In short: Cisco Secure Access DNS Defense is the DNS-layer security tier of Cisco Secure Access, formerly Cisco Umbrella DNS. Sold in Essentials and Advantage, it blocks malicious domains before connections are made and, per Cisco, adds SaaS API DLP, cloud malware scanning and AI-based DNS tunnelling and DGA detection, with an upgrade path to Secure Internet Access.
What is DNS Defense?
Almost every connection starts with a DNS lookup. DNS-layer security answers those lookups through Cisco's recursive resolvers and refuses to resolve domains linked to malware, phishing, command-and-control or unwanted content categories. Because the decision is made before any connection exists, it works over any port and protocol.
Cisco Secure Access DNS Defense is that capability packaged as a tier of Cisco Secure Access. Cisco's data sheet describes it as formerly Cisco Umbrella DNS, and Cisco's Umbrella end-of-life notice names DNS Defense Essentials and Advantage as the migration products for the Umbrella DNS Security Essentials and Advantage packages. Domain reputation comes from Cisco Talos, and it is managed in the same console as the rest of Secure Access, so it can grow into a full SSE without a second platform.
What it adds over the Umbrella DNS packages
Cisco says DNS Defense goes beyond the previous Umbrella DNS packages, without raising cost, by adding:
- An enhanced policy framework, shared with the wider Secure Access platform
- SaaS API data loss prevention, scanning data at rest in sanctioned cloud apps for sensitive content
- Cloud malware detection, finding and removing malware stored in sanctioned cloud file platforms (Cisco's package guide limits DNS Defense to a small number of these apps; Secure Internet Access covers more)
- AI-based detection of DNS tunnelling and domain generation algorithms (DGA), which malware uses to hide data theft and command traffic
The core DNS features remain: category and security filtering, custom allow and block lists, user-level reporting, and log export to your security operations tools, such as Splunk Enterprise Security. Cisco's data sheet also lists a partial secure web gateway capability, with category or URL filtering and selective proxying and inspection of web traffic, rather than simply allowing or blocking at the DNS layer.
Packages: Essentials, Advantage and education
| Umbrella package (end of sale 31 January 2027) | Secure Access replacement |
|---|---|
| Umbrella DNS Security Essentials | Secure Access DNS Defense Essentials |
| Umbrella DNS Security Advantage | Secure Access DNS Defense Advantage |
| Umbrella SIG Essentials and Advantage | Secure Internet Access Essentials and Advantage (full SSE, not DNS Defense) |
Advantage is the counterpart of DNS Security Advantage, and Cisco's package guide also lists DNS Defense education (EDU) packages; Cisco names Secure Access DNS EDU Essentials as the migration product for Umbrella's education DNS packages. Because the exact split of features between tiers changes over time, we check Cisco's current package guide with you before you order.
Points that help with planning:
- Cisco's data sheet says DNS Defense goes further than the previous Umbrella DNS packages without higher cost
- Secure Internet Access includes all DNS Defense capabilities, so moving up later does not mean giving features up
- Cisco includes a no-cost trial of Secure Private Access for a limited number of seats, so you can test ZTNA alongside DNS Defense
For a cross-package view, see Secure Access licensing. For pricing, ask us for a quote.
How DNS Defense is deployed
- Networks and offices: point your network's DNS forwarders, or your firewall and router DHCP settings, at Cisco's resolvers so every device on site is covered
- Roaming users: Cisco Secure Client on Windows, macOS, iOS and Android, which Cisco includes at no added cost
- Chromebooks: the Cisco Security for Chromebook client, which matters for UK schools and colleges
- Identity: link users and groups from your directory so policy and reports work per person, not just per network
Existing Umbrella deployments use the same DNS-redirection approach, so moving from Umbrella DNS to DNS Defense is mostly about licensing, policy and client configuration rather than a new network design. We confirm the details for your estate during planning.
The upgrade path to full Secure Access
DNS Defense is designed as a first step. Cisco's data sheet sets out where to go next:
- Secure Internet Access: adds the full secure web gateway, CASB, full DLP, remote browser isolation, firewall as a service and Experience Insights.
- Secure Private Access: adds ZTNA and VPN as a service. Cisco includes a no-cost trial of Secure Private Access for a limited number of seats with DNS Defense.
- Full SSE and universal ZTNA: both use cases together, with zero trust policy enforced in the cloud or on-premises.
- SASE: Secure Access integrated with Cisco SD-WAN or Meraki SD-WAN; see Cisco SASE.
Because all of these sit on one platform, policy and reporting carry forward as you add capability.
Moving from Umbrella and how we help
Cisco's end-of-sale date for Umbrella DNS and SIG is 31 January 2027, with renewals until 31 January 2028 and support ending on 31 January 2029. Our Cisco Umbrella hub gives the short version, and the Umbrella end of life guide on our specialist Umbrella site covers dates, options and planning in detail.
Forever Systems reviews your current Umbrella policies, identities and deployment, maps them to the right DNS Defense or Secure Internet Access package, and handles the change-over and support. Contact us to plan your move.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What replaces Cisco Umbrella DNS Security?
Cisco Secure Access DNS Defense. Cisco's data sheet describes it as formerly Cisco Umbrella DNS, with DNS Defense Essentials and Advantage replacing the Umbrella DNS Security Essentials and Advantage packages.
Is DNS Defense the same as Umbrella?
It provides the same style of DNS-layer protection, but it runs on the Secure Access platform and, according to Cisco, adds SaaS API DLP, cloud malware scanning and AI-based DNS tunnelling and DGA detection.
Does DNS Defense include a secure web gateway?
Only partially. Cisco lists partial secure web gateway capability for DNS Defense; the full proxy, CASB, firewall as a service and remote browser isolation come with Secure Internet Access.
Can I add ZTNA to DNS Defense?
ZTNA comes with Secure Private Access, which runs on the same Secure Access platform. Cisco includes a no-cost trial of Secure Private Access for a limited number of seats with DNS Defense, and we can quote for adding it permanently or moving to full Secure Access.
Is there a DNS Defense package for schools?
Yes. Cisco's package guide lists DNS Defense education (EDU) packages, and Cisco names Secure Access DNS EDU Essentials as the successor to Umbrella's education DNS package. The Cisco Security for Chromebook client covers ChromeOS devices.