A secure web gateway (SWG) protects your users and devices as they browse out to the internet. A web application firewall (WAF) protects your own web applications from inbound attacks. They face opposite directions, so one does not replace the other.
What does a secure web gateway do?
NIST SP 800-215 describes SWGs as appliances used for policy based access to and control of cloud based applications, and for governing access to the open web for enterprise users wherever they are: headquarters, branch offices, home or remote locations. It calls an SWG fundamentally a web filter that protects outbound user traffic through HTTP or HTTPS inspection. It also protects endpoints from web based threats that arise when users click links to malicious sites or visit sites infected with malware, and it centralizes control, visibility and reporting across locations and user types.
The same document says SWGs are not a replacement for WAFs.
What does a web application firewall do?
OWASP defines a WAF as an application firewall for HTTP applications that applies a set of rules to an HTTP conversation. The rules usually cover common attacks such as cross-site scripting and SQL injection. OWASP's contrast is useful: proxies generally protect clients, while WAFs protect servers. A WAF is deployed to protect a specific web application or a set of them, and can be considered a reverse proxy. It may be an appliance, a server plugin or a filter.
OWASP also warns that customizing a WAF to an application can take significant effort and has to be maintained as the application changes. NIST SP 800-215 places WAFs inside a wider category, web application and API protection, which adds API security, bot defense and DDoS protection.
How do they differ side by side?
- Protects: an SWG guards your users and their devices. A WAF guards your web applications.
- Direction: an SWG handles outbound traffic from users to the web. A WAF handles inbound requests from clients to your app.
- Typical rules: an SWG blocks categories, malicious sites and risky downloads. A WAF blocks injection, scripting and malformed requests.
- Owner: an SWG usually belongs to network or security operations. A WAF usually belongs to the application or platform team.
- App knowledge needed: little for an SWG, often a lot for a WAF.
A constructed example
A company with remote staff and a customer portal sees two incidents in a month. In the first, an employee follows a link in an email to a site that serves a malicious download. A gateway filtering outbound web traffic would have blocked the site or the file. In the second, a script probes the portal's search box with injection strings. A WAF in front of the portal would have blocked the requests and logged them. The first incident was about what employees reach. The second was about what outsiders reach. Different tools covered each.
What neither tool fixes
A WAF can block patterns, but it does not repair the flaw in the application. If the portal builds queries unsafely, the code still needs fixing, and a determined attacker may find a request shape the rules miss. An SWG cannot decide whether a legitimate cloud service is acceptable to use; that is a policy decision, and cloud access security brokers address part of it.
Both also depend on seeing traffic. Encrypted traffic must be decrypted for either to inspect it, which carries key management and privacy costs.
How to check or apply this
- List your assets by direction: what users reach out to, and what outsiders reach in to.
- For outbound web use, check whether users off the corporate network are filtered too.
- For each public web app, record whether a WAF sits in front and who maintains its rules.
- Start a WAF in detect mode to find false positives before blocking.
- Fix the underlying application flaws that the WAF is masking.
- Review blocked event logs from both weekly.
- Decide where TLS inspection is justified and who may see decrypted data.
Quick check
Can a WAF protect my employees' browsing?
No. A WAF sits in front of your applications and handles inbound requests. Employee browsing goes outbound and needs a web filter such as an SWG.
Does a WAF replace secure coding?
No. It reduces exposure to common attack patterns, but the vulnerable code remains until you fix it.
Sources
Last reviewed: 18 October 2026.
