A secure web gateway sits between your team and the internet, checking every website they visit and blocking the dangerous ones before they load. Think of it as a checkpoint rather than a filter list. It doesn’t just block a known bad site; it inspects what’s actually happening on a page in real time, including sites that were perfectly safe yesterday and were hijacked overnight.
Most business owners have heard the term from a vendor pitch and switched off halfway through, because the explanations are written for IT specialists, not for the person signing off the budget. Here is the plain version.
What does a secure web gateway actually do, in plain terms?
A secure web gateway checks every website your team tries to visit and blocks the ones carrying malware, running phishing pages, or breaking your company’s browsing rules. It sits in the path between the browser and the open internet, so the check happens before a dangerous page ever loads on the device, not after something has already gone wrong.
Filtering, malware blocking and content control explained without jargon
Three things happen at once when someone clicks a link. Filtering checks the destination against known-bad and known-good site lists. Malware blocking scans the page content itself for malicious code, even on sites that aren’t yet flagged as dangerous. Content control lets you set rules, such as blocking file-sharing sites on a work network, without anyone manually managing a blocklist by hand.
None of this depends on staff making the right call in the moment. That’s the practical difference from simply training people to spot suspicious links. A well-run awareness programme still helps, but it relies on someone noticing something is wrong before they click. A secure web gateway decides for them, at the network level, whether they notice anything or not.
Do you already have some of this if you’re on Microsoft 365 or Google Workspace?
Yes, partially. Both platforms scan links inside email and Office documents, but neither one protects general web browsing outside those apps. Microsoft’s Safe Links checks URLs clicked inside email, Word, Excel, PowerPoint and Teams, and this protection has expanded into lower-tier Microsoft 365 plans during 2026, where it used to require a higher tier or a paid add-on. Google Workspace scans links and attachments in Gmail with similar baseline protection.
What Microsoft 365 and Google Workspace’s built-in protections cover, and where they stop
Both stop at the edge of email and productivity apps. Neither checks a link someone pastes directly into a browser, clicks in a WhatsApp message, or follows from a personal social media account while connected to the company network. A secure web gateway closes that gap because it inspects traffic at the network level rather than only inside specific applications.
How do you know if your business needs a dedicated one?
You need a secure web gateway once staff routinely browse the open web for research, client sites, or general work, and your current protection stops at email. The businesses that skip this step are usually the ones who assume Microsoft or Google’s built-in scanning covers everything, and only find out otherwise after an incident.
Warning signs it’s time to add one, and who typically needs this at 70-150 user scale
- Staff regularly browse unfamiliar client or supplier websites as part of their job
- The business handles client data and needs to evidence web-layer controls for Cyber Essentials or a client security questionnaire
- Remote or hybrid staff connect from home networks with no equivalent office-level protection
- IT has no visibility into what websites staff are actually visiting day to day
For an agency in the 70 to 150 person range, this combination is common rather than exceptional. Client-facing teams researching prospects and suppliers, a mix of office and remote work, and growing compliance pressure from client due diligence all point in the same direction.
It’s also worth being honest about who doesn’t need one yet. A small, fully office-based team with no client data obligations and tightly controlled browsing habits may genuinely be well served by email-layer protection alone for now. The point isn’t to add every security layer available; it’s to match the layer to the actual risk your team creates by being online all day.
What this means for your business
A secure web gateway is not a replacement for Microsoft 365 or Google Workspace’s built-in protections; it is the layer that covers what those platforms were never designed to reach. In Dr Logic’s experience, most Mac-first businesses at this size already have solid email security and are underprotected everywhere else the browser goes.
Not sure if your email is doing more than it actually is?
Most businesses assume Microsoft 365 or Google Workspace already covers their web browsing. Talk to Dr Logic and find out what’s actually protected, and what isn’t.
Related articles
- Securing Microsoft 365 and Google Workspace for Hybrid Teams in 2026
- The MFA and Email Security Shortlist for Microsoft 365 and Google Workspace
- Cyber Essentials Has Changed: the April 2026 Danzell Update
FAQs
Does Microsoft 365 already include a secure web gateway?
No. Microsoft 365’s Safe Links protection scans URLs inside email, Office documents, and Teams, but it does not inspect general web browsing outside those apps. A secure web gateway covers browsing traffic that Safe Links was never designed to reach.
Does Google Workspace protect us from malicious websites?
Partially. Google Workspace scans links and attachments in Gmail, but this protection stops at email. It does not filter or inspect websites staff visit directly through a browser.
Is a secure web gateway only for large enterprises?
No. Any business where staff regularly browse the open web, handle client data, or work remotely benefits from this layer, and it’s increasingly expected as evidence of web-layer control in client security reviews and Cyber Essentials assessments.
What's the difference between a secure web gateway and antivirus?
Antivirus scans files already on a device for known malware signatures. A secure web gateway inspects web traffic before a page loads, catching threats like phishing sites and malicious scripts that antivirus alone would miss.
How do I know which tier of protection my business needs?
It depends on team size, how much staff rely on browsing for client and research work, and your compliance obligations. Our companion article breaks down which tier suits a 70 to 150 person agency.
