Cisco Umbrella Intelligent Proxy: Release Date, EOL Timeline and What Replaces It
The Cisco Umbrella Intelligent Proxy was released in January 2014 by OpenDNS, eighteen months before Cisco acquired the company. It is still running today, and it is on its way out: the legacy packages that carried it stopped being sold on 30 September 2025 and reach end of software maintenance on 30 September 2026, while the current DNS and SIG packages reach end of sale on 31 January 2027. Cisco Secure Access, the designated successor, does not include a selective proxy.
That is the whole answer, and it is remarkably hard to find. Cisco’s administration guides explain how the feature works without saying when it shipped. Encyclopaedia entries record the 2014 launch with no lifecycle context. Competitor migration posts cover the Roaming Client retirement and skip the proxy engine entirely. Nobody puts the release date, the package scope and the end-of-life status on one page.
Below is that page, plus the part that actually affects your week: what selective proxying was inspecting on your behalf, and what has to take over.
What the Intelligent Proxy actually does
The Intelligent Proxy sits between DNS-layer filtering and a full inline secure web gateway. It was engineered around a cost problem: proxying all enterprise web traffic is expensive in bandwidth and compute, so route only the ambiguous traffic through a proxy and let everything else resolve normally.
When an endpoint using Umbrella resolves a domain, Cisco’s Anycast resolvers evaluate it against Talos threat intelligence and sort it into one of three paths:
- Known benign. Major CDNs, high-reputation business platforms and internal hosts resolve straight to their authoritative IP addresses. The client connects directly and sees no proxy latency at all.
- Known malicious. Command-and-control infrastructure, phishing servers and malware distribution nodes are blocked at the DNS layer. The resolver returns the address of an Umbrella block page and the session dies before TCP is established.
- Grey. Uncategorised domains, newly registered domains, and multi-tenant hosting platforms where good and bad content share an address. Here the resolver returns an Anycast proxy address inside Cisco’s 146.112.0.0/16 block, and the browser sends its HTTP or HTTPS handshake to the proxy instead.
On that third path, the proxy inspects the full URI rather than just the domain, so examplegrey.com/report.pdf and examplegrey.com/payload.exe can be treated differently. Where file inspection is licensed, downloads are stripped out and hashed against Talos intelligence, with unknown binaries submitted for sandboxing. And if the grey traffic is HTTPS, deep inspection requires SSL decryption, which means installing the Cisco Umbrella Root CA in the trust store of every managed endpoint so the proxy can terminate and re-sign the session.
Where the design stops
The trade-off that made selective proxying cheap is the same one that limits it. Four blind spots are structural rather than configuration mistakes, and they are worth understanding before you assess what needs to replace the feature.
Standard web ports only. Inspection applies to TCP 80 and TCP 443. Anything targeting 8080, 8443, or a non-HTTP protocol on a raw socket resolves via DNS and never touches the proxy.
Reputation decides before inspection does. The model depends entirely on the grey list being right. Malware or a phishing form hosted on SharePoint, Google Drive or GitHub sits behind a domain Umbrella treats as benign, so the query resolves directly to the hosting provider and the payload is never inspected. This is not an edge case; it is how a large share of modern delivery works.
No outbound data inspection. Because traffic to trusted domains is never intercepted, there is nothing watching outbound movement. HTTP POST bodies to corporate cloud services are invisible, personal and corporate tenants of the same SaaS platform cannot be distinguished, and pasting internal material into an unapproved web tool leaves no trace at this layer.
Encrypted DNS walks around it. The whole model assumes you control name resolution. A browser with DNS over HTTPS pointed at a public resolver bypasses local DNS configuration entirely, and unless you are blocking known DoH endpoints and port 853 at the perimeter, Umbrella never sees the query. As one network engineer put it in a community thread: “If your security relies entirely on owning port 53, modern browser encryption effectively blinds you.”
Release and change timeline
| Date | Milestone | What changed |
|---|---|---|
| November 2012 | OpenDNS Umbrella launches | DNS-layer enterprise security platform |
| February 2013 | Security Graph | Threat intelligence layer behind the resolvers |
| January 2014 | Intelligent Proxy general availability | Selective proxying of grey domains introduced |
| August 2015 | Cisco acquires OpenDNS | Reported at $635 million |
| November 2016 | Rebrand to Cisco Umbrella | Product naming change |
| February 2017 | Umbrella SIG launches | Full cloud secure web gateway alongside DNS |
| August 2017 | Cloud file inspection | Antivirus and AMP scanning added to proxied sessions |
| May 2018 | SSL decryption GA | Deep inspection of HTTPS grey traffic, root CA required |
| 31 July 2022 | IP layer enforcement retired | Roaming Client callback enforcement moved to SWG tunnels or DNS |
| 2 April 2024 | Roaming Client EOL announced | Standalone client and OpenDNS consumer tiers retired |
| 2 April 2025 | Roaming Client end of support | Migration to Cisco Secure Client required |
| 18 June 2025 | Bulletin EOL15688 published | Legacy Umbrella tiers formally retired |
| 30 September 2025 | End of sale, legacy SKUs | Last date to buy or renew Insights, Platform, Professional |
| 30 September 2026 | End of software maintenance, legacy SKUs | Final maintenance releases and engineering fixes |
| 1 September 2026 | DNS and SIG EOL announced | Current Umbrella packages given retirement dates |
| 31 January 2027 | End of sale, Umbrella DNS and SIG | Last date to purchase current SKUs |
| 31 January 2028 | End of renewal, DNS and SIG | Last date to extend an existing subscription |
| 31 January 2029 | Last date of support, DNS and SIG | TAC support and cloud entitlements end |
| 30 September 2030 | Last date of support, legacy SKUs | Legacy subscriptions fully obsolete |
Last verified: September 2026. Sources: Cisco end-of-life bulletin EOL15688, Cisco’s Umbrella DNS and SIG end-of-life notice of 1 September 2026, and the Cisco Umbrella Roaming Client end-of-life bulletin, all on cisco.com.
Which packages carry the proxy, and where they stand
Not every Umbrella tier includes the Intelligent Proxy, and the ones that do are not all on the same clock. This is the table that decides whether you have a deadline in three weeks or in sixteen months.
| Package | Intelligent Proxy included | End of sale | End of software maintenance | Last date of support | Cisco’s designated replacement |
|---|---|---|---|---|---|
| Umbrella Insights (UMB-INSIGHTS-K9) | Yes, with SSL decryption and file inspection | 30 Sep 2025 | 30 Sep 2026 | 30 Sep 2030 | Umbrella DNS Security Advantage |
| Umbrella Platform (UMB-PLATFORM-K9) | Yes, plus threat APIs | 30 Sep 2025 | 30 Sep 2026 | 30 Sep 2030 | Umbrella DNS Security Advantage |
| Umbrella Professional (UMB-PROFESSIONAL) | No, DNS filtering only | 30 Sep 2025 | 30 Sep 2026 | 30 Sep 2030 | Umbrella DNS Security Essentials |
| Umbrella DNS Security Essentials (UMB-DNS-ESS-K9) | No, DNS filtering only | 31 Jan 2027 | 31 Jan 2027 | 31 Jan 2029 | Cisco Secure Access DNS Essentials |
| Umbrella DNS Security Advantage (UMB-DNS-ADV-K9) | Yes, with SSL decryption and file inspection | 31 Jan 2027 | 31 Jan 2027 | 31 Jan 2029 | Cisco Secure Access DNS Advantage |
| Umbrella SIG Essentials (UMB-SIG-ESS-K9) | Full cloud SWG, not selective | 31 Jan 2027 | 31 Jan 2027 | 31 Jan 2029 | Secure Access Internet Access Essentials |
| Umbrella SIG Advantage | Full cloud SWG, not selective | 31 Jan 2027 | 31 Jan 2027 | 31 Jan 2029 | Secure Access Internet Access Advantage |
| Umbrella Roaming Client (standalone) | Endpoint agent only | 2 Apr 2024 | 2 Apr 2025 | 2 Apr 2025 | Cisco Secure Client, Umbrella module |
Two rows deserve attention. If you are on Insights or Platform, engineering maintenance for your subscription ends this month, on 30 September 2026, even though support formally runs to 2030. And Cisco Secure Access, the endpoint of every migration path in the right-hand column, discontinues selective proxying altogether. There is no like-for-like destination for this feature. That is the fact the whole article turns on.
For the wider migration paths off legacy Umbrella tiers, we covered the options in Cisco Umbrella end of life: migration paths in 2026, and set out a staged approach in a sixty-day replacement plan.
What replaces selective proxying
Modern architectures split the job the Intelligent Proxy was doing into three functions, and it is worth being honest that each of them carries a cost the old design avoided.
| Intelligent Proxy (selective) | Inline cloud secure web gateway | |
|---|---|---|
| How traffic is intercepted | DNS-layer redirection of grey domains | Endpoint proxy driver, PAC file, or IPsec/GRE tunnel |
| Share of web traffic inspected | Only domains classified as grey | All outbound HTTP and HTTPS |
| Ports and protocols | TCP 80 and 443 only | All web ports; firewall-as-a-service covers other IP protocols |
| Outbound data inspection | None | Content inspection, pattern matching, file fingerprinting |
| SaaS tenant control | Domain-level block or allow | Inline CASB with tenant restriction |
| Untrusted sites | Proxy and inspect, or block | Remote browser isolation in an ephemeral container |
| Latency | Negligible for most traffic | Continuous, depending on proximity to the nearest point of presence |
| Certificate footprint | Root CA needed for grey sites; breakage limited to those | Universal root CA; certificate failures affect all browsing |
The honest reading of that table is that always-on inspection removes the blind spots and introduces two real operational problems in their place.
The first is decryption breakage. Universal TLS inspection terminates every encrypted session at the security edge, and applications with strict certificate pinning reject a proxy-generated certificate outright. Banking portals, developer command-line tools, synchronisation clients and mobile OS update daemons all sit in this category, and keeping a bypass list current is permanent engineering work rather than a one-off configuration task.
The second is specific to Europe and it is the reason “just inspect everything” is not a complete answer here. Full TLS inspection intersects directly with GDPR and with national labour law. Under GDPR Article 88 and works council arrangements in Belgium and Germany, decrypting personal communications, online banking or healthcare sessions without explicit justification is not something you can simply switch on. NIS2 and DORA add the requirement that decrypted payloads, URL parameters containing personal data and user identification logs stay within EU jurisdiction. A US-hosted inspection stack makes that a harder conversation than it needs to be.
This is where remote browser isolation earns its place rather than being a nice extra. Instead of decrypting an uncategorised site to inspect it, the session executes in a disposable cloud container and only sanitised visual output reaches the endpoint. No untrusted code touches the device, and no TLS termination is required for the ambiguous traffic. It handles the exact case the grey list was invented for, without the certificate and privacy overhead.
Jimber’s platform is built around that combination for EU mid-market organisations: an always-on secure web gateway for the traffic that should be inspected, remote browser isolation for the traffic that should not be decrypted, and EU-sovereign data handling so the privacy question has a straightforward answer. If you want the architectural comparison in more depth, we set it out in DNS-first security or full SASE for the mid-market, and the case for keeping DNS filtering as a baseline layer in DNS filtering for the mid-market.
What a mid-market Umbrella shop actually has to rebuild
Teams underestimate this migration in five specific places, and none of them is the security policy itself.
Policy translation. Umbrella policies are coarse: category lists and domain allow or block entries. An inline gateway works in URL paths, HTTP methods and application controls. Translating one into the other is not a copy operation, and the dependencies between rules only become visible once you try.
Identity. Umbrella deployments typically rely on Active Directory virtual appliances parsing domain controller event logs. Cloud-native platforms expect SCIM and SAML federation against Entra ID or Okta. The migration surfaces every piece of directory debt you have: nested groups, stale accounts, group count limits.
Endpoint rollout. Moving from a lightweight roaming module to an agent that intercepts traffic and installs a root certificate means reboots, potential conflicts with other network filter drivers, and a sequenced MDM deployment. Plan it as a rollout, not a push.
Block pages. Umbrella redirects to an Anycast block server. An inline gateway injects the block page into the live session, which works cleanly only if the root certificate is present. Where it is not, the user sees a browser security warning rather than your message, and the service desk gets the call.
Logging volume. This one catches finance rather than engineering. DNS query logs are small: timestamp, identity, domain, disposition. Web proxy transaction logs carry full URLs, headers, MIME types and file hashes, and the volume increase is substantial enough to change SIEM ingestion costs materially. Model it before you commit to a retention policy.
Where this leaves you
If you are running Umbrella Insights or Platform, your engineering maintenance ends on 30 September 2026 and your selective proxy has no direct successor in Cisco’s own portfolio. If you are on DNS Security Advantage, you have until 31 January 2027 before end of sale and a further year to renew, which is enough time to run a proper evaluation rather than an emergency one.
Either way the architectural decision is the same, and it is not “which Umbrella tier next”. Selective proxying is being retired as a category, not as a product. What replaces it is a choice between full inline inspection, isolation for the ambiguous traffic, or both, and in an EU context where those sessions are decrypted and stored matters as much as whether they are inspected.
We are happy to walk through what your current Umbrella policy set would look like on an inline platform, including the parts that do not translate cleanly. Book a demo or get in touch.
Frequently asked questions
What is the release date of the Cisco Umbrella Intelligent Proxy?
The Cisco Umbrella Intelligent Proxy was released in January 2014 by OpenDNS, eighteen months before Cisco acquired the company. It introduced selective proxying: routing suspicious or uncategorised “grey” domains to cloud proxies for inspection while allowing benign DNS traffic to resolve directly without added latency.
When does the Cisco Umbrella Intelligent Proxy reach end of life?
It retires in phases. Legacy packages carrying the proxy reached end of sale on 30 September 2025 and reach end of software maintenance on 30 September 2026. Current DNS and SIG tiers reach end of sale on 31 January 2027, with support ending 31 January 2029.
Does Cisco Secure Access include the Intelligent Proxy?
No. Cisco Secure Access discontinues the selective proxy. Instead of redirecting grey domains at the DNS layer, it directs traffic into a full security service edge architecture using inline secure web gateway inspection, remote browser isolation, or standard DNS-layer filtering.
What is a selective proxy in DNS security?
A selective proxy intercepts web traffic based on domain reputation. Benign sites resolve normally with no proxy in the path, confirmed malicious sites are blocked at the DNS layer, and domains flagged as risky or uncategorised are redirected to a cloud proxy for deeper inspection of the URL and any files.
Why does the Intelligent Proxy require a root certificate?
Because it acts as a man in the middle to decrypt HTTPS traffic on grey domains. Without the Cisco Umbrella Root CA installed in endpoint certificate stores, browsers reject the proxy’s re-signed connection and show untrusted certificate warnings instead of the page, blocking access entirely.
Does the Intelligent Proxy inspect traffic if SSL decryption is off?
Only partially. With decryption disabled it inspects URL paths and payloads for unencrypted HTTP on port 80. For HTTPS on port 443 it can see the domain via Server Name Indication and the initial handshake, but cannot evaluate full URI paths, query parameters, or run file scanning.
Can administrators edit the Cisco Umbrella grey list?
No. The grey list is curated dynamically by Cisco Talos and cannot be viewed, edited or customised directly. Administrators can only override behaviour by adding domains to custom global allow or block lists, which exempts them from all policy rather than just from proxying.
Why does the Intelligent Proxy not block malicious links on Microsoft 365 or Google Workspace?
High-reputation cloud platforms are classified as benign so that core workflows avoid proxy latency. DNS requests resolve directly to Microsoft or Google addresses and bypass inspection entirely. Blocking malicious files hosted on those platforms requires an inline secure web gateway or an API-based CASB integration.
What replaced the Cisco Umbrella Roaming Client?
The standalone Roaming Client was superseded by Cisco Secure Client with the Umbrella roaming security module. Software maintenance and support for the standalone client ended on 2 April 2025, so any endpoint still running it has been unsupported for over a year.
What is the difference between the selective proxy and remote browser isolation?
The selective proxy terminates the connection, inspects the URL and payload, then forwards content for the local browser to execute. Remote browser isolation runs the entire session in a disposable cloud container and streams only visual output, so untrusted code never reaches the endpoint at all.