As Gartner defined, Secure Web Gateways utilize URL filtering, advanced threat defense, legacy malware protection and application control technologies to defend users from Internet-borne threats, and to help enterprises enforce Internet policy compliance. SWGs are delivered as on-premises appliances (hardware and virtual) or cloud-based services. Vendors differ greatly in the maturity and features of their cloud-based services, and in their ability to protect enterprises from advanced threats.

Let's assume that I have a Firewall, IPS on my network and Web Application Firewall in front of my Web Applications, Server.

I know that Next Generation Firewall's now provide URL Filtering, Application Control, Antivirus and so on. WAF will secure the back end web server by monitoring every HTTP request and response to and from the server. So, I'm confused on,

What would be the protection that Secure Web Gateway only provides, other appliances don't?

  • 1
    It's more of a Marketing ploy than anything special. It's a NGFW, but I think the companies want to distinguish that it's not just blocking ports. It's the same when you see UTM or Unified Threat Management. Commented Jan 6, 2015 at 22:53

3 Answers 3


What would be the protection that Secure Web Gateway only provides, other appliances don't?

In your scenario, the answer is none.

Per Gartner's definition:

Secure Web Gateway

Secure Web gateway solutions protect Web-surfing PCs from infection and enforce company policies. A secure Web gateway is a solution that filters unwanted software/malware from user-initiated Web/Internet traffic and enforces corporate and regulatory policy compliance. These gateways must, at a minimum, include URL filtering, malicious-code detection and filtering, and application controls for popular Web-based applications, such as instant messaging (IM) and Skype. Native or integrated data leak prevention is also increasingly included.

In other words, an SWG is aimed at protecting the clients on your network while browsing the internet, not protecting your network from clients accessing your published web services.

An appliance like FireEye and/or Websense comes to mind.

  • What a nice answer :D
    – mau5
    Commented Jan 7, 2015 at 1:59

I checked Gartner's definition and it appears to be a neologism for a proxy server that does content filtering. This definitely overlaps with the feature set provided by modern firewalls.

Looking at the website for CheckPoint, a large vendor offering products under both titles, Secure Web Gateways and Next Generation Firewalls, it appears they consider SWG to be a subset of NGF.

Conceptually, it is possible that separating these roles may provide some extra security by the defence in depth principle.

So that answer is, while in theory all the protection of a SWG could be provided by a NGF, in practice for any given NGF there may well be exist a SWG (perhaps one from a different vendor) that provides extra security.


Most of the Next-Gen FW use their own Web reputation/AV. I'm sorry but there is still a huge gap between their Global Intelligence Network and a gartner market leader proxy like Blue Coat. Proxies also act has a second layer of defense and they can also be used in reverse proxy mode to protect servers. The level of granularity for policies in a real Proxy is 100000x times more than on a Next-Gen FW.

Proxies also do caching which improves performance. One other major advantage of Proxies is they terminate TCP. Next-Gen FW don't. In security this is a major difference, since Next-Gen FW can allow a flow without inspecting all of the content.

Each solution completes the other and provides another layer of protection.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .