What is an SWG?
Secure Web Gateway, told as a story about the checkpoint on the way out to town.
Castle folk go out to town every day.The market, the library, the theater… that's the internet.
Town has some bad alleys.The box from the "free gifts" alley has a bug inside. Once it's in, the dog has to catch it.
An SWG is the checkpoint on the road to town.It sees where you're going, blocks bad alleys, and opens the boxes you bring back.
Bad alleys are blocked; boxes get opened.Even sealed boxes (encryption) are opened at the checkpoint — but that's agreed with the castle folk beforehand.
Skip the gate, and it sees nothing.Straight from home into town? So these days checkpoints sit all over town (in the cloud), and you pass one wherever you start. Same problem the shed broker has.
An SWG = the checkpoint on the road to town (the internet). It blocks bad alleys, opens the boxes you bring back, and writes down where you went.
Secure Web Gateway — what used to be called a web proxy. Today it's sold in an SSE bundle with the shed broker (CASB) and the castle that always asks (ZTNA): Zscaler, Netskope, Cisco Umbrella.
When grown-ups say it
- Web proxy
- The checkpoint. Goes to town on my behalf — which is why it sees everything.
- URL filtering
- The town map. Every alley has a color: gambling red, library green.
- Reputation
- Alley gossip. "Lots of people got robbed in that alley." → the watchtower friend passes it on
- Malware scanning
- Opening the box. A bug inside means it never enters. Miss it, and it's the dog's turn.
- TLS inspection
- Breaking the seal. Opening sealed (encrypted) boxes at the checkpoint — something the hallway watcher can't do.
- Sandbox
- Opening it in a side room. Suspicious boxes get opened in an empty room first. If a bug jumps out, it ends there.
- Cloud SWG
- Checkpoints all over town. Not one gate, but a checkpoint wherever you start from.
- SSE
- The checkpoint bundle. Checkpoint (SWG) + shed broker (CASB) + castle that always asks (ZTNA).