A proxy forwards web requests on behalf of clients. A secure web gateway, or SWG, is a proxy that also enforces security policy on that traffic, such as blocking risky categories, inspecting downloads and logging activity. Every SWG acts as a proxy, but a basic proxy is not an SWG.
What is a proxy at its core?
NIST's glossary, citing CNSSI 4009, defines a proxy server as a server that services the requests of its clients by forwarding those requests to other servers. RFC 9110, the HTTP specification, describes an intermediary acting as a proxy as one selected by the client, usually through configuration, to receive requests for many origin servers and forward them. That is all a plain forward proxy has to do.
A proxy in that sense can add useful things: caching, a single outbound address, simple allow and deny lists. But the word itself says nothing about security checks.
What does an SWG add?
"Secure web gateway" is a product category, not a standard, so features vary and you should read each vendor's feature list rather than assume. In general, the added functions are:
- URL and category filtering, so staff cannot reach known malicious or prohibited sites.
- Malware inspection of downloads.
- TLS inspection, which decrypts traffic to look inside it, then re-encrypts it.
- Controls on uploads and application use, to reduce data leaving.
- User and device identity tied to policy, so rules differ by group.
- Central logging and reporting.
The proxy is the place where the traffic is stopped, and the policy engine decides what to do with it.
Where do the trade-offs sit?
TLS inspection is the main one. Most web traffic is encrypted, so without inspection, content checks see little. With inspection, the gateway holds a certificate that clients trust, which creates privacy and compliance questions, and some applications refuse to work through it. Decide which categories you will not inspect, such as banking and health sites, and write that down.
Placement matters too. A gateway in a data center only protects people behind it, and laptops on home networks bypass it unless traffic is steered or an agent is installed. Many deployments now run as cloud services for that reason. Check how a specific product handles off-network devices.
A third point is that a gateway sees web traffic only. It does not replace network firewalling, endpoint controls or email filtering. NIST SP 800-41 treats the proxy approach as one firewall technology among others, with its own strengths and costs.
A constructed example
A 200-person company has a simple forward proxy that caches updates and hides internal addresses. A user downloads an invoice from a compromised site. The proxy fetches it and hands it over, since it only forwards. After the company moves to a gateway with category filtering and download scanning, the same download is blocked and logged, and the log shows which user and device asked for it.
How does this relate to zero trust?
A gateway enforces policy at the point where traffic leaves, which fits the idea in NIST SP 800-207 that decisions should rest on identity and context rather than network location. In that view the gateway is one policy enforcement point among several. It is strongest when it knows who the user is and the state of their device, and weakest when it only sees an address on the office network.
How to check or apply this
- Write down what you need: filtering, malware checks, data upload controls, logging, or only caching.
- Ask any product exactly which of those it performs, and on which traffic.
- Decide your TLS inspection policy, including exemptions, before rollout.
- Plan for off-network laptops and mobile devices.
- Start in monitor mode, review what would be blocked, then enforce in stages.
- Send gateway logs to the place your analysts already work.
- Test with a harmless known test file and a blocked category to confirm enforcement.
Quick check
Is a VPN the same as a proxy?
No. A VPN tunnels network traffic between points. A proxy handles requests for specific protocols, most often web traffic.
Do I need TLS inspection?
Without it, a gateway can still filter by domain, but it cannot see inside encrypted content. Weigh that against privacy and compatibility.
Sources
- NIST glossary, proxy server
- RFC 9110, HTTP Semantics
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
Last reviewed: 18 October 2026.
