Organizations manage web security across different environments, from centralized corporate networks to distributed offices, remote employees, and cloud applications. How users connect to the internet, where web traffic is inspected, and who manages the security infrastructure can vary significantly.
Choosing between a cloud secure web gateway (SWG) and an on-prem SWG affects more than infrastructure ownership. It can influence traffic routing, policy enforcement, scalability, operational costs, and user experience.
Both approaches help organizations control internet access, but they differ in deployment and management. Understanding these differences can help IT and security teams select an architecture that fits their network environment, security requirements, and operational priorities.
What is a cloud SWG?
A cloud SWG is a cloud-delivered network security solution that sits between enterprise users and the internet to filter traffic, block cyber threats, and enforce corporate security and regulatory policies. It is a provider-hosted security solution that inspects internet-bound web traffic and enforces web access policies.
Depending on the solution, a cloud SWG can filter websites, block web-based threats, and apply security controls to users connecting from offices, branch locations, and remote environments.
Unlike an on-prem SWG, a cloud SWG does not require organizations to host the main gateway infrastructure within their own data centers. Instead, traffic is directed to the provider’s cloud infrastructure for inspection and policy enforcement.
Depending on the deployment, traffic may reach the service through endpoint agents, proxy configurations, DNS policies, secure tunnels, or branch connectors.
Common cloud SWG capabilities may include:
- URL and category-based web filtering
- Malware and phishing protection
- SSL/TLS traffic inspection
- Data loss prevention (DLP)
- Application-aware policy enforcement
- Centralized policy management
The exact capabilities and inspection methods vary by provider, platform, and license.
Since the provider manages the gateway infrastructure, organizations can expand coverage without deploying additional physical gateway appliances at every location. However, they may still need to manage endpoint components, traffic routing configurations, and security policies.
What is an on-prem SWG?
An on-prem SWG is a hardware or software-based security solution deployed within an organization’s own infrastructure to filter, inspect, and control internet-bound web traffic. It typically operates as a physical appliance, virtual appliance, or locally hosted software within a corporate network or data center.
Internet-bound traffic is directed through the gateway, where configured web security policies are applied before users access external websites or cloud applications.
In traditional enterprise networks, on-prem SWGs commonly served as centralized inspection points. When most employees worked from corporate offices and internet traffic passed through established network paths, organizations could manage web filtering and inspection through gateway infrastructure within their network.
A typical on-prem SWG deployment involves:
- Physical or virtual gateway appliances hosted within organizational infrastructure
- Traffic routing through designated inspection points
- Internal administration of gateway software and security policies
- Capacity planning and infrastructure maintenance
- Hardware upgrades or additional resources as traffic requirements grow
On-prem SWGs remain relevant for organizations with centralized networks, internal hosting requirements, or existing investments in gateway infrastructure. However, extending the same inspection model to remote users and cloud applications can require additional traffic routing, connectivity, and capacity planning.
Cloud SWG vs. On-Prem SWG: Key differences
Cloud and on-prem SWGs share the goal of enforcing web access policies. Their primary differences involve infrastructure location, management responsibilities, scalability, and how traffic reaches the inspection point.
| Feature | Cloud SWG | On-Prem SWG |
| Deployment model | Provider-hosted, cloud-delivered service | Physical or virtual gateway within organizational infrastructure |
| Common organizational fit | Distributed workforces, hybrid environments, and cloud-first operations | Centralized networks, internal hosting requirements, and existing gateway infrastructure |
| Infrastructure management | Provider maintains gateway infrastructure; IT manages applicable policies and configurations | Organization or managed service provider maintains infrastructure, updates, and policies |
| Scalability | Capacity can generally expand without deploying additional on-site gateway appliances | Expansion may require additional hardware, licenses, or infrastructure resources |
| Traffic inspection | Traffic is directed to provider-hosted inspection points | Traffic is directed through organization-controlled inspection points |
| Cost structure | Typically subscription-based, with lower gateway hardware investment | Typically includes infrastructure, licensing, maintenance, and capacity-related costs |
| Remote user support | Uses supported traffic steering methods to extend controls to remote users | May require VPN connectivity, tunnels, proxies, or additional routing |
| Maintenance | Core gateway infrastructure is maintained by the provider | Infrastructure maintenance remains the responsibility of the organization or its service provider |
These are general differences rather than fixed advantages. Actual security coverage, performance, and total cost depend on the architecture, product capabilities, deployment requirements, and traffic volumes.
While both deployment models can support enterprise web security requirements, changes in how employees work and access applications have created new challenges for traditional on-prem SWGs. These challenges are particularly relevant for organizations supporting remote users, distributed locations, and increasing cloud application traffic.
Why businesses are moving beyond on-prem SWG
On-prem SWGs can be effective when web traffic follows predictable network paths. However, hybrid work, SaaS adoption, and direct-to-internet connectivity have changed how organizations access applications.
Extending centralized inspection to these environments may introduce operational challenges.
1. Supporting remote users
Employees working outside the corporate network may not automatically send internet traffic through an on-prem SWG.
Organizations may need VPN connections, proxy configurations, or secure tunnels to direct this traffic through centralized inspection points. These additional network paths can increase deployment complexity and, depending on the architecture, affect performance.
2. Inspecting encrypted web traffic
SSL/TLS encryption is widely used across modern websites and cloud applications. When an SWG needs to inspect encrypted content for threats or policy violations, it may decrypt the traffic, inspect it, and re-encrypt it before delivery.
This can increase processing requirements, particularly for on-prem gateways handling large traffic volumes. As inspection demand grows, organizations may need additional gateway capacity or infrastructure upgrades to maintain performance.
Not all web filtering requires full traffic decryption. Domain-based restrictions and some other controls can operate without inspecting encrypted application content. The inspection methods available depend on the solution.
3. Maintaining gateway infrastructure
On-prem SWGs require ongoing infrastructure management. IT teams or managed service providers must maintain gateway software, apply updates, monitor performance, manage capacity, and plan hardware refreshes.
These responsibilities can become more demanding as organizations add users, locations, and network traffic.
Cloud-delivered services shift much of the underlying gateway infrastructure maintenance to the provider, although organizations remain responsible for their policies and any required customer-managed components.
4. Scaling security as the business grows
Scaling an on-prem SWG deployment may require additional appliances, virtual resources, licenses, or network capacity. Organizations must estimate current and future traffic volumes to ensure their inspection infrastructure can handle demand.
When traffic increases beyond available capacity, additional infrastructure investment or configuration changes may be required.
Cloud-delivered SWGs can generally expand provider-hosted capacity without requiring customers to install additional gateway hardware. However, scalability and performance still depend on the service provider and deployment configuration.
5. Securing direct-to-cloud applications
Employees increasingly access SaaS applications directly over the internet rather than through centralized corporate networks.
When an organization relies on an on-prem SWG for web inspection, these connections must reach the gateway to remain subject to its policies. For remote users and distributed offices, that may require VPN connections, tunnels, proxy configurations, or additional network routes.
As the number of users and cloud applications grows, maintaining these traffic paths can increase network complexity and operational overhead.
On-prem SWGs are not inherently unsuitable for distributed environments. However, organizations need to assess whether their existing routing architecture can support the required coverage and performance.
For businesses supporting distributed users and cloud applications, cloud-delivered SWGs offer an alternative approach to web security, simplifying traffic routing and gateway infrastructure management.
Why organizations are adopting cloud SWG
Cloud-delivered SWGs offer an alternative for organizations that want provider-managed inspection infrastructure and web security controls across distributed environments. Their main advantages relate to deployment flexibility, infrastructure management, and the ability to support different network locations.
1. Extending security beyond the corporate network
Cloud SWGs can apply web security policies to traffic originating from corporate offices, branch locations, and remote users. Depending on the solution, organizations can direct traffic through cloud inspection points using endpoint agents, proxies, secure tunnels, DNS-based methods, or network connectors.
This can reduce the need to route all internet traffic through a central corporate data center. However, policy coverage depends on whether the relevant traffic is directed through the security service and whether the required components are configured correctly.
2. Centralized policy management
Cloud SWGs allow IT admins to manage web access policies through a centralized management interface. This can simplify policy administration across multiple locations without requiring separate physical gateway appliances at each site.
On-prem SWGs may also provide centralized policy management. The distinction is that cloud-delivered solutions shift responsibility for maintaining the underlying gateway infrastructure to the provider.
3. Provider-managed updates and maintenance
Cloud SWG providers maintain and update the underlying gateway infrastructure, reducing the need for organizations to manage physical appliances and hardware refreshes themselves.
Service updates and security data refreshes can also be delivered through the provider’s infrastructure. However, update frequency and maintenance requirements for endpoint agents, network connectors, certificates, and other customer-managed components vary between solutions.
4. Support for cloud-first environments
Cloud SWGs can support organizations whose users and applications operate across different network locations. Since the inspection infrastructure is provider-hosted, organizations can evaluate traffic paths that do not depend on a single corporate data center.
Integration capabilities still vary. IT and security teams should assess compatibility with identity providers, endpoint management platforms, security monitoring tools, and existing networking infrastructure before choosing a solution.
How to choose the right SWG solution
Choosing the right SWG involves more than deciding between cloud and on-prem deployment. Organizations should also evaluate how web security policies are enforced and how the solution fits their existing infrastructure.
Gateway-based approaches inspect traffic routed through a gateway, while endpoint-centric approaches apply supported web filtering policies directly on managed devices.
The following questions can help guide the decision.
1. Where are web security policies enforced?
Determine whether traffic must pass through network-level inspection infrastructure or whether web access controls can be applied directly on managed endpoints.
Gateway-based enforcement can cover traffic directed through designated network paths. Endpoint-centric enforcement can extend supported controls to managed devices outside those paths. Consider which devices, users, applications, and traffic types require coverage.
2. How does the solution handle encrypted traffic?
Evaluate whether the SWG supports SSL/TLS decryption and inspection, which traffic it can inspect, and what exclusions may apply. Ask vendors about certificate requirements, supported protocols, inspection performance, and privacy considerations.
The required inspection depth should reflect your organization’s security policies and the types of threats or violations you need to detect.
3. How granular are the web filtering capabilities?
Review the policies the solution supports, including:
- Website category restrictions
- Domain allowlists and blocklists
- Exceptions for trusted resources
- Application-specific controls
- User or device-based policy assignment
Additionally, evaluate how easily IT admins can update policies and review enforcement activity.
4. Does it integrate with your existing security ecosystem?
An SWG should fit into the technologies your organization already uses. Evaluate compatibility with identity providers, endpoint management platforms, network infrastructure, and security monitoring tools.
Check whether the solution supports the reporting, logging, and administrative workflows your team requires.
5. How complex is deployment and ongoing management?
Deployment requirements can vary significantly between solutions. Some require gateway appliances, endpoint agents, proxies, DNS changes, secure tunnels, certificates, or network connectors.
Understanding these dependencies helps IT teams estimate implementation effort, maintenance responsibilities, and long-term operating costs.
6. Which enforcement model fits your environment?
Consider whether your organization primarily needs network-level traffic inspection, endpoint-level web access controls, or both.
For example, endpoint-centric filtering may be useful for managed devices used outside corporate networks. Network-level controls may still be required for unmanaged devices, guest traffic, or traffic that does not pass through the endpoint enforcement layer.
The appropriate choice depends on the coverage and inspection requirements of your environment.
Choosing the right SWG architecture
There is no universally better deployment model. The right approach depends on the organization’s infrastructure, traffic patterns, security requirements, and available IT resources.
The following scenarios can help narrow the options.
| If your organization primarily has… | Consider evaluating… |
|---|---|
| Centralized networks with internal hosting requirements | On-prem SWG |
| Remote employees, distributed offices, and cloud-first applications | Cloud SWG |
| Managed endpoints requiring device-level web filtering | Endpoint-centric web security or endpoint-level SWG enforcement |
| A combination of centralized infrastructure and distributed users | Hybrid gateway and endpoint enforcement |
| Limited resources for maintaining gateway appliances | Cloud-delivered or managed SWG |
| Existing gateway investments alongside growing remote device coverage | A combination of network-level and endpoint-level controls |
These are starting points rather than fixed recommendations. Organizations should assess traffic inspection, policy coverage, compatibility, cost, and operational requirements before selecting an architecture.
The location of the gateway is only one part of the decision. IT teams also need to understand whether their chosen approach can enforce the required policies wherever users and devices connect.
What is endpoint-centric web security?
Endpoint-centric web security applies web access controls directly on managed devices instead of relying only on centralized network inspection points.
In an endpoint-centric SWG model, the managed device acts as a policy enforcement point. Configured filtering controls can remain active when users move between office networks, home connections, branch locations, and other environments.
This approach can help organizations maintain web content restrictions without requiring every filtering decision to occur at a centralized gateway. However, enforcement depends on supported platforms, enrollment methods, endpoint components, and assigned policies.
Endpoint-centric filtering also does not automatically replace every function of a network-based SWG. Organizations may still require additional controls for unmanaged devices, network traffic outside managed endpoints, or inspection requirements that the endpoint solution does not support.
Endpoint-centric web security with Veltar
As employees access websites and cloud applications from different network environments, IT teams need a way to apply web access policies to managed devices beyond the corporate network.
Veltar addresses this requirement through its endpoint-centric SWG capability. Rather than relying solely on centralized gateway infrastructure, Veltar SWG applies configured web content filtering policies directly on supported managed devices.
From the Scalefusion dashboard, IT admins can configure:
- Category-based web filtering: Restrict access to websites belonging to selected categories.
- Custom domain rules: Block specific domains based on organizational requirements.
- Allowed domain exceptions: Permit selected domains even when broader filtering rules are applied.
- Cloud application access controls: Restrict sign-ins to supported Google and Microsoft cloud services using approved organizational accounts on managed Windows, macOS, and Linux devices.
- Policy assignment: Publish configured web filters through device profiles for supported managed devices.
Secure Web Gateway supports web content filtering on eligible managed devices across supported operating systems: Android, iOS, Windows, macOS, and Linux. Available filtering options, cloud app account restrictions, and enforcement requirements vary by platform, enrollment method, and configuration.
This endpoint-centric approach can help organizations maintain web filtering across distributed managed devices while reducing reliance on centralized traffic backhauling for those controls.
Organizations should still evaluate whether complementary network-level security is needed for unmanaged devices, additional traffic inspection requirements, or other parts of their environment.