In short
DNS Defense vs Umbrella: Cisco Secure Access DNS Defense is the successor to Umbrella DNS Security Essentials and Advantage. Cisco says it provides all Umbrella DNS features on Cisco's recursive resolvers and adds AI-based DNS tunnelling and DGA detection and an enhanced policy framework, with SaaS API DLP and cloud malware scanning in Advantage. Umbrella DNS ordering ends on 31 January 2027.
Want an impartial recommendation?
Tell us about your users, systems and priorities and we will tell you which option fits, and why.
Is DNS Defense just Umbrella with a new name?
Not quite. Cisco's Umbrella website says Umbrella has evolved to Cisco Secure Access and that it is more than a new name: an all-new platform. For DNS security specifically, Cisco describes Secure Access DNS Defense as providing all Umbrella DNS features and much more, backed by Cisco's global network of recursive DNS resolvers.
So the DNS protection you know carries across, but it runs inside Cisco Secure Access, Cisco's security service edge (SSE) platform, with its own console, policy model and upgrade path. Cisco's end-of-life notice for Umbrella SIG and DNS names the migration products:
| Umbrella DNS package | Cisco's migration product |
|---|---|
| DNS Security Essentials | Secure Access DNS Essentials (DNS Defense) |
| DNS Security Advantage | Secure Access DNS Advantage (DNS Defense) |
| DNS Security for Education | Secure Access DNS EDU Essentials |
This page looks only at the DNS packages. For the broader move from Umbrella SIG to Secure Internet Access, see the Cisco Umbrella end of life guide, and for the product itself see Cisco Secure Access DNS Defense on our Cisco Secure site.
Still not sure which way to go? Ask us
Tell us what matters most to you and we will recommend one, with the trade-offs explained.
What stays the same
- The resolvers. Cisco's data sheet describes DNS Defense as formerly Cisco Umbrella DNS, backed by Cisco's global network of recursive DNS resolvers.
- DNS redirection. Offices still forward DNS to Cisco, so moving is mostly about licensing, policy and client configuration rather than network redesign.
- Threat intelligence. Domain reputation still comes from Cisco Talos.
- Core DNS filtering. Security and content categories, custom allow and block lists, block pages, user-level reporting and log export carry across.
- Roaming protection. Laptops use Cisco Secure Client, which Cisco includes with DNS Defense at no added cost.
- Chromebooks. Cisco Security for Chromebook covers ChromeOS devices, which matters for schools.
What DNS Defense adds
According to Cisco's DNS Defense data sheet, launch blog and SSE package comparison guide, these are the main differences from the Umbrella DNS packages:
| Capability | Umbrella DNS Security | Secure Access DNS Defense | Why it matters for DNS security |
|---|---|---|---|
| DNS-layer threat and content blocking | Yes | Yes | The core protection is unchanged |
| DNS tunnelling protection | Yes | Yes, with AI-based enhancements | Spots data or command traffic hidden in DNS queries; see DNS tunnelling |
| AI-based DGA domain detection | Not listed | Yes | Catches malware that generates new domains to reach its controller |
| Enhanced policy framework | - | Yes | Rules-based policy shared with the wider Secure Access platform |
| SaaS API data loss prevention | - | Advantage | Scans data at rest in sanctioned cloud apps such as Microsoft 365, Google Workspace and Box |
| Cloud malware detection | - | Advantage | Finds and removes malware stored in cloud file platforms; Cisco lists Box, Dropbox, Webex, Microsoft 365, Google Drive, AWS S3 and Azure |
| Selective proxy on risky domains | Advantage only (intelligent proxy) | Advantage only (partial secure web gateway) | Inspects full URLs on uncertain domains |
| Upgrade path | Umbrella SIG | Secure Internet Access and Secure Private Access | Grow into a full SSE without changing platform |
The DNS-specific changes are the ones that matter most for your protection. DNS tunnelling and DNS exfiltration hide data inside lookups that look normal one by one, and DGA domains are created faster than any block list can be updated, so detecting them by behaviour rather than by a known-bad list helps close a gap that classic DNS filtering leaves open. Cisco says DNS Defense delivers its additions without higher cost than the Umbrella DNS packages. The split between Essentials and Advantage above is from Cisco's current guides; because it can change, we check it with you before you order.
Weighing up the options?
We can compare them against your own requirements and give you a straight answer.
What changes for you
Moving from Umbrella DNS to DNS Defense is a change of platform as well as package. The points that matter most for DNS security:
- A new console and sign-in. Secure Access is managed in Cisco's cloud console (Cisco Cloud Control in Cisco's July 2026 package guide, Security Cloud Control in its upgrade guide), with Security Cloud Sign On for administrators.
- Policy becomes rules. Cisco's Upgrade Manager copies Umbrella policies into Secure Access as rules in an access policy. Secure Access applies the first matching rule, so rule order needs checking after the copy.
- Some items are not copied. Cisco's upgrade guide lists items that do not carry across, such as bypass codes, and changes made in Umbrella after the copy may not appear in Secure Access.
- Clients and appliances need updating. Virtual appliances, AD Connectors, Chromebooks and mobile devices all have prerequisites before traffic is redirected.
- A paid subscription first. Cisco's automated upgrade needs an active, paid Secure Access subscription; trial licences are not supported for the upgrade.
The full prerequisites, eligibility rules and cut-over steps are on our Umbrella to Secure Access migration guide. We do not repeat them here.
Reporting, logs and investigation
DNS security is only as useful as what you do with the data. Here too, the move is mostly like for like:
- Reports and activity search. Both platforms show which identities looked up which domains and what was blocked, so you can spot infected devices and tune policy.
- Log export. Both export logs to a Cisco-managed or your own Amazon S3 bucket, which security teams use to feed a SIEM, and Cisco lists integrations with tools such as Splunk and Cisco XDR.
- Investigation. Umbrella Investigate comes with DNS Security Advantage. Cisco lists Secure Access Investigate console users and API tiers as the migration product for Investigate, although the Investigate Integration API and Console has no migration product.
If your security team relies on Investigate or on a SIEM feed of Umbrella DNS events, include those in the audit before you switch, so nothing goes quiet on cut-over day. Our DNS security best practices checklist covers logging DNS to a SIEM in more detail.
When to move
Cisco's milestones set the outer limits:
| Date | Milestone | What to do |
|---|---|---|
| 31 January 2027 | Last day to order Umbrella DNS | New buyers should normally start on DNS Defense |
| 31 January 2028 | Last day to renew or add Umbrella licences | Existing customers can still renew or add licences, but any term must end by 31 January 2029 |
| 31 January 2029 | Last date of support | DNS protection needs to be on a successor by here |
Existing Umbrella services do not stop immediately; Cisco says customers keep service and support under their subscription terms and its milestones. In practice the best time to move is usually at your next renewal, when you can compare renewing Umbrella with buying DNS Defense, and when a short pilot will not overlap two paid subscriptions for long. Schools may prefer a holiday period, so filtering can be re-tested before pupils return.
Ask us for the current position on any Cisco upgrade offer; Cisco advertises one for Umbrella customers but does not publish its terms. Licensing detail for the new packages is under Cisco Secure Access licensing.
Should you look beyond Cisco?
End of sale is a natural moment to check you have the right service. For many Umbrella DNS customers DNS Defense is the simplest step: same resolvers, same deployment model, more detection. Others take the chance to compare. Our Cisco Umbrella vs DNSFilter page compares Cisco with DNSFilter, a DNS-focused alternative we also supply, and DNS security solutions covers every other DNS-layer option we supply, from endpoint add-ons to SASE platforms. The hub page on Cisco DNS-layer security maps every Cisco package if you are unsure which one you have.
How Forever Systems helps
Forever Systems is a Cisco Partner. We can audit your Umbrella DNS organisation (policies, destination lists, identities, virtual appliances, roaming clients, Chromebooks and integrations), recommend the matching DNS Defense package, time the move against your renewal, and help you pilot and cut over. If you would rather compare alternatives first, we can do that too.
For pricing, ask us for a quote. Contact us to plan your move to DNS Defense.
How Forever Systems helps with DNS security
We are an independent UK IT and cyber security provider and a Cisco Partner. We supply Cisco Umbrella and Cisco Secure Access DNS Defense, and a range of other DNS filtering options, so we can recommend what fits rather than one answer for everyone.
- Start with what you have: we look at your firewall, endpoint protection and Microsoft 365 licences first, as some already include DNS or web filtering
- Choosing a service: Cisco DNS-layer security, DNS filtering bundled with endpoint protection, or a protective DNS service from the public sector, compared in plain English
- Set-up and roll-out: network forwarding, roaming clients for laptops off site, policies, block pages and controls to stop encrypted DNS bypassing the filter
- Migration help, including planning a move from Umbrella DNS packages to Cisco Secure Access DNS Defense
- Ongoing help: policy changes, reporting reviews, licence management and renewals, agreed at quote
We work with businesses, schools, charities and public sector organisations.
Frequently asked questions
Is DNS Defense the same as Umbrella DNS?
It provides the same DNS-layer protection on Cisco's recursive resolvers, but runs on the Cisco Secure Access platform. Cisco says DNS Defense provides all Umbrella DNS features and adds AI-based DNS tunnelling and DGA detection and an enhanced policy framework, with SaaS API DLP and cloud malware scanning in the Advantage package.
What does DNS Defense add over Umbrella DNS Security?
Per Cisco: AI-based DNS tunnelling enhancements and DGA detection, an enhanced rules-based policy framework, and an upgrade path to Secure Internet Access and Secure Private Access on the same platform. DNS Defense Advantage also adds SaaS API data loss prevention and cloud malware scanning for apps such as Microsoft 365, Google Drive and Box.
Do I have to move from Umbrella DNS to DNS Defense?
You need a successor before Umbrella support ends on 31 January 2029. DNS Defense is Cisco's named migration product, but you can also choose another DNS security service. You can renew Umbrella until 31 January 2028.
When should I move from Umbrella to DNS Defense?
Usually at your next renewal, after a short pilot. New buyers should start on DNS Defense, because Umbrella DNS can only be ordered until 31 January 2027.
Does my Umbrella roaming client work with DNS Defense?
DNS Defense uses Cisco Secure Client for roaming protection, which Cisco includes at no added cost, but clients and their configuration need updating as part of the move. Chromebooks use Cisco Security for Chromebook.
Is there a DNS Defense package for schools?
Yes. Cisco names Secure Access DNS EDU Essentials as the successor to Umbrella DNS Security for Education, and its Umbrella website refers to a DNS Defense education package.
Still deciding?
Ask us and a member of our team will reply by email with a straight answer.
More DNS security guides
Cisco DNS-layer securityEvery Umbrella and Secure Access DNS Defense package, seen from the DNS layer.Umbrella vs DNSFilterCisco Umbrella and DNSFilter compared on DNS protection, roaming, plans and lifecycle.DNS tunnellingHow attackers hide traffic inside DNS, the signs to look for and how to stop it.DNS security solutionsEvery DNS-layer security option we supply, compared: standalone DNS, endpoint add-ons, firewall services, SASE, browser and mobile.Protective DNSWhat protective DNS is, the NCSC service for the public sector, and a checklist for choosing a provider.