- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Forcepoint Web Security
Your data rules stop at the browser. Every upload to an unsanctioned site skips them — Forcepoint Web Security decrypts web traffic and applies your Forcepoint DLP rules to every upload, enforced on the laptop or in Forcepoint’s cloud, with edge sites in five Indian cities.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Forcepoint platform family
This page covers Forcepoint Web Security — the secure web gateway on Forcepoint Data Security Cloud. The rest:
Quick facts
30-second orientation- Product
- Proxy-based secure web gateway with inline DLP, run from Forcepoint Data Security Cloud
- Maker
- Forcepoint, Austin, Texas; CEO Ryan Windham; India offices in Thane and Bangalore
- Former name
- Forcepoint ONE SWG; Forcepoint ONE became Data Security Cloud in April 2025
- Price
- $55 per user a year for Web Security Edition on AWS Marketplace; 500-user minimum
- Layer
- Proxy only, with full TLS inspection; no DNS-layer filter is documented for this SKU
- Steering
- GRE or IPsec tunnels or a PAC file from sites; the SmartEdge agent on Windows and macOS
- CASB
- Inline control of unlimited cloud apps included; API scanning is Forcepoint Cloud App Security
- India edge
- Mumbai cloud region; local edge data centres in Bangalore, Chennai, Hyderabad, Mumbai and New Delhi
- Logs
- Web and proxy logs kept 30 days in Forcepoint’s US East data centre unless you export them
- In India via
- TechBag — sizing against the 500-user floor, INR quote with GST, pilot and log-export plan
Understand secure web gateways before you buy one
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is a data-centric web gateway?
A proxy that decrypts web traffic and applies the same DLP rules your endpoints and email already use.
A web filter and a separate DLP proxy vs one data-aware gateway — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | A URL filter plus a separate DLP proxy | Forcepoint Web Security |
|---|---|---|
| Data leaving by browser | Invisible unless a separate DLP proxy is chained in | Checked inline with Forcepoint DLP classifiers |
| Laptops off the network | VPN back to the office, or no filtering at all | SmartEdge agent enforces policy on the device |
| Personal AI accounts | Block the whole AI site, or allow every account | Corporate tenant allowed, personal tenant blocked |
| Branch offices | A web appliance in every site to patch | GRE, IPsec or PAC file to the cloud proxy |
| Log evidence | Appliance logs held wherever the box sits | 30 days in US East; export for 180 days |
| What it is NOT | — | A DNS filter, an API CASB, or a small-office product |
The cheapest test is monitor mode: send one office and fifty agent laptops through it for two weeks and read what it would have blocked.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Cloud SWG
Branch sites send web traffic over GRE or IPsec tunnels, or through a PAC file, to Forcepoint’s cloud proxy, which decrypts, scans and applies policy before forwarding it.
SmartEdge
On Windows 10 and 11 and macOS the agent enforces policy locally and calls the cloud only for unseen URLs or files to scan; users cannot remove it without an admin.
Console
One console sets web, cloud-app and private-app policy and reuses DLP patterns across them; web and proxy logs stay 30 days in Forcepoint’s US East data centre.
Edge
The datasheet cites over 300 PoPs on AWS; India gets a Mumbai region and five edge cities, and virtual PoPs localise content for 110 countries.
A cloud proxy for offices and an on-device agent for laptops — one DLP-aware policy, with Indian edge sites.
Nine capabilities. Enforce, inspect, control.
Forcepoint Web Security is a proxy gateway that treats every web upload as a DLP decision.
Policy on the laptop
The SmartEdge agent enforces web policy on Windows and macOS wherever the user is, and the user cannot stop or uninstall it.
No agent for the office
Branches reach the cloud proxy over GRE or IPsec tunnels, or a PAC file, so guests and unmanaged devices are filtered too.
Phones and tablets
Forcepoint Mobile, the client for Web Security, brings the same cloud policy to managed iOS and Android devices.
Decrypt, with privacy bypass
HTTPS is decrypted for inspection, while connection rules can let banking or health sites pass through without decryption.
Data rules on every upload
Uploads, web forms and cloud storage are checked inline with the same classifiers Forcepoint DLP applies to endpoints and email.
Scan, or isolate
Files are scanned by CrowdStrike or Bitdefender engines; risky sites can open in remote browser isolation, an add-on.
Corporate AI yes, personal no
Tenant-based rules let the company’s ChatGPT or Claude account through while blocking a personal account on the same site.
Rules below the domain
Custom categories accept full directory paths, so one section of a large site can be blocked while the rest stays open.
Time limits, not just blocks
Daily browsing quotas and time-of-day rules allow social or shopping sites in breaks instead of banning them outright.
Watch Forcepoint Web Security in action
Blocking personal AI tenants while allowing the corporate one, protecting iOS and Android devices, and setting browsing quotas.
Block Personal AI Tenants | Forcepoint Secure Web Gateway (SWG) Demo
A corporate Claude tenant is allowed while a personal account on the same service is blocked in the same session.
Protect Mobile Devices with Forcepoint Web Security | Demo
Mobile profiles for iOS and Android, then an AI upload, a phishing link and a malicious QR code stopped on an iPhone.
How to Set Web Browsing Quotas with Forcepoint Web Security | Demo
Time-of-day rules and per-category browsing quotas, configured in Data Security Cloud and reset each midnight.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Web filters see destinations. Forcepoint inspects the data you send to them.
Here’s what genuinely sets it apart — and exactly where it stops.
The web gateway that is really a DLP channel
Forcepoint built its name on data loss prevention, and the gateway shows it. Uploads, web forms and cloud storage are checked inline with the classifiers Forcepoint DLP uses on endpoints and email, so one data policy covers the browser too. Forrester’s Q1 2024 SSE Wave scored the platform 4.6 of 5 on data protection, tied for the top mark.
Enforcement on the laptop, not a round trip
The SmartEdge agent applies policy on the device and asks the cloud only about URLs it has not seen recently and files that need scanning. Ordinary browsing goes straight to the site, which Forcepoint says keeps throughput near the line rate. Offices without agents tunnel to the cloud proxy instead, so guests are covered as well.
Indian edge sites, with a log caveat
Forcepoint lists a Mumbai cloud region and local edge data centres in Bangalore, Chennai, Hyderabad, Mumbai and New Delhi to cut latency for Indian users. Its retention policy, though, keeps web and proxy logs for 30 days in a US East data centre. CERT-In expects 180 days of logs, so plan a SIEM export from day one.
Where it stops
It is a proxy with no DNS-layer tier, so there is no cheap floor for unmanaged devices on your resolver. The agent runs only on Windows and macOS. API scanning of data already in SaaS needs Cloud App Security, a separate licence. The Marketplace listing sets a 500-user minimum, which rules out small offices. Forcepoint documents no handling of DNS-over-HTTPS.
The numbers behind the platform
What your Forcepoint Web Security rollout looks like
Count seats and pick steering
Confirm you clear the 500-user floor, then split users into agent laptops, tunnelled offices and mobile devices.
Plan certificates and bypasses
List apps that pin certificates and the banking or health sites you will not decrypt, before any policy goes live.
Pilot in monitor mode
Put one office and fifty laptops on the gateway, log without blocking, and review what would have been stopped.
Turn on DLP and tenant rules
Apply your Forcepoint DLP policies to uploads, allow the corporate AI tenant, and block personal accounts on it.
Wire logs to the SIEM
Export web logs before the 30-day window closes, so CERT-In’s 180 days and audit requests are covered.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We already ran Forcepoint DLP, so the web channel picked up our Aadhaar and PAN rules without rewriting a single policy.”
“Allowing the company ChatGPT tenant while blocking personal logins settled a six-month argument with our legal team.”
“The agent on laptops felt quicker than our old cloud proxy, because routine browsing no longer took a detour abroad.”
“Thirty days of logs was not enough for our auditors. We stream everything to the SIEM now; set that up before go-live.”
“Quotas worked better than blocks. Staff get twenty minutes of shopping sites at lunch and complaints stopped.”
“Our 300-seat branch office fell under the 500-user minimum, so the quote took a custom package and extra weeks.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the secure web gateway market — tap any vendor to see why it sits where it does.
TechBag Secure Web & DNS Grid
Execution strength vs product vision — the classic market map, minus the paywall.
$55 per user a year on AWS Marketplace; 500-user minimum.
Deployment Reach × Data-Protection Depth
The grid nobody publishes — how many ways traffic can reach the control (sites, agents, mobile, DNS) vs how deeply it protects data on the web.
Tunnels, PAC, agent, mobile, on-prem; inline DLP and tenant control.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Forcepoint Web Security vs the secure web gateway field
Against Zscaler Internet Access, Netskope Next Gen SWG, Cisco Umbrella, Cloudflare One Gateway and FortiSASE — on layer, steering, TLS, CASB, price, minimums, India and logs.
| Dimension | Forcepoint Web Security | Zscaler Internet Access | Netskope Next Gen SWG | Cisco Umbrella | Cloudflare One Gateway | FortiSASE |
|---|---|---|---|---|---|---|
| What it is | Data-centric cloud SWG | Inline cloud proxy | Instance-aware proxy | DNS layer, then SIG | Zero Trust web gateway | SASE for Fortinet shops |
| Enforcement layer | Proxy only | Proxy only | Proxy only | DNS + proxy | DNS + HTTP + network | DNS + proxy |
| Traffic steering | Tunnels, PAC or agent | Client or tunnels | Client or tunnels | Resolver change first | WARP or tunnels | FortiClient or FortiGate |
| Off-network devices | Windows, macOS, mobile | Roaming agent | Roaming agent | Roaming module | WARP client | FortiClient |
| TLS inspection | Full, agent certificates | Full | Full | Selective | Full, on the $7 tier | Full |
| CASB mode | Inline; API extra | Inline + API | Inline + API | API-based | Inline + API | Inline |
| Data protection (DLP) | Inline DLP built in | Edition or add-on | In Netskope One | SIG tiers only | Deeper at Enterprise | Check the bundle |
| Pricing model | Per user, 12 months | Per user, by edition | Platform, per user | Per user, four tiers | Free, then per user | Per user, by bundle |
| Published entry price | $55/user/yr | ~$6–12/user/mo | Not published | $2.25–6.50/user/mo | Free, then $7/user/mo | Quote; UK list from £78 |
| Included vs add-on | RBI and API CASB extra | Data features extra | Modules of a platform | Proxy at SIG only | Depth at Enterprise | Rises with the tier |
| Smallest estate | 500-user minimum | Not published | Not published | No floor printed | Free to 50 users | From 50 users |
| India PoPs | Mumbai + 5 edge cities | Four Indian cities | Eight Indian DCs | Mumbai and Chennai | Six cities named | Not documented |
| Log retention | 30 days, US East | 180 days | Ask in writing | 30-day search | 30 days for HTTP | 30 days at most |
| Best fit | DLP-led web control | Deepest inspection | Per-tenant SaaS control | A cheap DNS floor | Public price, wide India | FortiGate estates |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Forcepoint Web Security if…
- ✓You already run Forcepoint DLP and want web uploads judged by the same classifiers and incident console
- ✓Roaming Windows and Mac laptops need enforcement on the device, without every request detouring through a cloud
- ✓You need to allow the corporate tenant of an AI or SaaS app while blocking personal accounts on it
Compare alternatives if…
- ✓You want a cheap DNS-layer floor first — Cisco Umbrella and Cloudflare filter at the resolver
- ✓You need 180 days of logs without an export pipeline — Zscaler keeps logs that long by default
- ✓You have fewer than 500 users — Cloudflare is free to 50 and Fortinet’s band starts at 50
Do not expect…
- ✓DNS filtering, or any documented handling of DNS-over-HTTPS bypass
- ✓API scanning of data at rest without buying Cloud App Security
- ✓Logs stored in India by default — Forcepoint keeps them 30 days in US East
Forcepoint Web Security is one of 44 secure web & DNS products TechBag carries. The Secure Web & DNS guide narrows them to a shortlist and shows the reasoning. →
What does split web and data policy cost you?
Drag the sliders (users behind the gateway; admin-hour cost). Estimates model administrator time spent on unblock requests, separate web and DLP policies and log pulls at an assumed 1.5 hours per user a year, with 70% of it removed by one data-aware gateway. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Published: Forcepoint’s AWS Marketplace listing suggests $55 per user a year for Web Security Edition on a 12-month term, with a 500-user minimum and add-ons such as selective browser isolation ($32), a dedicated egress IP ($75) and 12-month reporting ($2) per user. forcepoint.com prints no price. TechBag checks the seat floor, then quotes in INR with GST.
Web Security Edition
Best for estates of 500 users or more
- $55 per user a year on AWS Marketplace
- Cloud SWG plus inline control of unlimited cloud apps
- 500-user minimum; smaller estates get custom packages
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Add-ons and the wider platform
Best for DLP-led, regulated estates
- Selective RBI $32, dedicated IP $75 per user
- API CASB via Forcepoint Cloud App Security
- Enterprise terms and INR quotes on request
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Do you have 500 or more users to license? Below that, ask Forcepoint for a custom package before you compare prices.
Which users get the SmartEdge agent, which offices use GRE, IPsec or a PAC file, and which phones need Forcepoint Mobile?
Can you push a certificate to PAC-file sites, and which pinned apps and private sites must bypass decryption?
What covers devices with no agent and no tunnel? This gateway has no DNS layer, so decide on one separately.
Is inline control enough, or do you need API scanning of files already in SaaS, which is a separate licence?
Where will logs live after 30 days in US East? CERT-In asks for 180 days, and its FAQ Q37 names proxy-server logs.
Does SEBI CSCRF apply? Guidelines 4.b and 4.c name proxy servers and web filters; map each to a policy here.
Running the on-prem line? CVE-2025-2274, a stored XSS through 8.5.6, is fixed in 8.5.7; confirm your version.
Questions buyers ask
Ready to evaluate Forcepoint Web Security?
Model your seats and admin time first, or let a TechBag advisor scope a monitor-mode pilot with one office and fifty laptops.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.