In short: Cisco Secure Web Appliance, formerly the Web Security Appliance (WSA), is an on-premises secure web proxy. It filters web traffic using Talos URL and reputation intelligence, controls applications, scans for malware with sandboxing, and decrypts HTTPS selectively. It runs as hardware, a virtual appliance or in AWS and Azure, managed by Secure Email and Web Manager.
What is Cisco Secure Web Appliance?
A secure web proxy sits between users and the internet, decides which requests are allowed, and inspects what comes back. Cisco's appliance for this job was long known as the Web Security Appliance (WSA) and is now Cisco Secure Web Appliance (SWA). It remains a current Cisco product, offered as a hardware appliance, a virtual appliance or in the public cloud.
It is the on-premises counterpart to the cloud secure web gateway in Cisco Secure Access. Organisations choose an appliance when they need traffic to stay on their own network, have strict data residency or air-gap requirements, run large on-site user populations on high-capacity links, or depend on proxy integrations with other on-premises systems.
Key capabilities
- URL filtering with dynamic content analysis, so new or uncategorised pages are classified on the fly
- Web reputation and malware filtering driven by Cisco Talos intelligence, updated continuously
- Application visibility and control for web apps and their individual functions (for example allowing a social site but blocking posting)
- Malware defence with file reputation, file sandboxing through Secure Malware Analytics and retrospective alerts if a file is later found to be malicious, plus an optional additional anti-malware engine
- Layer 4 traffic monitoring to spot infected devices trying to reach command-and-control servers
- Selective HTTPS inspection by URL category, so sensitive categories such as banking and health can be left undecrypted
- Data loss prevention through ICAP and secure ICAP integration with dedicated third-party DLP products
- Remote browser isolation integration for risky sites
- Identity-aware policy, including integration with Cisco ISE for user and group context
Deployment options
| Form factor | Notes |
|---|---|
| Hardware appliance | Cisco offers appliances sized for small business and branch, midsize office and large enterprise use; the earlier platforms are past their last order date, so we confirm current models and size from your user count and throughput |
| Virtual appliance | Runs on VMware ESXi, KVM and Microsoft Hyper-V |
| Public cloud | Available in Amazon Web Services and Microsoft Azure, including through their marketplaces |
The appliance supports explicit proxy (PAC files, WPAD or browser settings) and transparent proxy (WCCP, policy-based routing or load balancers), and handles HTTP, HTTPS, SOCKS and FTP. Transparent mode avoids browser changes, with redirection handled by the network, for example by a Cisco Secure Firewall or core switch.
Management and licensing
Multiple appliances are managed and reported on centrally through Cisco Secure Email and Web Manager (formerly the Security Management Appliance), which also manages the Secure Email Gateway. It is available as hardware or virtual.
Cisco's data sheet describes term-based software licences (one, three or five years) in Essentials, Advantage and Premier bundles, priced by a range of users rather than by device, with add-ons such as an additional anti-malware engine. Each software bundle includes a virtual appliance licence, while virtual licences for the central manager are bought separately. For how this compares with other Cisco licensing, see Cisco security licensing. Bundles change over time, so we confirm the current options and ask you for a quote rather than publishing prices.
Hardware lifecycle
In December 2025 Cisco announced end of sale for the Secure Web Appliance hardware platforms then on sale. The last order date was 17 June 2026 and the last date of support is 30 June 2031, so existing appliances stay supported for several years but can no longer be bought new. Cisco's notice lists successor appliances for each size; our Cisco security end-of-life guide lists the dates.
If your appliances are from that generation or older, you have three options:
- Refresh onto Cisco's successor hardware, once we have confirmed availability for your size
- Move to the virtual appliance on your own hypervisors or in AWS or Azure
- Move to the cloud with Secure Access Secure Internet Access, retiring the on-premises proxy
Secure Web Appliance or Secure Access?
| Consideration | Secure Web Appliance | Secure Access (cloud SWG) |
|---|---|---|
| Where traffic is inspected | On your network or your cloud tenancy | Cisco's cloud points of presence |
| Remote and hybrid users | Need to backhaul or use a VPN | Protected directly, wherever they are |
| Private app access (ZTNA) | Not included | Included with Secure Private Access |
| CASB, RBI, cloud DLP | Limited or via integrations | Built in, depending on tier |
| Capacity planning | You size and refresh appliances | Cisco scales the service |
| Strong fit | Air-gapped, highly regulated or high-volume on-site networks | Distributed and hybrid workforces |
The two can also run together: the appliance protects on-site users and legacy integrations while Secure Access covers remote staff, with policy aligned between them. Our secure web gateway explainer compares the approaches in vendor-neutral terms.
How we help
Forever Systems sizes, supplies, deploys and supports Secure Web Appliance estates, migrates policy between hardware generations or to virtual appliances, and plans moves to Secure Access where that makes more sense. Contact us for an appliance review or a refresh plan.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Cisco WSA the same as Secure Web Appliance?
Yes. Cisco renamed the Web Security Appliance (WSA) to Cisco Secure Web Appliance. The product continues under the new name, with the same proxy role and management tools.
Is Cisco Secure Web Appliance end of life?
No, the product continues. Cisco has ended sale of its earlier hardware platforms, with a last order date of 17 June 2026 and support until 30 June 2031, and lists successor appliances alongside the virtual and cloud versions.
Can Cisco Secure Web Appliance run in the cloud?
Yes. Cisco offers it in Amazon Web Services and Microsoft Azure, including through their marketplaces, as well as on VMware ESXi, KVM and Hyper-V.
What manages Cisco Secure Web Appliance?
Cisco Secure Email and Web Manager, formerly the Security Management Appliance, provides central policy, tracking and reporting across appliances, and also manages Secure Email Gateway.
Should I replace my web proxy with Cisco Secure Access?
If most users work remotely or in many small sites, a cloud secure web gateway like Secure Access is usually a better fit. If traffic must stay on your network, a current appliance is still a sound choice, and the two can run together.