based with no published list price. Enterprise negotiated rates at 5,000+ users typically fall in the $4.15 to $6.50 per user per month range.

SIG Advantage: The Full SASE Platform

What It Adds Over SIG Essentials

SIG Advantage is Cisco's most comprehensive Umbrella offering, adding advanced data loss prevention (DLP) across web and cloud application traffic, cloud malware detection and automated remediation for files accessed through the SIG, user and entity behaviour analytics (UEBA) for detecting anomalous access patterns that may indicate compromised accounts or insider threats, and expanded CASB controls for inline traffic inspection of managed cloud applications with full policy enforcement capabilities.

The DLP capability in SIG Advantage is particularly significant for regulated industries: it provides content inspection for data leaving the organisation through web and cloud application channels, enforcing policies against data classification labels (which it can recognise when integrated with Microsoft Purview or equivalent classification tools) and specific sensitive content patterns defined by the security team.

Who It Is Right For

SIG Advantage is appropriate for enterprises in regulated industries (financial services, healthcare, government) where data loss prevention and UEBA capabilities are regulatory requirements, for organisations that have mature CASB deployments requiring inline traffic inspection beyond the visibility-only capabilities of lower tiers, and for security programmes that need cloud malware detection and response beyond what DNS-layer and firewall controls provide.

The key question before selecting SIG Advantage is whether you will actually configure and operate its advanced capabilities — DLP policy creation and management, UEBA alerting and response, advanced CASB policy enforcement. These are not capabilities that deliver value passively; they require ongoing security operations investment. If the security team lacks the capacity to operationalise SIG Advantage features, the incremental cost over SIG Essentials delivers no security value. Enterprise negotiated rates for SIG Advantage at 5,000+ users typically range from $6.50 to $9.00 per user per month.

Umbrella in the Security EA Context

Cisco Umbrella is one of the four products bundled in the Cisco Security Enterprise Agreement alongside Duo, Cisco Secure Endpoint, and Cisco Secure Email. The Security EA includes a matching tier of each product — an Advantage-tier Security EA includes DNS Security Advantage Umbrella, Duo Advantage, Secure Endpoint Advantage, and Secure Email Advantage.

The Security EA is cost-effective when the enterprise needs all four bundled products at the same tier level. It becomes less cost-effective when Umbrella requirements are at a different tier than the other products — for example, when Duo Premier is required for zero trust network access but only DNS Security Essentials is needed for Umbrella. In that scenario, the Security EA Premier tier includes SIG Advantage Umbrella capabilities that will not be deployed, paying for them as part of the bundle.

Modelling the Security EA total cost against standalone Umbrella plus standalone Duo purchases is essential before committing to the bundle. Our Cisco ELA negotiation guide covers how to structure this analysis and use it as leverage in your Security EA commercial conversation. For additional context, see how the Duo MFA licensing structure interacts with the Security EA in our Cisco Duo MFA licensing tiers and cost guide.

Competitive Context: ZScaler and Netskope

Cisco Umbrella's two primary competitive alternatives for SIG-tier deployments are Zscaler Internet Access (ZIA) and Netskope Secure Web Gateway. Both are credible platforms with comparable technical capability at the SIG tier, and both are used by enterprise security teams as leverage to move Cisco's SIG pricing.

Zscaler's performance-per-dollar advantage at larger deployments (10,000+ users) is often cited in competitive evaluations, and Cisco account teams consistently respond to credible Zscaler evaluations with additional discount — typically 8 to 15 percent beyond the initial quote. Netskope applies similar leverage at mid-market volumes. The presence of a completed Zscaler or Netskope evaluation (not just a statement of competitive evaluation intent) is the condition that triggers Cisco's deepest response.

Six Umbrella Buying Recommendations

1. Map deployment use cases to tier requirements before any vendor engagement. Document which user populations need DNS-only filtering, which need content inspection, and which need full SIG capabilities. This prevents overbidding on tier for users who do not need advanced features.

2. Model the Security EA vs standalone purchase separately. Do not let Cisco's account team frame the Security EA as inherently cheaper. Model both options at your actual tier requirements across all four included products.

3. Conduct a competitive evaluation before pricing discussions. A completed Zscaler or Netskope evaluation is worth more in Umbrella negotiations than any other single factor. Cisco will respond to credible competition.

4. Negotiate multi-year pricing with mid-term review rights. Umbrella user counts can change significantly over a three-year term. Ensure your agreement includes provisions for reducing the licensed user count if headcount decreases. Our Cisco ELA true-up guide covers mid-term adjustment provisions and how True Forward billing applies to multi-year Umbrella agreements.

5. Time your engagement to Cisco's fiscal year. Cisco's fiscal year ends 31 July. Q3 and Q4 (May through July) deliver the best discounts as account teams push toward annual targets. See the full timing strategy in our Cisco security licensing guide. Understanding the Smart Licensing compliance requirements that apply to Umbrella's cloud-managed architecture is also covered in our Cisco Smart Licensing guide.

6. Confirm your capacity to operationalise advanced features before buying SIG Advantage. Advanced DLP, UEBA, and inline CASB capabilities require security operations investment to deliver value. If your SOC team cannot commit to configuring and managing these capabilities, SIG Essentials is the appropriate tier.

Summary

Cisco Umbrella is a strong product across all four tiers — the question is matching the tier to your actual deployment plan, not to your security wishlist. DNS Security Essentials covers the DNS filtering use case comprehensively and cost-effectively. SIG tiers deliver genuine value for organisations eliminating on-premises internet gateway infrastructure or building SASE architectures, but only when the advanced features will be actively configured and operated.

For the complete commercial strategy — including how Umbrella fits in your Cisco ELA, how to use competitive alternatives as leverage, and what discount benchmarks to target — our Cisco security licensing advisory team provides independent guidance from initial evaluation through contract signature. Questions or ready to start? Contact us directly.