A Secure Web Gateway (SWG) is a security service that sits between users and the Internet, inspecting web traffic and enforcing policy to protect users from malicious sites, malware, and data loss. Every web request is evaluated against policy before it is allowed, and responses can be inspected before they reach the user. SWGs have traditionally been deployed as on-premises web proxies, but today most are delivered from the cloud as part of a Security Service Edge (SSE) solution.

Why an SWG Matters

Internet access is essential for productivity, but it also exposes users and organizations to a range of threats, including the following.

• Malware. Malicious and compromised websites can deliver malware through downloads or browser exploits, even on sites that are otherwise reputable.
• Phishing. Fraudulent sites impersonate legitimate services to steal user credentials.
• Data loss. Users can upload sensitive data to unsanctioned cloud services, personal accounts, or generative AI applications.
• Shadow IT. Unapproved applications and services introduce risk that security teams can’t see or manage.

How an SWG Works

Regardless of how it is delivered, an SWG performs three basic functions.

Traffic Acquisition

Web traffic must first be directed to the SWG. Traditionally, this is done by configuring browsers to use a proxy, either explicitly or with a Proxy Auto-Configuration (PAC) file. Cloud-delivered SWGs typically use a lightweight client agent on the endpoint to acquire traffic, and IPsec tunnels or similar connectivity from branch offices for devices where installing an agent isn’t practical.

Policy Evaluation

The SWG evaluates each request against policy, considering the destination’s web category, reputation, and threat intelligence, along with who the user is and, in modern solutions, the health of their device. The request is then allowed, blocked, or allowed with additional inspection.

TLS Inspection

Most web traffic today is encrypted with Transport Layer Security (TLS). Without TLS inspection, an SWG can see only the destination hostname, typically from the Server Name Indication (SNI) in the TLS handshake. With TLS inspection enabled, the SWG terminates the client’s TLS connection, establishes a separate TLS connection to the destination, and decrypts, inspects, and re-encrypts the traffic. This enables full URL filtering, malware scanning of downloads, data loss prevention, and other content-level controls.

For this to work, clients must trust the certificates the SWG presents. The SWG issues them from an inspection certificate authority (CA), which must be trusted by every managed endpoint. That CA can be subordinate to the organization’s internal PKI or provided by the SWG vendor.

Key Features

The following are key features of most SWG solutions.

• Web content filtering. Allows or blocks access based on web category, domain, or full URL.
• Threat protection. Blocks access to known malicious sites using threat intelligence and scans downloads for malware.
• Data loss prevention (DLP). Detects and blocks sensitive information, such as credit card or Social Security numbers, from being uploaded or submitted to websites.
• Application control. Discovers and controls the use of cloud applications, including file sharing services and generative AI tools.
• Logging and visibility. Records web activity by user and device, providing insight for security operations and compliance reporting.

SWG vs. Firewall

SWGs and firewalls overlap in some capabilities, but they are designed for different jobs. The table below highlights the key differences.

Aspect	Network Firewall	Secure Web Gateway
Primary Focus	All network traffic	Web and SaaS traffic
Policy Basis	Primarily IP addresses, ports, and protocols	User identity, web category, URL, and content
Content Inspection	Varies; next-generation firewalls add some application awareness	Deep inspection of web content, downloads, and uploads
Location	Network perimeter or data center	Cloud edge or on-premises proxy, following the user
Remote Users	Protected only when traffic is routed through the corporate network	Protected wherever they work

In practice, most organizations use both: firewalls to protect networks and data centers, and an SWG to protect users accessing the Internet.

Benefits of an SWG

There are many benefits associated with deploying an SWG, including the following.

• Reduced risk from web threats. Malicious sites and downloads are blocked before they reach the user.
• Data protection. Sensitive information is protected from accidental or intentional leakage.
• Consistent policy everywhere. Cloud-delivered SWGs apply the same policy whether users are in the office, at home, or traveling.
• Compliance. Acceptable use policies are enforced, and web activity is logged for auditing and reporting.
• Better performance for remote users. Cloud SWGs inspect traffic at nearby edge locations rather than backhauling it through the corporate network.

Considerations

Organizations deploying an SWG should plan for the following.

• Certificate deployment. The inspection CA certificate must be distributed to the trusted root store of every managed endpoint, and its lifecycle, including renewal, must be managed. An expired inspection certificate breaks inspection for all users.
• Inspection bypasses. Some destinations can’t be inspected, such as applications that use certificate pinning or mutual TLS authentication. Others, such as banking and healthcare sites, are commonly bypassed for privacy reasons. Bypass rules should be documented and reviewed regularly.
• Privacy and legal requirements. Decrypting user traffic may be subject to privacy regulations, labor laws, or works council agreements, depending on the jurisdiction.
• Protocol support. Not all SWGs can inspect every protocol. For example, some require QUIC to be blocked so browsers fall back to TLS over TCP.
• Traffic forwarding. Choose how traffic reaches the SWG (proxy configuration, client agent, or branch tunnels) and ensure unmanaged devices and servers are accounted for.

Cloud-Native SWG with Microsoft Entra Internet Access

Microsoft Entra Internet Access is Microsoft’s cloud-delivered SWG and part of Microsoft Entra Global Secure Access. Because it is built on Microsoft Entra ID, web filtering policies are applied through Conditional Access based on user identity, device compliance, location, and risk, extending Zero Trust principles to Internet-bound traffic. It provides web content filtering, threat intelligence filtering, TLS inspection, and protections for generative AI applications, all without on-premises proxy infrastructure. It also pairs naturally with Microsoft Entra Private Access, Microsoft’s ZTNA solution, using the same client.

Summary

A Secure Web Gateway protects users and data by inspecting web traffic and enforcing policy between users and the Internet. With most web traffic now encrypted, TLS inspection is what allows an SWG to see and stop threats hidden inside encrypted sessions, and careful planning of certificates and bypass rules is essential to a successful deployment. Cloud-delivered SWGs, such as Microsoft Entra Internet Access, extend that protection to users wherever they work, without the need for on-premises proxy infrastructure.

Additional Information

Learn about Microsoft Entra Internet Access

Configure Transport Layer Security Inspection Policies

What is Security Service Edge (SSE)?

What is Secure Access Service Edge (SASE)?

What’s the Difference Between SSE and SASE?

What is Zero Trust Network Access (ZTNA)?

Ready to Secure Your Internet Access?

Schedule a free one-hour consultation to review your current web security posture. I’ll help you evaluate whether a cloud-delivered SWG such as Microsoft Entra Internet Access is a good fit for your environment, covering TLS inspection planning, certificate deployment, policy design, and migration from existing web proxies. There’s no obligation. Fill out the form below, and I’ll personally follow up to schedule your consultation.