90.41%
Threat detection rate
Malware Protection That Operates at Cloud Speed
Traditional endpoint-based malware detection identifies threats only after files reach the device. Cisco Umbrella intercepts malicious files in the cloud — during web browsing, file downloads, or cloud storage activity — before they ever land on an endpoint. Combined with Cisco Secure Endpoint for post-infection response, Umbrella gives you the fastest path from threat detection to containment.
Protection Powered by Global Scale
620B
DNS requests processed per day
5B
Web reputation requests per day
170M
Malicious DNS queries blocked per day
200+
New vulnerabilities discovered per year
30+
Machine learning algorithms to detect emerging attacks
Protection Powered by Global Scale
90.41%
Threat detection rate
620B
DNS requests processed per day
5B
Web reputation requests per day
170M
Malicious DNS queries blocked per day
200+
New vulnerabilities discovered per year
30+
Machine learning algorithms to detect emerging attacks
Three Layers of Cloud Malware Defense
Cisco Umbrella approaches cloud malware protection from three angles: policy-based control, cloud-native detection, and integration with endpoint security for comprehensive coverage from the network to the device.
Control and Management
Configure file type restrictions, download policies, and content controls through the Umbrella console. Block high-risk file categories (executables, scripts, archives) for users or groups without requiring endpoint policy changes.
Cloud-Native Detection
Files passing through Umbrella’s proxy are inspected using multi-engine antivirus and Cisco’s cloud sandbox. Unknown files are detonated in a safe cloud environment to identify zero-day malware and advanced threats before they reach endpoints.
Cisco Secure Endpoint Integration
Umbrella integrates with Cisco Secure Endpoint (AMP) to share threat intelligence and file reputation data. Threats identified by Umbrella are correlated with endpoint activity, giving security teams the context to investigate and respond to incidents faster.
Faster Incident Response
Shrink the Time Between Detection and Containment
When malware is detected, every minute matters. Cisco Umbrella surfaces threat events in real time within the Umbrella dashboard — with details on the user affected, the file hash, the source URL, and the action taken. Security teams can pivot directly from a malware detection event to endpoint investigation using Cisco Secure Endpoint, dramatically reducing mean time to respond (MTTR).
- Real-time threat alerts with user and device context
- File hash correlation with Cisco Secure Endpoint for endpoint-level investigation
- Historical lookup of blocked files and threat events for forensic analysis
- API-based integration with SIEM platforms for centralized incident management
Detection Accuracy Powered by Cisco Talos
Cloud malware detection is only as good as the intelligence behind it. Cisco Talos analyzes over 600 billion security events per day, maintaining one of the most comprehensive malware databases and URL reputation systems available — all of which feeds directly into Umbrella’s file inspection and threat blocking capabilities.
File Reputation
Every file inspected by Umbrella is checked against Talos’ file reputation database with billions of known-good and known-bad signatures.
Cloud Sandbox
Unknown files are executed in Cisco’s cloud sandbox to observe behavior. Zero-day and polymorphic malware is identified even without a known signature.
URL and Domain Intelligence
Malware-serving URLs and newly registered malicious domains are blocked at the DNS layer before files are requested, reducing the attack surface at the earliest opportunity.
Continuous Updates
Threat intelligence updates propagate to Umbrella in real time. New malware families and threat campaigns are blocked across all customers the moment Talos identifies them.
The Next Evolution
Cisco Umbrella Is Evolving to Cisco Secure Access
Building on Cisco Umbrella’s proven security with more than 30,000 customers globally, Cisco Secure Access delivers an intuitive user experience, simplified IT management, and powerful new capabilities — for the same price.
Explore Cisco Secure AccessStop Malware Before It Reaches Your Endpoints
Our Cisco-certified team can help you deploy Umbrella cloud malware protection and integrate it with Cisco Secure Endpoint for end-to-end threat coverage from the network to the device.
- Multi-engine AV and cloud sandbox for unknown files
- Real-time Talos threat intelligence keeps detection current
- Integrated with Cisco Secure Endpoint for rapid incident response
- Response from a certified Cisco specialist within one business day