If your company uses Cisco Umbrella, it's worth putting a date on your IT planning: January 31, 2027.That's when Cisco will end new sales of certain Umbrella SIG and DNS offerings, as announced in September 2026.
The service will not be shut down on that date. There is a transition schedule for the affected products, with subsequent renewal and support deadlines. For those who rely on Umbrella for network protection, now is a good time to review their contract and assess their next steps.
One possibility is to follow the migration proposed by Cisco itself to Secure Access. Another is to take advantage of the contract review to compare solutions specialized in DNS security. The choice depends on the resources the company actually uses and the work required to maintain them.
Will Cisco Umbrella DNS be discontinued in 2027?
There will be no general shutdown of Umbrella in January 2027. Cisco's official statement , published on September 1, 2026 and updated on September 2, establishes end-of-sale and end-of-life dates for specific offers and product codes.
| March | Date | What does it mean for the customer? |
|---|---|---|
| Official announcement | 01/09/2026 | Announcement of the calendar |
| End of new sales | 31/01/2027 | Last day to purchase new subscriptions for eligible products |
| Closure of new software improvements | 31/01/2027 | End of new enhancements planned under this milestone; bug fixes and maintenance may continue as per Cisco support conditions |
| Limit for renewing or expanding existing subscriptions | 31/01/2028 | Timeframe for renewals and permitted changes to covered contracts |
| Last support date | 31/01/2029 | Expected termination of support for the affected products, in accordance with contractual rights |
These deadlines pertain to the products identified in bulletin EOL15975. It lists the product codes (part numbers) involved and the indicated migration options. Some codes appear without a replacement specified in the bulletin itself.
If you already use Umbrella, first check which SKU is listed in your contract, when your subscription expires, and what renewal conditions apply. The solution's commercial name alone is not enough to conclude that your environment will be affected in the same way.
What changes with Cisco Secure Access?
Cisco is directing customers toward Cisco Secure Access, which brings together Security Service Edge (SSE) capabilities. For DNS protection, the company is also presenting Cisco Secure Access – DNS Defense as an evolutionary path.
This distinction deserves attention. Some companies use Umbrella primarily to block malicious domains, filter website categories, and enforce browsing policies. Others rely on additional features such as Secure Web Gateway (SWG), web inspection, data loss prevention (DLP), and access to private applications.
In the first case, it may make sense to compare platforms specialized in DNS. In the second, it will be necessary to assess how the other security controls will be addressed, whether by an integrated solution or by complementary tools.
Cisco itself provides a guide for upgrading Umbrella DNS to Secure Access – DNS Defense, with instructions for preparing the environment and conducting the transition.
What options are available for those who use Umbrella?
Migrate to Cisco Secure Access – DNS Defense
This is an option to consider when the company intends to remain within the Cisco ecosystem and the target product meets its requirements. The documented procedure involves verifying prerequisites, preparing accounts, copying configurations, and transferring traffic gradually.
Even while remaining with the vendor, the migration needs to be tested. Cisco states that Umbrella's DNS policies can be converted into access rules in the new environment. After conversion, it's important to verify the order and behavior of these rules.
The official migration flow also describes an irreversible step in closing down the old organization. Therefore, the new configuration must be validated before the process is completed.
Compare other DNS security solutions
If Umbrella's primary use is to protect DNS queries and control browsing, the company can use this period to evaluate other providers.
In addition to technical features, factors such as ease of policy creation, installation process, report quality, support channels, and subscription cost are also taken into account. For Brazilian teams, having support in Portuguese and paying in reais can also make a difference.
The assessment should begin with the current environment: which networks are protected, how many branches exist, how remote devices work, and which integrations and exceptions are essential. This avoids switching solutions and then discovering that an important rule was left out.
Reassessing a broader SSE architecture
If the company uses web proxy, DLP, ZTNA, and other components besides DNS, the comparison needs to cover that entire architecture.
A specialized DNS service does not automatically replicate the features of an SSE suite. In this scenario, it is possible to continue with an integrated platform or combine different solutions, as long as each need is met and the operation can manage the whole package.
What should you consider before choosing an alternative?
Start by looking at the features your organization uses today and the problems you want to solve. An extensive list of features isn't very helpful if it doesn't show which ones will be needed on a daily basis.
| Criterion | What to check |
|---|---|
| Protection | Is the need for DNS filtering, or does it also involve SWG, DLP, and private access? |
| Remote users | Which devices can be configured with DoH/DoT? When is it worthwhile to use an agent to enforce policy enforcement and individual management? |
| Policies | Is it possible to apply blocks, permissions, and exceptions by network, location, device, group, or user? |
| Logs and reports | What data is made available for investigating access and blockages? For how long? |
| Branch management and MSPs | How can I manage multiple units or clients without repeating settings? |
| Support in Brazil | Is there support in Portuguese? Is it possible to speak with technical analysts and get help with real deployment and usage issues? |
| Service channels and conditions | Is support provided via chat, email, phone, or meeting? What are the hours, priorities, and contractual conditions? |
| Currency and payment | Is the payment made in Brazilian Reais? What payment methods, taxes, and conditions are included in the proposal? |
| Migration and reversal | How do I create a pilot program, and how do I restore the previous configuration if there are problems? |
To delve deeper into the technical analysis, see what to evaluate in a Protective DNS solution, with criteria regarding policies, devices, query logs, and governance.
How does Lumiun DNS fit into this comparison?
Lumiun Lumiun DNS is aimed at businesses, schools, and managed service providers (MSPs). It operates at the DNS layer to help block malicious domains, phishing, and other threats, as well as enabling browsing policies and centralized management of networks and devices.
For a company that primarily uses Umbrella as a DNS filter, it's worth testing features such as:
- Blocking by categories, custom domain lists, and exceptions, according to the plan.
- Policies for different networks, locations, groups, and devices.
- DNS query and block reports, with advanced integration and export options on compatible plans.
- DNS protection outside the corporate network through DoH/DoT configuration on compatible computers and mobile devices, without the need to install the ActiveNet Agent.
- ActiveNet Agent for Windows is offered as an additional option, with simplified deployment, individual device identification, more granular policies and reports, and controls to make unauthorized changes more difficult.
- Policies and reports by user or group in the Advanced plan, using ActiveNet Agent 1.7.0 or higher for Windows. See how user identification works.
Configuration methods vary depending on the operating system, version, and device. The ActiveNet Agent, in turn, is intended for Windows computers. It is also important to remember that Lumiun DNS alone does not replace a complete SSE suite nor does it offer automatic equivalence to all Umbrella SIG, SWG, DLP, or ZTNA components.
Off-network protection: with or without ActiveNet
Lumiun Lumiun DNS can protect browsing even when the device is outside the company network, such as when working from home or traveling. One way to do this is to configure the device's own DNS to use Lumiun DNS via DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT), depending on compatibility. This option works in different scenarios on Windows, macOS, iPhone, Android, and other devices, without requiring the ActiveNet Agent.
When queries are routed to Lumiun DNS, the policies configured for the corresponding Location can be applied. Protection depends on the system keeping the configuration active; procedures vary depending on the device and operating system version.
For Windows computers, the ActiveNet Agent offers a more practical deployment and management alternative. The agent identifies the device individually in the dashboard, allows for more granular policies and reports, and helps maintain the organization's DNS usage even on other networks. It can also provide protection against uninstallation, service interruption, and unauthorized changes, depending on the configuration adopted.
Thus, ActiveNet adds control and ease of management, but it is not mandatory to use DNS protection outside the network. The specific feature of automatic user identification, however, requires ActiveNet 1.7.0 or higher for Windows and is available in the Advanced plan.
Customer service in Portuguese and billing in Brazilian Reais
For those who manage IT infrastructure in Brazil, product features are only part of the evaluation. The quality of service and the contracting process also influence the team's performance.
Lumiun Lumiun DNS offers support in Portuguese (PT-BR), provided by human analysts with technical knowledge of the platform. The team assists with installation, network and policy configuration, panel usage, and troubleshooting difficulties encountered during operation. Contact can be made through channels such as chat, email, and WhatsApp, subject to the service conditions of each plan. Information is available on the features page Lumiun DNS.
There is also an administrative advantage for Brazilian customers: plans are presented and charged in Brazilian reais (BRL), with payment options via credit card and bank slip. This facilitates the comparison of offers and budget planning. Check the current prices and conditions on the plans and pricing page.
These points should be considered when comparing the Cisco offer that was actually contracted. The language, support level, and billing currency of a Cisco offer may depend on the contract and the business partner; it is incorrect to assume that every Cisco customer receives support only in English or pays in dollars.
Comparing the requirements in practice
| Aspect | What to check in Umbrella / Secure Access | What to evaluate in Lumiun DNS |
|---|---|---|
| Scope of the solution | Which DNS, GIS, or SSE services are included in the subscription? | DNS security and browsing filtering, without pretending to replace an entire SSE suite |
| Policies and reports | What rules and data does the current environment use? | DNS filters, lists, policies, and reports, as per plan |
| Off-grid protection | What configuration methods and agents are available? | DoH/DoT configuration on compatible devices (Windows, macOS, iOS, Android, and others); optional ActiveNet for granular management on Windows |
| User-based management | How does the current environment identify people and enforce rules? | Advanced feature with ActiveNet Agent 1.7.0+ for Windows |
| Support language | What services in Portuguese are stipulated in the contract and with the partner? | Technical support in Portuguese (PT-BR) |
| Assistance with deployment and use | Which channels answer questions about installation and configuration? | Human analysts assist with installation, configuration, and troubleshooting |
| Currency and trading conditions | In which currency will the offer be accepted and what conditions apply? | Plans for Brazil in Brazilian Reais (BRL), with credit card and bank slip payment options |
| Pre-hiring assessment | Is it possible to test the offer, and under what conditions? | 14-day free trial |
The comparison needs to be made considering the contracted Cisco plan, the chosen Lumiun DNS plan, and the organization's actual needs.
Want to analyze the two platforms in more detail? Access the comparison page between Lumiun DNS and Cisco Umbrella and check out the features and conditions that make sense for your environment.
How can you test an alternative without affecting the entire operation?
A proof of concept can begin with a network, a few machines, or two units with different profiles. The goal is to discover, in a controlled environment, whether the policies and protections meet the needs before scaling up the deployment.
- Take inventory. Record Cisco SKUs, protected networks, remote users, current policies, exceptions, and log export needs.
- Choose a pilot environment. Select representative computers or units that allow you to monitor any potential impacts.
- Recreate the most important rules. Configure the filters, allowlists, blocks, and exceptions used daily.
- Validate the operation. Test DNS resolution, anticipated blocks, access to work systems, reports, and devices outside the network, using both DoH/DoT and ActiveNet, depending on the scenario.
- Investigate what isn't working. Record false positives and discrepancies. When necessary, ask support for help analyzing the configuration and results.
- Prepare for the rollback. Document how to revert to the previous settings and only expand the pilot after validating the defined criteria.
A company with a single unit and an MSP that manages dozens of clients will have distinct needs. The pilot program should reflect this difference, including in policy management and support efforts.
Frequently Asked Questions
Will Cisco Umbrella be shut down in January 2027?
No. The date of January 31, 2027 marks the end of new sales for products included in bulletin EOL15975. The announcement provides for other deadlines for renewals and support of existing subscriptions.
Until when can existing customers renew?
The announced deadline for renewing or extending subscriptions to the affected products is January 31, 2028, subject to Cisco's terms and conditions and the terms of the contract.
Will Cisco Umbrella support end in 2029?
For the products covered by this announcement, the last expected support date is January 31, 2029, in accordance with applicable subscription and support rights.
Is migrating to Cisco Secure Access mandatory?
Cisco presents Secure Access and DNS Defense as paths for evolution. The client company can also evaluate other vendors or review its security architecture, considering the capabilities and contractual obligations of its environment.
Does Lumiun DNS replace all the features of Cisco Umbrella SIG?
No. Lumiun DNS specializes in DNS security and browsing filtering. Features such as SWG, DLP, and ZTNA need to be evaluated separately.
Do I need to install ActiveNet to use Lumiun DNS outside of the company?
No. It is possible to configure DoH or DoT on compatible devices to use Lumiun DNS on other networks. ActiveNet is an additional option for Windows, recommended when the company needs to identify devices individually, apply more granular policies, and strengthen control over DNS settings. Installation and available methods depend on the device and operating system.
Does Lumiun DNS offer technical support in Portuguese?
Yes. Lumiun offers support with human analysts in Portuguese, including for questions about installation, configuration, policies, and service usage. The channels and conditions depend on the service plan contracted.
Is Lumiun DNS payment in Brazilian Reais?
Yes. Plans for Brazilian customers are presented in Brazilian reais (BRL), with credit card and bank slip payment options. Current prices and conditions are available on the pricing page.
Can I test Lumiun DNS before subscribing?
Yes. Lumiun DNS offers a 14-day free trial. This period can be used to validate blocks, exceptions, reports, and the coverage needed for your environment.
Plan the evaluation before the next renewal
Those who use the products mentioned in the Cisco announcement have specific dates to check. Start with the contract SKU and what your team actually uses, from DNS policies to broader security features.
If your primary need is to protect DNS queries and control browsing, you can compare Lumiun DNS with Cisco Umbrella and try Lumiun DNS for free for 14 days. For projects with multiple branches, MSPs, or more complex integrations, confirm the technical and business requirements before defining the migration.
