Cisco Umbrella Professional
Defend against threats on the internet wherever users go.

Visibility into traffic both ON and OFF your network

Your users and apps have left the perimeter. Umbrella provides visibility into internet activity across all devices, over all ports, even when users are off your corporate network. You can even retain the logs forever.

Threat intelligence to see attacks before they launch

Umbrella learns from internet activity to automatically identify attacker infrastructure staged for current and emergent threats. We capture and understand relationships between malware, domains, IPs, and networks across the internet.

Enterprise-wide deployment in minutes

Umbrella is the simplest security you’ll ever deploy. There is no hardware to install or software to manually update, and the browser-based interface provides quick setup and ongoing management.

Here’s how:

API-based integrations to the rest of your security stack

Umbrella’s API enables you to integrate with your existing solutions to amplify protection. Automatically enrich the data in your SIEM, threat intelligence platform, or incident workflow to speed up investigation and response by security analysts.

"I like the ease of use and the threat intelligence. We do a lot of research on our attack vectors, analyzing phishing emails, and anomalous events. Nine times out of 10 Cisco Umbrella is already blocking identified malicious domains."

Senior IT Architect
Large Enterprise Computer Software Company

Built into the foundation of the internet.

The domain name system (DNS) is a foundational component of the internet — mapping names to IP addresses. When you click a link or type a URL, a DNS request initiates the process of connecting any device to the internet. For our cloud security platform, we use DNS as just one way to make connecting to the cloud not only simple and fast, but also secure.

A bit about our global network.

We process billions of DNS requests from millions of users every day. Not only do we have data center locations around the world, but more importantly, we peer with the top internet service providers (ISPs) and content delivery networks (CDNs) to shorten the routes between every network in the world and our data centers — making your internet access even faster.

We scale to support tens of thousands of concurrent enterprises and block millions of concurrent threats. In fact, we enforce 7 million unique malicious destinations at any given time. No appliance could scale to deliver this same efficacy.

The fastest, most reliable platform.

When you connect to a cloud security platform, performance is critical. It cannot break or slow down your internet connection. To ensure reliability, we use Anycast routing— every data center announces the same IP address so that requests are transparently sent to the fastest available with automated failover. With Umbrella, you’ll never experience downtime for maintenance and you don’t need static routes to a primary and backup datacenters.

Peering for speed.

Umbrella won’t add latency compared to your current provider. In fact, many customers see a boost in internet speed. Our peering partnerships with ISPs and CDNs provide shortcuts between every network. And Umbrella stores the responses to 80 million users’ daily requests, and for most safe destinations, responds back immediately.

Protection in 30 seconds with one change.

Do you use DNS or DHCP servers in your network? Just add 208.67.222.222 in one of the settings, and every device on that network is protected. What about laptops connecting off network? If you use Cisco AnyConnect, simply enable the Umbrella roaming security module for protection anywhere — even when the VPN is off. If not, we have an agent that works with any VPN — proven in over a million deployments. And by performing everything in the cloud, there is no hardware to install, and no software to manually update.

Enforcement without latency or delay.

To start, Umbrella determines which customer the internet request belongs to, and which policy to enforce. Next, we determine if the destination — domain request and IP response — is (A) malicious, unwanted, or blacklisted; (B) safe or whitelisted; or (C) risky, meaning it hosts both malicious and safe content.

For type A destinations, we route the connection to a block page. For B, we route the connection as normal. And for C, we route the connection through our cloud-based proxy for deeper inspection. All requests are logged globally and immediately visible for your security teams to take action.

World's first intelligent proxy.

Traditionally, blocking web content at the URL level requires proxying all connections — which adds complexity and negatively impacts performance. With Umbrella, safe connections are allowed and malicious requests are blocked at the DNS-layer. Only requests to risky domains, which contain both malicious and legitimate content, are routed for deeper URL and file inspection. With Umbrella’s intelligent proxy, users don’t experience any slow or broken internet access.

Our platform is open for integration.

One fear that IT has with the cloud is a loss of customization and control. Umbrella is an open platform that integrates with your in-house tools and third party solutions. Using our API, you can send local intelligence to Umbrella and enforce it globally in minutes. Additionally, you can query our threat intelligence using the Cisco Umbrella Investigate API and enrich security event data in your SIEM or other systems.

We don't just connect the dots, we are the dots.

When you analyze over 100 billion internet requests a day, you see what other security solutions miss.

Attacks don't just suddenly happen.

The development lifecycle to create new attacks is similar to that of new applications. An app developer builds something, tests it, and then launches it. Attackers do the same, which requires infrastructure, malware, and a web or email delivery scheme. While they modify and create new malware (e.g. ransomware variants) and draft new phishing emails, attackers often reuse the exact same infrastructure (e.g. web servers and IPs) for multiple attacks — leaving behind cyber fingerprints. We focus on identifying those fingerprints, so we can pinpoint current attacks and even uncover emerging threats being staged.

Statistical models are our secret sauce.

We statistically score the “guilt” of domains and IPs to determine if they’re part of an attacker’s infrastructure. More than a reputation score that looks at the past, we analyze both historic and live data. And we’ve built statistical models to automatically score and classify all of our data, so we can detect anomalies, and uncover known and emergent threats. We use three main approaches: guilt by inference, guilt by association, and patterns of guilt.

Datasets must be diverse, global & live.

Not only do we analyze a massive amount of data, but perhaps more important is the diversity of our data. Umbrella gathers 100 billion internet requests from over 100 million enterprise and consumer users across 160 countries every day at the moment a request is made — which gives us a statistically significant data set. Our real-time DNS data is also enriched with diverse public and private data feeds.

Making discoveries through DNS resolution.

We analyze the request patterns to detect many types of threats and anomalies. For example, we can determine if a system is compromised based on the types of requests it’s making. If a device is making requests to a number of known-bad domains, it’s more likely to be compromised. The user requests patterns across our user base give us great insight into potential threats.

In the second part of the process, if our global cache doesn’t have a non-expired response to the request, then we recursively contact all of the nameservers that are authoritative for the domain requested. This process gathers authoritative logs for virtually every domain daily, which we use to find newly staged infrastructures and other types of anomalies.

A new approach to security research.

There is no army of security researchers big enough to manually identify every threat. We look at things differently. The Cisco Umbrella security researchers take mathematical concepts and find new ways to apply them to security data — helping us uncover threats before attacks even launch. Our security researchers leverage advanced data mining techniques, 3D data visualization, and security domain expertise to develop the statistical models behind our intelligence.

Efficacy is king.

Threat intelligence is one thing, but you also need to act on all of that data. Cisco Umbrella has the horsepower to actively process and enforce more than 7 million unique malicious domains and IPs concurrently at the DNS layer — appliances and hybrid-cloud solutions can’t come close to enforcing that many threats at once. And we’re constantly adding to our block list — 60,000+ new destinations are added every day. Plus, Umbrella can be deployed enterprise-wide in minutes — making it one of the easiest ways to start protecting users.