--- title: "Is web gateway technology used to monitor and filter malicious or suspicious URLs?" url: https://insuranceposture.com/questions/network-and-logging/web-gateway-technology-monitor-filter-malicious-suspicious-urls category: "Network, logging and monitoring" canonical_key: q_net_015 evidence_state: partial updated: 2026-08-24 --- # Is web gateway technology used to monitor and filter malicious or suspicious URLs? URL: https://insuranceposture.com/questions/network-and-logging/web-gateway-technology-monitor-filter-malicious-suspicious-urls Section: Network, logging and monitoring Evidence state: Partly verifiable from your tenant Web filtering inspects what DNS filtering only blocks by name, and it is where control over unsanctioned cloud services lives. ## What the carrier is actually asking The carrier is asking whether web traffic is inspected and filtered for malicious and suspicious destinations. It covers category blocking, malicious URL detection, and increasingly control over which cloud services users can reach. ## Why it is underwritten Web browsing delivers malware, hosts phishing pages, and provides the exfiltration route for data leaving through personal cloud storage. Filtering reduces all three, and the associated telemetry is useful during an investigation. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Web gateways are third-party or endpoint-delivered, so mostly attested. The Microsoft components are measurable. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Microsoft 365 | Defender for Cloud Apps and its integration with endpoint tooling | Cloud application discovery and the ability to block unsanctioned services | | Microsoft 365 | Network protection and web content filtering on endpoints | Endpoint-delivered filtering that follows the device off the corporate network | | Microsoft 365 | Safe Links coverage for links in mail and documents | Time-of-click evaluation, which overlaps with web filtering for the mail-delivered case | | Gateway vendor | Categories blocked and inspection configuration | Blocking of malicious and high-risk categories, with an exception path. Attested | | Coverage | Whether filtering applies to remote devices | Endpoint-based or cloud-delivered filtering rather than an on-network appliance only | **Cloud application control is the modern half** The classic use of a web gateway was blocking categories of website. The valuable use now is discovering and controlling which cloud services hold your data, which is where unsanctioned file sharing and data exfiltration actually happen. ## What a defensible yes requires - Filtering covers malicious and high-risk categories and follows the device off-network. - Unsanctioned cloud services are discovered and can be blocked. - Filtering coexists with mail link protection rather than duplicating gaps. - An exception path exists so blocks do not get lifted wholesale. - Blocked events are logged and reviewed as intrusion indicators. ## How this answer goes wrong An appliance filters traffic on the corporate network for a workforce that mostly works elsewhere. Or filtering is deployed and inspection is disabled for most traffic because of certificate issues, leaving category blocking based on domain alone. ## If this answer turns out to be wrong Remote access exposure and log retention are what a forensic report describes first, which makes them the answers most often revisited after a loss. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Is this needed alongside DNS filtering? They overlap and are not identical. DNS filtering is broader and coarser; web filtering inspects and can distinguish parts of a site. Most carriers accept either as a reasonable answer. ### Does encrypted traffic limit this? Without inspection, filtering falls back to domain-level decisions. Inspection has its own operational and privacy considerations, which is why many organisations rely more on endpoint and DNS layers. ### What about remote workers? Endpoint-delivered or cloud-delivered filtering is the only design that covers them. Appliance-based filtering does not. ### Does this help with data loss? Yes, by controlling uploads to unsanctioned services. It pairs directly with the data loss prevention answer. ## Related questions - [Are protective DNS or DNS filtering services in use?](https://insuranceposture.com/questions/network-and-logging/protective-dns-dns-filtering-services) - [Does the Applicant employ Data Loss Prevention (DLP)?](https://insuranceposture.com/questions/data-handling/applicant-employ-data-loss-prevention) - [Is inbound email security (SEG) deployed with sandbox attachment detonation?](https://insuranceposture.com/questions/email-security/inbound-email-security-deployed-sandbox-attachment-detonation) - [Are unnecessary or unauthorized browser extensions blocked?](https://insuranceposture.com/questions/endpoint-and-patching/unnecessary-unauthorized-browser-extensions-blocked) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.