A secure web gateway is a security service that checks every website a company's staff visit, and blocks harmful or forbidden websites, wherever the laptop is. It used to be a box in the office, called a web proxy. Today it is usually a part of SASE, and it runs in a security company's cloud.
A small program on each laptop sends all web traffic to the gateway first. The gateway then does three checks. First, it looks up the website's category, such as news, banking, gambling or "newly registered". The company decides which categories its staff may open. Second, it checks the website against lists of known harmful sites from a threat intelligence platform. Third, it scans the files that staff download. It can open a suspicious file in a sandbox, a sealed computer in the cloud, to see what the file does.
Most websites today use HTTPS, which encrypts the page between the website and the browser. To check the contents, the gateway must decrypt the page and encrypt it again. The laptops accept this because the company installs the gateway's certificate on them. A certificate is a digital document that proves which company or server is at the other end of a connection. Companies usually skip this decryption for banking and health websites, to protect their staff's privacy.
Imagine an architect at a design firm, working from her flat in Chandigarh. At 11 a.m., she clicks a link in an email that promises free invoice templates. Her laptop sends the request to the gateway's nearest site, in Delhi. The gateway sees that the website was registered two days ago. The firm blocks this category, so she sees a warning page instead. In the afternoon, she downloads a drawing tool from a file-sharing site. The gateway holds the file for 30 seconds while the sandbox runs it. The tool does nothing harmful, so the download completes.
Every visit and every block is logged to the SIEM. The gateway can also stop company data from leaving. It applies data loss prevention (DLP) rules to uploads. It also controls which outside AI tools staff may use, and what they may paste into them. This is called shadow AI control.
A secure web gateway checks the website itself. DNS security does a simpler check, one step earlier: it refuses to look up the address of a harmful website at all. Schools use the same kind of filter on the laptops they give students, through school device management and web filtering.