Defending the edge: Cisco Secure Access for a connected world

Oh, Welcome everybody and thank you for joining today's Secure Access webinar. The title of the webinar today is called.00:00Defending the edge secure access for a connected world. This is typically a webinar that we run as part of the expert insights series and the the audience that we've invited to the call today is our English speaking APJC customer.00:19But going forward we'll be extending that.00:39The team that we, that you're seeing in front of you today, we're all customer success specialists. The three very technical people who are subject matter experts on these topics that are joining us today. And let me jump into our agenda is.00:42Will be taking us through the 1st topic, which is a deep dive into AR access, the AR supply chain and risk management. 2nd topic is Neeraj Panchal.01:03And he'll be speaking to us about it's not sorry which well you're gonna be speaking to us about digital instance insights experience and then ending off with Neeraj Chel and that's he'll be speaking to us about the secure web gateway using secure internet access. I do.01:17I want to make mention of the fact that we've got the Webex Q and A panel available for your questions cause that helps us get actual responses to you and we can capture some of those questions and responses instead of the normal chat panel. Anyway.01:37I'll stop my sharing and hand it over to Anku for the 1st part of our webinar. Thanks. Yeah Anku we got you there. Yep.01:57So hello everyone, thank you for joining us today. We are excited to have you here for our 1st session on AI access. My name is and I'm customer success specialist here at Cisco.02:12Today I'm going to walk you through how you can safely embrace AI in your workplace, manage the risk and ensure your organizations stay protected. Apart from our deep dive into AI access today, we have two other important topics to cover as Jay already mentioned.02:30Secure access experience inside and secure web gateway.02:49So my colleague Neeraj and will be walking you through those sessions right after we wrap up our AI access discussion. We have a lot of great information to cover, so let's get started.02:54Before we dive in, let's take a quick look at our agenda for today AI access session. So we will start by defining what we meant by AI access and why it has become such a critical focus for security top teams.03:11Next, we will move into an overview of our AI access products, showing you how it fits into the border security ecosystem, then we will discuss the outcomes and discovery process to help you understand how to apply this in your own environment. After that, I will.03:27Walk you through a demo of the platform so you can see these features in action. Finally.03:47We will wrap up with some time for your questions ok when when we talk about securing AI, we really need to look at.03:54Look at it through two two different angles, how we consume AI as users and how we build AI as developers. Let's break this down. 1st, let's look at using AI apps. Many of us are using AI tools daily.04:10To boost productivity. However, this introduces risks regarding data privacy and shadow AI. With Cisco Secure Access, we provide a unified way to control how your employees interact with these tools.04:29We ensure that sensitivity, sensitive corporate data doesn't link into public AI models giving you visibility into which apps are being used and enforcing security policies so that your team can innovate safely without compromising the organization's integrity.04:44So next we move to developing AI applications. If your organization is building its own AI solutions, the security requirements shift, you are not just protecting the user, you are protecting the model, the training data.05:02And the infrastructure. Developing secure AI means ensuring that your pipeline are protected from vulnerabilities, that your data sets are sanitized and that the resulting application are resilient against adversary attacks. Cisco's approach ensures that security is integrated into the development.05:19Life cycle.05:39Keeping your property more safe from the ground up, innovate safely without compromising the organization's integrity. Now, if you look at the data, it is clear that AI adoption is happening at an incredibly.05:40In fact, it is moving even faster than the adoption of cloud technology did.06:01According to the Gartner by 2026, more than 80 % of enterprises will have used Gen AI apps or develop their own Gen AI applications. But here is the catch, and it is a significant one. Even though almost everyone is jumping on board.06:07Our 2025 Cisco AI readiness index survey shows that only three out of ten companies have comp comprehensive AI policies and protocols in place. If you look at this on the on the screen.06:27You can see that this isn't just happening in tech, it is happening across every sector from retail and communica telecommunications to financial services and healthcares. The growth we have seen just between October 2023 and June 2024 is massive. So this tells us.06:42That while the technology is spreading rapidly, the governance and the security side is lagging behind. And we are at the point where the tools are.07:02Outrunning the policies and that is exactly the gap we need to bridge to stay both innovative and secure. So, what happens when we did not manage this risk?07:13The reality is that unmanaged AI applications and access can lead to serious consequences from financial and legal damage to losing your intellectual property or suffering a measure blow to your reputation.07:30The example on the screen should show you that this isn't just theoretical. We have seen companies face everything from prompt injection attack and sensitive data lakes to chatbots making unauthorized.07:46Legally binding promises that cost them money. It's clear that without the right guardrails, the tools meant to help us can quickly become a business liability. So this is exactly why a managed secure approach to AI is NO longer optional, it is necessary.08:01So how do we actually solve this? With Cisco secure access, we break it down into three simple steps. Discovery, detection, and protection. 1st, we use discovery to find all those shadow AI applications that might be running in your environment without IPs.08:23Knowledge.08:43Next detection, which gives you the full picture by assessing the risk of those application based on based on the device location and network context. Finally, protection allow you to enforce strict policies to keep your data safe. It is all about turning that visibility.08:44Ability into action seamlessly so your team can work safely.09:04Let's take a closer look at the using AI app side of the house. The biggest risk we face here is settled AI. When employees use unauthorized AI tools, often accidentally sharing sensitive company data in the process.09:14The dashboard you see here is how Cisco Secure Access gives you back control. It provides deep visibility showing you exactly which AI application are being used, who is using them, and what their specific risk scores are.09:33By identifying these apps and their compliance attributes, you can move from a state of uncertainty to a policy driven environment that ensures your team uses AI safely and securely. Now that we have.09:49Identified the risk, how do we actually stop them?10:09The key here is that Cisco secure access doesn't just look for simple patterns. It understand the intent, whether it is blocking sophisticated prompt injection attacks or identifying sensitive data like PII or PHI.10:14Our protection is fully intelligent and the best part, it's zero friction because this is built directly into your existing Cisco secure access framework. There is NO new infrastructure to manage and NO complex setup.10:29You get one unified policy to protect over 1200 AI applications, keeping your organization secure without slowing your team down now when we shift our focus to the developing AI side of the house.10:45The security landscape become more even complex, as you can see we are dealing with a whole new set of vulnerabilities from prompt injection and sensitive information disclosure to supply chain risk and system prompt leakages etc. So these are.11:04Not just theoretical issues they are the specific challenges you face when building or integrating LLM into your infrastructure.11:24So while this list of ten risks might look overwhelming, it is actually your roadmap. By understanding the specific threats, you can build your AI application with security in mind from day one rather than trying to patch them after it beach occurred.11:33To address these threats, we just discussed we implemented AI guardrails categorized into three core pillars, security privacy and safety. Security focuses on technical threats like prompt injection privacy ensures your sensitive data like PII or PHI doesn't leak.11:52And safety gives the generated content appropriate by filtering out harmful or toxic materials.12:12So we map these guardrails directly to industry standard framework like ops, and IMI DRE, Atlas to to ensure you are following the best practices. And because we know every organization has a unique needs.12:19So these guardrails are fully customizable, allowing you to tailor your security posture to fit your specific industry or use case. So, what truly sets Cisco secure access apart, it comes down, comes down.12:37To a few key differentiators.12:57So we offer intelligence driven protection that understand intent rather than just patterns, meaning fewer false positive and more accurate data protection. So we provide comprehensive security and safety guardrails that cover everything from from injection to toxicity.13:00So most importantly, we deliver this through a single unified policy framework that's built natively into secure access. This is, this is not extra infrastructure to deploy, as I mentioned earlier, right? So giving you a true zero friction protection with.13:18Average over more than 1200 AI applications and advanced reporting. So we make it simple to secure your AI journey at scale.13:38Okay, we are taking data loss prevention to the next level beyond just traditional DLP, we have introduced a new policy engine that uses predictive classifier.14:00Our models to detect the intent behind the prompt rather than just looking for simple patterns. E.g., if a user enters a prompt like, please generate a table with all emails from the attached database, a traditional system might miss the risk.14:15Our new AI away DLP recognize the intent to extract the sensitive data and can block it automatically. It is a smarter, more proactive way to ensure your data stays where it belongs.14:34Finally, let's talk about how you manage these policies day to day. As you can see, we have integrated.14:57AI guardrails directly into your existing data loss prevention workflow, whether you are creating a new real time rule or a specific AI guardrail rule, it is all handled within the same intuitive interface.15:06So this gives you deeper data classification capabilities specifically for your AI applications, allowing you to monitor or block actively with just a few clicks. It is all about making complex security management.15:23Simple, consistent, and highly effective for your team. Let's see just how granular we can get. As you can see here, we offer enhanced classification capabilities that let you drill down into it.15:40Basically what you need to protect, whether it is specific privacy identifiers like PCI data, safety categories like preventing harassment or security trusts like put detection. You have the power to customize your guardrails to match your organization's specific risk profile.16:00When it comes to AI development, we know that repositories like HuggingFace are essential for innovation, but they also introduced supply chain risk like malicious code copy lift IP issues.16:23Or unknown model origins. So rather than taking the all or nothing approach of blocking these sites, Cisco secure access helps you enable safe development. We provide deep AI model risk and compliance analysis.16:39Giving you the visibility to identify this risk automatically. So this allow your developers to keep moving fast while you maintain the granular control needed to keep your organization secure.16:55So how does this all come together? As we have seen, unmanaged AI models introduce real risk from IP compliance issue to malicious code. Cisco addresses this by running this risk through our AI model risk and compliance compliance analysis engine.17:12The beauty of this approach is that it doesn't live in a silo. We feed those insights directly into our Cisco enforcement points like secure endpoint, secure access and email threat defense by leveraging the power of the Cisco sec security cloud.17:30We provide a unified multi layered defense that protects your organization against every vector.17:50And with even more integrations like secure firewall and Meraki on the roadmap. So we are continue continuing to build the most comprehensive security ecosystem for the AI era. To wrap up this section.17:57Let's look at the big picture. We know that AI development is a massive engine for innovation, but it comes with real risk. When you have over 1.7 million models on platform like HuggingFace, you can't just.18:17Block access without hurting your competitive edge. The risks are clear, malicious code hidden in embedding complex licensing issues and a lack of transparency regarding where these models come from. Cisco's approach is to help you.18:33Accurate and safe innovation by integrating AI model analysis into our advanced malware protection and and across our entire security portfolio from secure access to email threat defense. So we give you the control you need today with a clear roadmap.18:51For even more robust protection tomorrow. Now that we have covered the risk and the technical guardrails, let's shift our focus to the practical side overcome and discovery.19:11So what is the core challenge we are solving here with 65 % of enterprise now using AI? The risk of sensitive data leaking into unauthorized apps is at an all high all time high. Traditional DLP tools simply are not.19:32Enough, so they really on basic pattern matching and cannot understand the intent behind the prompt or preventing sophisticated attacks like prompt injections. So this is where a Cisco AI comes.19:52Comes in, available in our advanced year it evolves your security beyond traditional DLP. So we provide coverage of over 1200 AI applications and forcing guardrails for the top 15 and deliver truly intelligent intent error protection.20:08So we are not just moving data, we are securing the way your business interacts with AI.20:28So, what are we trying to achieve here? Ultimately, it is about reclaiming visibility and control in, in an era of AI. We need to discover which 3rd party application your employees are using. Control that access.20:39And restrict the sensitive information being leaked back and forth.20:57Think about a real world risk. For instance, a financial analyst uses a AI tool to police an acquisition proposal, but the sensitive data is then used to re retrain the model and.21:03Inadvertently lead to a competitor. So this is a catastrophic outcome. So our goal is to provide the policies that prevent this ensuring your team can use the tool they need while keeping your confidential information and.21:18Compliance status fully protected, to wrap up this section, I want to leave you with a few questions to consider for your own organization.21:341st, who is actually driving AI security in your company and how have their needs changed as AI adoption has exploded? Second, what are your biggest concerns regarding employees using unsanctioned tools?21:513rd, have you already seen developers pulling down open source models like repositories like havingface or GitHub? And finally, how are you currently deciding what counts as a safe AI application for your business?22:10So these are not easy questions, but they are the right one to talk, the right one to ask. If you if you don't have clear answer yet, that is exactly where Cisco Secure access can help you find your routine.22:26Okay, this table perfectly summarizes why AI access is a game changer for your security posture while traditional DLP relies on simple keywords or pattern matching.22:44AI access adds a critical layer of context and intent. So whether it is protecting privacy by understanding if a document contains sensitive PII, ensuring security by identifying the malicious intent behind the prompt.23:02Or maintaining safety by filtering out harmful content. We are moving from basic filtering to smart understanding. The bottom line is simple. You get higher accuracy significantly fewer false alarms and much stronger protection against the sophisticated.23:19Ways AI can be misused. It is the difference between just seeing a word word with actually understanding a risk now let's move from, from the what and the why to the how.23:37It is now, it is one thing to talk about these security capabilities, but it's another to see them in action. So I'm going to walk you through a live demonstration of Cisco secure access so you can see, how we discover AI applications and force guardrails and protect your time real.23:57Time. Now that we are in this in the console, let's look at how simple it is to set up an access policy. As you can see, we have defined a rule for generative AI applications.24:17You can choose to allow block, isolate or in this case simply one day user. Look at the bottom section under configure security.24:37So we have decryption enabled. So this is a vital step because it allows Cisco secure access to intercept and inspect the encrypted traffic flowing to these AI tools. Without this visibility, you would be blind to the actual prompt and data being.24:51Here. By enabling decryption, we ensure that our security controls can actually see and protect the content. Now, let's see how we define the actual data loss prevention policy. As you can see.25:11It is incredibly straightforward. You simply select your data classification like privacy, safety or security guardrails and then choose which application you want to protect. So on the right.25:28You can see we have selected 15 different than AI applications ranging from to GitHub copilot. Finally, you just see your action. In this case we have chosen to block.25:45Any action, any activity that violate these rules. So it is that simple. You define the policy once and it is automatically applied across all of, all of your selected AI destination.26:02So in this demo, we will observe the user experience while utilizing public AI tools like Gemini and as you can see, the user attempts to input company called.26:20Confidential information into Germani to draft an email.26:40However, the request is blocked because the secure access policy is triggered preventing the the data from being leaked. Next, the user attempts to access use.26:45To request informations that valid public safety policies and you can see that the secure access policy successfully blocked this request as well.27:05Finally, let's look at the reporting side, this is where you get full visibility into everything happening across your environment. As you can see, the dashboard logs every event showing you exactly who was involved.27:23Which AI application was used and which security rule was triggered. So on the right you can see the deep dive details for specific events including the exact prompt that triggered the block. In this case, the system identified the block.27:40A prompt related to violent and public safety threats. So this level of reporting is essential. It doesn't just show you that something was blocked. It shows you why giving your security security teams the actionable intelligence they need to.27:57Refine policies and stay ahead of emerging trends.28:17You might be wondering which application we support, we provide full coverage for, for the top AI application listed here, including Germini and many others.28:24Okay, this brings us the end of the AI access session. I hope this gives you a clear overview of how it works and the value it can provide for your organization. Thank you for your time. I will now pass it to over Ujoel and who will walk you through the next topic.28:41Thank you so much Anku, for this detailed presentation. Now let me quickly share my screen. Can you all hear me? Good job can you see this screen as well? Let me go to presentation.29:04Are you good? Perfect. So hello everyone, so good morning, good afternoon, good evening from wherever you are joining. So thank you for joining today's session on experience inside for digital experience monitoring with our Cisco secure access. I'm, part of.29:24Customer success team at Cisco and today I will walk you through how we can give visibility.29:42How we can gain visibility and give you visibility into user experience across endpoint network and applications. But before we move ahead, let's quickly note one let's let me bring my pointer over here just a second, yeah.29:48So this is the package, so experience insight is part of Cisco secure access and the features available depends on SSE package which you are using. So different packages provide different level of visibility across endpoints, network, and applications. So based on the license.30:03You may see variations in the depth of insights and analysis you will see. So experience insights is available in both SIA and SPA and it covers both essential and advantage license. So I have added a reference link here where, where you can check the detailed feature.30:21Yeah, so after this session, after this presentation, I will share you this link so you can.30:41Get more insight of it. So now, here's an overview of the capabilities within Cisco secure access. So on the left, we have secure internet access, which includes feature like DNS security firewall, secure web gateway, data loss prevention.30:46And CASB. On the right, we have secure private access, which cover use cases like ZPA, VPN as a service and for accessing private application. Now digital experience monitoring or experience inside sit across this entire framework.31:06It provides end to end visibility into user experience by collecting and analyzing data from the endpoint, networks and applications, and this helps you understand how users are actually experiencing both internet and private application access.31:25So all of this is supported by our Cisco Talos threat intelligence, and it helps ensure not just secure access but also a smooth and optimized user experience, ok? So now let's.31:43Look at some of the core benefit provided by experience inside. 1st, from an endpoint perspective, you get visibility into key performance metrics like CPU utilization, memory usage, and Wi-Fi signal strength.32:01This help you quickly understand if the issue is coming from user device itself. Next is network performance. So you can visualize the full path from the endpoint to the secure access edge along with the metrics like latency, jitter, and packet loss. It also provides suggestion or.32:16Remediation which helps in faster troubleshooting. And finally, you get visibility into the performance of commonly used application like Outlook, Slack, workday, SharePoint, Teams, and there are many other applications which will cover in depth in the upcoming slide.32:36So overall, this gives you a clear view across endpoint network and application helping you quickly identify and resolve user experience issues. Now continuing with our core benefit.32:56Experience insights also, provide detailed visibility into collaboration application, like I said, Webex zoom, Microsoft Teams. So whatever collaboration application you are using, you can track their performance, and you can get an insight of it.33:11Another key capability is hop by hop path, which will help you gain visibility. You can place the full path of performance and service dependency from the endpoint all the way to the secure access.33:30This is especially helpful for identifying exactly where a degradation is happening along the path. And for organization with thousand eye essentials or advantage license, this visibility extend even further, you can also see final hub from securex to the application.33:43Which will help you give you it through end to end visibility. I will try to provide you some screenshots and, which will give you good insight like what I mean by hop by hop, moving forward. Next is integration, so let's look at how experience insight integrates with.34:03The overall secure access environment and how it works with different components and provide end to end visibility. So for successful onboarding of experience inside, there are few key prerequisites. 1st, you need to have an active.34:22Thousandeye account with the required organization admin role and a light version of thousandeye is already included with the license, so you don't have to separate purchase for it. It is already included. Next, thousandeye user profile must have a designated login account code.34:42Which is required for registration with the secure access. I will show you a quick demo how this registration and integration works and finally, Cisco secure access client or Cisco secure client must be ins installed on your endpoint as it is used to collect telemetry from user devices.35:01So all these prerequisites are essential to ensure smooth deployment and proper integration of your experience inside. So this slide shows how the onboarding this loaded, yeah. So this slide shows how the.35:19Onboarding process looks within the dashboard. So once you navigate to experience insight, let me start this option to start a demo. I do not see or I cannot start.35:36What slot at the bottom. Okay. Yeah. So this is a quick demo on how you can do an integration. So 1st when you place on begin integration, it will provide you the experience.35:59Pop up window where it will this option to click on integrate Once you click on integrate it will be redirected to the thousand like page where you can, you have to enter your account details, as I said, there's a prerequisite to have a thousand account, then you need to select a region. You can select your nearest region.36:15Then you will click on login, it will prompt you with SSO prompt. Once everything, all the checks are completed, you will be logged into thousandeye accounts and this will show you who which user is logging in or which from which user you are logging in and.36:32You have to give authorization to secure access to read organization details manage endpoint agent manage endpoint test and manage test and rea read all the test. Once you provide all the access, you log in, you will see a pop up saying that good.36:48Integration is successful. Now you need to set a default test target. You can select any of the method like you can set zero trust access remote access VPN or SWG roaming module. For this demo, we will select SWG roaming module. Then you can select your collaboration application like Webex.37:04Room teams or whatever application which you want to monitor in real time to see the application performance, right?37:24So here we will select Webex, you can select your own collaboration, and then the last step to select the agent. So as I said there are two methods. Either you can deploy a Cisco secure client agent to your endpoint, which already have a thousand eye endpoint agent is installed, but if thousandeye agent is not installed and.37:30This is mentioned for endpoints that are not using one of the security connection method, you can copy this script and just paste the script in Windows or if you are using Mac, there's a Mac script available as well. So once the script is done, the integration will be successful and here in experience inside that you can see your endpoints listed on the.37:50Expense inside here.38:11So right now this is the quick demo of it. Hope this helps. Moving forward, 1 s, we are on which slide.38:12Sorry about it. Yeah, next slide. We I think it just speaks about that yeah just this is done. This is taking some time for me, not sure why. Yeah, so now let's take a deep dive into how.38:33We can achieve this seamless experience. So at the goal of this experience inside, let me bring my pointer again. So at the course of experience inside, this is a thousand eye agent. So this agent is designed.38:52Would be easy to install and this is lightweight so it is, it has a very minimal impact on endpoint performance. It runs in the background and it is completely invisible to the end user, meaning it does not interrupt with their normal workflow.39:07The role of the agent is to continuously collect performance data from the endpoint including network and application experience. This data is then used by the platform to provide visibility into user experience and help identify issue quickly. So overall, the thousand eye.39:22Agent plays a critical role in enabling end to end monitoring and ensuring a consistent and reliable user experience, ok? This is a single dashboard experience. It's fully integrated into the secure access.39:40So if you click on left, there's an experience inside tab so you can directly go there. So from this single interface, you can monitor thousandeye agent deployed across endpoints, like how many endpoints are onboarded. This give you a centralized view of the entire environment like was the CPU count, what's the memory usage, everything you can see from here.39:55And since everything is consolidated into one dashboard, it removes the need to navigate across different systems and make troubleshooting much faster and more efficient. Like now you don't have to log into each and every individual endpoint to check the performance. Since everything is integrated from the single dashboard, you can.40:15Check the performance from here itself, ok? Which will help you in easy troubleshooting. Next, extending this further, we have global remote monitoring. So these capabilities allow you to monitor user device and overall network health across different location.40:34So you can see detailed information for each endpoint, including the current status, location and performance metrics which help in quickly identifying users or region experience. In addition to real time visibility, you also have access to historic data.40:53Okay, so, this is important because it allows you to analyze past incident, identify thread and understand if certain issues are recurring. So with this combination of real time and historic insight, you can make.41:11More informed decision and take proactive action to improve user experience, ok? One of the key advantage of experience inside is simplifying troubleshooting and reducing mean time to resolve.41:27With the visibility provided, you can identify the root cause of the issue without needing to collect the logs, so as I said in the previous slide we can see hop by hop count, so where is the issue might be happening? So.41:44It allows you to detect problem without any user interaction. In many cases, this means you can identify and start resolution, start resolving the issue even before the user is aware of it, right? So additionally, you can quickly spot issue directly from the dashboard, ok? So since you have we have now.41:59The hop by hop visibility, you can directly log into that hop and you can start troubleshooting.42:19Now let's look into the endpoint test. So experience insight, as I said, it uses a thousand eye agent installed on the user's machine to perform this testing. So this test simulate user activity and help measure.42:25Performance across the network. The number of tests you can configure depends on the license type. E.g., with the default embedded license, you can you can you get a limited number of scheduled and dynamic tests with shorter data retention, but as.42:41We move higher tier like advantage, you can run more tests to retain data for the longer duration. So overall, endpoint test provider monitoring capabilities and the scale of testing depends on the license which you are using. So if you have advantage license, you will get more.43:01Test retention grade, ok? So with remote testing, you can validate the reachability of critical application from the user perspective. This includes collaborate collaboration applications like Webex, zoom, Microsoft team.43:20In addition to that, you can also test target within your access environment such as zero trust access, are they VPN, your roaming module, you can also also set your custom target, like you can select your private resources or any other public application.43:42Which you want to perform a test on. So overall, this provides a flexibility and comprehensive way to continuously validate and continuously validate your connectivity and ensure application reachability across your environment, ok?43:56So remote test, so this slide shows how the remote testing configuration and result looks within the dashboard, ok? So here you can see the list of endpoint tests which you have performed. If you give your test name, types and target.44:16It also give you visibility into license usage, including how many tests are allowed and how many current in use. This is a license type. So from this view you can quickly check the current status of each test and identify if any issue are occurring. The key benefit here is.44:34Is that all the information is easy to interrupt.44:53It's very user friendly, which helps you quickly understand performance and take action if needed. So overall, this makes it simple to monitor test result maintain network performance and respond quickly to an any emerging issue.44:57Once the tests are running, you get detailed remote test results like what you see here. You can see key metrics such as latency, jitter, response, packet loss and application performance score.45:16At the top, you also see a path visualization which shows the journey from the endpoint to the network of the application. This helps you quickly identify where an issue is occurring, whether it's at the endpoint or within the network or closer to the application. In the table below.45:33So, you can see the status of each test along with performance indicators making it easy to spot unhealthy and degraded services. So overall.45:53This level of visibility allows you to quickly pinpoint bottleneck and take targeted action to resolve issue more effectively. This is, for the more test reachability.46:03You can create either the network test or a HTTP test based on your troubleshooting requirement. Here, you define the test name, select the source agent and where the test will run speci and specify the target.46:20This could be private resource or any custom public endpoint, ok? You can also configure parameters like protocol, port, and test interval given, which will give you flexibility on how frequently you will run the test.46:36One key capability is the ability to choose specific agent. This allows you to run tests from particular user location or device which is very useful when troubleshooting location specific use issues, right? So suppose you have users across different location, so you can select the device from device or agent from where.46:52Where you want to start the troubleshooting. So overall this level of control helps you perform targeted.47:12Diagnosis and make troubleshooting more precise and effective. So now let's look at the AI insight and how it helps in identify issue proactively. Here we can see the AI inside view with within the experience inside. So this platform continuously analyzes.47:18This performance data collected from the endpoint and highlights potential issue in a simple and easy to understand format. E.g., here you can see a summary card showing all, overall device health, regional insight and low performance application.47:37This helps you quickly identify if there are any problem area without going through detailed metric. In addition, you can also have access to AI assistant, which allows you to ask question and get more context around the insight. So instead of manually analyzing data, the system automat.47:55Automatically review all the things. It gives you a key issue and guides you towards your possible cause of the issue. This helps to stay proactive, quickly identify performance problem and take action before the users are impacted.48:15And finally, let's look at the AI assistant I just talked about. So this allows you to interact with the platform using your natural language. So instead of navigating through multiple dashboards, you can simply ask question here, like can you provide health status of device from your.48:33To specific region, how many devices are located in.48:53Yours region like Europe or Asia or wherever you are from, what is the current license usage? So there are many questions which you can ask directly using our AI assistant. So the AI assistant not only provide answer but also suggest follow up questions, same like and recommend.48:56To guide your investigation. This make it easier to analyze data or troubleshoot issue and get to the root cause much faster. So overall the AI assistant acts like an intelligent or as an.49:17Co admin helping you simplify operation and make quicker, more informed decision. So this is how the entire experience inside works and I hope this session gave you a clear understanding on how you can integrate experience inside, how to onboard it.49:33I lost my connector. Can you all hear me again? Yeah there was excellent. Hold on. Perfect. So ok so this marks the end of my presentation and I will hand over to Neeraj for continuing this session. What do you Neeraj?49:55I'm not so can you take Neeraj you are on mute if you're speaking. I was just loading up the deck. Thanks.50:12Let me quickly start sharing alright, so let's quickly get started with deploying secure access to secure web traffic sec.50:31So we'll walk you through how we set up the SWG from foundational protection mechanism to the advanced controls using a practical and phased approach that you can apply in your environment.50:48So let's have a look into the agenda. So we'll begin by settling the context, why SWG matters today? With the shift to SAS hybrid work and direct to internet access, the traditional perimeter is gone and securing web traffic has become very.51:01Much critical. So SWG is NO longer an optional thing. It's a foundation.51:20From there, I'll walk you through how it works at a high level, specifically how proxy based inspection enables visibility, control and threat production across the web traffic. Next, we'll move on to the deployment best practices so that you can get it right at the very 1st time.51:25Whether you are deploying in a cloud delivered model like SIG or integrating with your existing security stack. We'll then focus on policy management, how to design and fine tune unified policies for consistent enforcement across your users, locations, and applications. And this is where more.51:44Most of the real value is unlocked. I'll also cover remote browser isolation when to use it and the prerequisites to keep in mind for a seamless user experience. And towards the end, I'll share some practical troubleshooting step tips that can save you time in real world deployments.52:04Alright, so let's take a step back and position where the secure web gateway fix in the layered security approach. So we'll always start with DNS security, right? It is your 1st line of defense. It stops threats at the domain level before even a connection is established. That makes.52:25Bit fast, highly scalable, and incredibly effective at blocking a large volume of malicious requests quite early.52:45And that role doesn't go away. Your DNS is always going to remain the foundational. But here is the reality for today, you know, attackers have also evolved. We are seeing more sophisticated techniques, malicious URLs, you know, compromised legitimate domains, and increasingly.52:53You know threats that are hidden inside encrypted HTTPS traffic. So DNS alone doesn't have the visibility into the encrypted payload.53:13And that's exactly why we need a layered approach. This is where secure web gateway comes in as a core component of the SSE architecture. SWG X as a inline proxy, inspecting and enforcing policy.53:23On web traffic in real time. So unlike DNS which operates at the domain level SWG goes deeper providing control at the URL application and even at the content level. So the outcome, you get stronger protection against malware, phishing, and even zero day threats. Along with that.53:37And you have data loss prevention and full visibility across users, devices, and applications. So the way you think about it is very simple. DNS gives you speed and broad coverage up front, and SWG adds depth, precision and control and together they deliver a truly layered.53:57Defense model that strengthens both security and compliance. Now let me walk you through how this actually works. So step one is the traffic redirection. All of your user web traffic is tiered to the cloud SWG. This can be done using a roaming client.54:18Or a pack file or network tunnels. The goal here is very simple. Ensure all traffic is consistently routed through the gateway regardless of the user location. Step number two is the policy evaluation. Once your traffic hits the SWG.54:38The intent based policies are applied. This determine whether to allow block one, inspect or isolate traffic using remote browser isolation. Step number three is your proxy control. For permitted traffic, the SWG operates as a full proxy. It terminates the user TLS session.54:55And establishes a new secure session to the destination.55:15What this does is this will enable deep inspection of the encrypted traffic without impacting the user experience. Step number four is decryption and inspection. So HTTPS traffic is decrypted and analyzed like URLs payloads, scripts, and files. This is where.55:19The hidden threats like malware, fishing or data exfiltration attempts are identified.55:39Right? Then we move on to the step five, which is the enforcement. So if any kind of malicious activity is detected, this session is immediately blocked or redirected based on the policy. This ensures users never reach unsafe destinations.55:45And finally, secure delivery and visibility. So clean traffic is re encrypted, forwarded back to the destination. At the same time, every session is logged, providing you full visibility for monitoring compliance and forensic analysis. So the key takeaway here is.56:01Without decryption, your visibility is limited especially with today's HTTPS heavy traffic. Your full proxy SWG delivers deep packet inspection, precise control, and complete visibility. Now let's take a look at the best practices to get this right in the real world deployment.56:20In my experience, customers who achieve strong security with minimal user impact consistently follow a few key best practices as outlined in this slide. 1st is planning ahead. Start with a clear business outcome, whether it's reducing phishing risk, improving visibility or.56:41For meeting compliance goals. Just as important, map your traffic flows and identify any critical applications at an early stage, and this is going to avoid any kind of surprises at a later stage.57:01Secondly, understanding your baseline. So out of the box, your secure access already blocks malware, phishing and command and control traffic. But advanced capabilities like TLS decryption, file inspection, and sandboxing are not enabled by default.57:143rd is choosing the right activation method. So for most environments, the secure client is most flexible starting point, especially for hybrid users. Tunnels work well for branches and back files for selective use cases, but getting this right at the very early stage simplifies everything.57:30Port is starting small, so you can begin with a pilot group of users, right? That can start with DNS layer protection and then followed by the SWG, followed by refining policies and only then introduce decryption. This phased approach ensures stability before adding any kind of complex.57:50City.58:105th is expanding globally, so you can roll it out in stages by user, by user groups or departments or locations so that you can avoid the temptation to go all in quickly. You know, you can have a control expansion that can reduce the disruption and it also improves the user.58:12The Option of the technology.58:31Finally, you need to optimize it continuously. So deployment is just the beginning. The most successful teams continuously monitor the logs, they fine tune the policies and also adapt to evolving threats and business needs. So a faced well planned approach delivers strong security, better user experience.58:33And long term success.58:53Now, building on the previous slide, this is where understanding your out of the box baseline becomes critical especially during your pilot testing. So by default, secure access includes a system defined policy that allows traffic and that the rule is tied to a system provided security profile. This gives you an.58:59Immediate baseline of the production from day one.59:18So what does this baseline include? Production against malware, phishing command and control along with basic file inspection for HTTP traffic. So right away you have a solid safety net without any kind of custom configuration. But here is where I see customers are mistaken. Several advanced productions.59:21Are not enabled by default. This will include TLS decryption, sandboxing, and advanced malware protection, file controls, safe service enforcement, and AI driven threat protections. And these capabilities are really powerful, but they must be intentionally enabled.59:40So my recommendation to you, do not turn everything at once. Enable features incrementally, validate, test, and then move on to the next. Because each control specially decryption introduces its own dependencies and potential impact also. A phased rollout which will make.59:57Troubleshooting easier.01:00:17Rollback safer and overall deployment far more predictable. So before we jump into the policy building and advanced features, let's make sure the fundamentals are in place. From field experience, skipping this prerequisites always leads to delays during.01:00:19Pilot testing. 1st is your certificate deployment. The secure access root certificate must be installed on all the endpoints. And this is non negotiable if you plan to use the DLS decryption. Without it, the users will see browser warnings and adoption drops immediately. It also requires for a seamless user experience.01:00:39With block and notification pages.01:00:592nd is use the secure client during the pilot. With umbrella module, it provides consistent traffic redirection, whether the users are on prem, remote or hybrid. It also makes proxy bypass simple, which is a critical because some applications do not behave well with proxies, right?01:01:02During the pilot, that flexibility.01:01:22Saves a lot of time. It also allows you to test the full feature set, whether it's DNS security, whether it's SWG or any other SSE capabilities, all through a single unified client, which can be installed across windows, Mac OS, and mobiles. 3rd is validating the.01:01:25Point status.01:01:44Ensure your test devices are active and correctly registered. In the secure client UI, you should see the roaming protection status as active and protected. If you don't see that, it means your traffic is not getting steered and NO policy will take effect until that is fixed. So the.01:01:46Bottom line is that getting these fundamentals right.01:02:05You know, and you set up yourself for smooth pilot testing. Now, once your pilot is stable, the next phase is preparing for TLS decryption. This is where the visibility really comes in. Step one is to build your own do not.01:02:09Decrypt list up front. So you can identify sensitive categories like banking, healthcare or any privacy regulated applications.01:02:29This should be excluded from decryption to meet the compliance and user privacy requirements. Step number two is to enable decryption strategically. There are multiple modes and options available for this. Because without decryption visibility into HTTPS traffic and therefore effective threat detection is.01:02:37Very much limited. Step number three is to validate and refine.01:02:57So as you turn on the decryption, closely monitoring the application behavior and user experience is necessary. If any kind of issues arise, update your bypass or do not decrypt list accordingly. And finally, you can expand it gradually. So once your pilot users are stable and workflows are validated.01:03:02You can roll out the decryption in phases across the entire organization. So the key takeaway is do not flip everything at once. A controlled phased approach is going to ensure that you gain visibility without introducing any kind of risk.01:03:22Or disruption. Now, beyond the default rule, now beyond the default rule, this is where you start unlocking real flexibility. The default internet access rule already.01:03:38Gives you strong out of the box protection covering malware, phishing, CNC, and basic file inspection. And for many organizations, this is the right starting point. You can also enhance it by customizing the system provided security profile. E.g., enabling TL TLS description or adding deeper inspection.01:03:58Controls based on your requirements. From there, you move on to the custom profiles. This is where it is going to allow you to create your own internet access rules with tailored security settings, you know, overriding the default behavior wherever it is needed. A common example is excluding specific.01:04:18Endpoints like IoT devices or certain user groups from decryption where certificate deployment may not be feasible.01:04:38And this is where it gets powerful. By integrating your identity provider, you can apply policies at a very granular level by user group or even at the location. So now your security aligns with business. Finance user can have sticker controls with sandboxing and deeper inspection while marketing.01:04:46Teams can have more flexible access for productivity. You can also gain user level visibility, which is critical for auditing and compliance purposes. So the approach is very simple. Start with default.01:05:06And hence the baseline, introduce custom policies wherever needed and then scale with identity based enforcement. Now, as your deployment matures, this is where you strike the right balance between production and flexibility through the business controls.01:05:19So here is an important point out of the box. Secure access does not enforce an acceptable use policy. So if your organization wants to control what users can.01:05:39And cannot access. This must be intentionally designed through custom rules and you have multiple ways to do it. Or you can define controls using, you know, destination list where you can block specific URLs or domains. You can use custom can content categories to apply policies at scale, you know, across groups like gambling, streaming.01:05:50Or any other content, you know, you can apply.01:06:10Controlled applications either entire categories like social media or drilling down into specific apps like file sharing platforms or any other platforms you have. On top of that, you can layer the contextual controls such as geolocation restrictions.01:06:14Or even time based policies so that enforcement aligns with your business requirements. Now, it's not, not just blocking, you know, you have the flexibility actions as well. You have actions like one, allow or even isolate. E.g., you can present a warning page to a user.01:06:31Or redirect risky activity into remote browser isolation instead of blocking it outright, you know? And that is how you move from generic protection to a true business agility security. Now let's talk about the rule defaults. Every time you create a new access rule.01:06:52It is going to inherit the default settings, including the security profile and the other configurations defined under the rule defaults. So unless you explicitly change those settings, your new rule will follow the baseline behavior. Now here is the key distinction.01:07:11If a rule has already been customized, it remains unchanged, even if you update the defaults later, but any rules still tied to the default will automatically inherit inherit those updates, which means your default rules are really very powerful. They allow you to enforce consistency and standardization.01:07:28Across multiple rules.01:07:48With a minimal effort, but at the same time, a single change at the default level can also have a broad impact across your environment. So the best practice is very simple. Treat your default rule as your baseline template, use them to accelerate your deployments and maintain consistency, but always be mindful.01:07:50Of the scope of the change because with great scale comes the need for, you know, careful control of your policies. Now let's move on to the global settings that are available and which are another critical piece of the policy framework. The global settings apply across all.01:08:09Three rules, including both internet access.01:08:29And private access. So in this session, we are focused only on the internet access, but the key point here is these settings are universal and cannot be overridden at the rule level. So think of them as your foundation layer for the policy behavior. In most cases, you would not want to touch them, right? Because they are primarily intended.01:08:32But for troubleshooting and diagnostic purposes and not for day to day policy design. E.g., you might temporarily disable the TLS decryption while investigating an issue, but that should never become a long term workaround. So there are a few important considerations that I would like to talk about. If you are using Microsoft.01:08:52Office 3605.01:09:12Follow the Microsoft guidelines to bypass proxy inspection for optimized performance. And for the applications using that used certificate pinning, ensure that your decryption strategy accounts for them as well. Otherwise, those applications are definitely going to break. So, so the guidance here is very simple.01:09:14Use the global settings sparingly with a clear purpose and keep the changes temporary.01:09:33For most deployments, the defaults are well designed and sufficient. Let me close this section with a simple maturity model for building an effective SWG policy. Step one is to start with the baseline. The default internet access rule is enabled.01:09:39Out of the box and it already protects against the malware phishing and CNC. The moment you steered the traffic to secure access, this protection goes active with NO additional configuration needed. Step number two is to enable advanced threat controls. This is where you introduce TLS decryption, sandboxing and safe search.01:09:59These are not enabled by default, so activate them incrementally, validate each step before moving forward. Step number three is to introduce custom security profiles. Now you tailor your policies for specific users, groups or devices.01:10:19Overriding the defaults wherever needed. E.g., including certain endpoints excluding certain endpoints from decryption wherever it is not feasible. Step number four is adding isolation. So instead of blocking everything.01:10:36Risky, you can redirect traffic to remote browser isolation. This will allow safe access while keeping threats away from the endpoint. Step number five is to ensure business controls. This is where you implement acceptable use policies, blocking categories, controlling applications, and adding.01:10:52Context like geolocation or time based access. And finally, you have your policy overrides. These are targeted.01:11:11Exceptions for specific users or groups, but they must be placed above the broader rules to take effect. Now let's talk about the rule order. Building the right rule is important, but it is just as critical, you know, the order of the rule is critical in which you place them. So.01:11:19Secure web policies are pro processed from top to bottom.01:11:39And the 1st match wins. What this means in practice is that if you have a broad rule that says sits about a specific rule, then that specific rule is never going to be evaluated. So the best practice here is going to be place specific rules about general rules, your high risk block.01:11:43Rules is an example. Destinations where you never want the users to access should always be at the very top.01:12:03More permissive rules like allows should be placed at the lower to avoid unintentionally bypassing of any kind of security controls. Now remember that if NO rule matches, the traffic is going to fall back to the default rule at the bottom, which is always going to be allowed. So the real risk here is misordered policies.01:12:10A misplaced rule can result into traffic being unintentionally allowed or critical productions being bypassed. E.g., if an exemption rule is placed above a block rule, the traffic will be allowed, even if it belongs to a restricted category. So the key takeaway is policy logic is not just about what you configure.01:12:30It's about where you place it. So getting the order right.01:12:50And your security works as intended. Get, you get it wrong and you introduce gaps without even realizing it. Now let's take a moment to look at one of the most powerful actions available in SWG, which is isolation. So the goal here is very simple to protect the user and the end.01:12:54Point by moving browser activity into a secure cloud hosted environment.01:13:14And here is how it works. When the traffic matches the policy with an isolate action, the platform automatically launches a remote browser session in the cloud. From the user's perspective, the experience feels completely normal. But behind the scenes.01:13:19They are not directly connecting to the destination side. Instead, all the activity that happens in an isolated cloud browser and only in a safe, it happens only in a safe visual stream, which is sent back to the user's device. What this means is NO codes, NO scripts, NO downloads ever.01:13:35Reach the endpoint.01:13:55Your, each session is going to run in a disposable container and it is destroyed after use. What the user sees is essentially a pixelated or rendered view of the web page. And the result is that you're, you effectively eliminate the risk from malware zero day exploits and compromise websites.01:13:56While still allowing the users to access the content they need.01:14:16Now before enabling remote browser isolation, let's quickly walk through the key prerequisites. These are based on real world deployments and getting them right avoids most of the pilot issues. The 1st is confirm your entitlement. Some organizations have risk based isolation where others have full isolation, you know.01:14:23Knowing this upfront sets the right expectation and avoids confusion during the testing. Your second step is going to be certificate and decryption. The secure access route certificate must be deployed and TLS decryption must be enabled in your policy. Without decryption.01:14:43Remote browser isolation simply cannot engage because it needs visibility into that HTTPS encrypted traffic. The 3rd is browser readiness. So remote browser isolation supports Chrome, Edge Firefox, and safari, but cookies must be enabled. A very common issue we see is sessions failing due to.01:14:59Disabled cookies or private incognito mode.01:15:19Your 4th is policy validation. Ensure that the destination is not a part of any kind of bypass exemption or higher priority block rule. Remember that policy order matters as we spoke in the last slides. If traffic never reaches the isolation rule, RBI is never going to be triggered.01:15:235th is going to be connectivity and exclusions. So your endpoint must have stable connectivity to secure access. Also make sure that RBI destinations are not in the do not decrypt list or bypass list. Otherwise isolation is skipped entirely. And finally verification. The simplest way to confirm.01:15:41Our remote browser isolation is working is by checking the Cisco indicator in the browser session at the very bottom right that tells you that the traffic is being isolated. And the bottom line here is that remote browser isolation is powerful, but only when the prerequisites are correctly in place. Getting this right.01:16:01An isolation is going to work seamlessly for you.01:16:21And lastly, let's have a look at how we simplify policy creation using the Cisco AI powered assistant within the unified policy framework. This capability is designed to make rule creation faster and more intuitive and less error prone. So instead of manually building each component, you can use.01:16:24This natural language. E.g., allow all users access to Jira application and the assistant is going to generate a complete access rule for you. The key here is to provide a clear intent. You know, you need to provide it source, destination, and an action. From that, the system is going to interpret that.01:16:44It builds the rule and it presents for it for your review. All AI generated rules are disabled by default, so nothing is enforced until you review and explicitly activate it, which gives you full control, you know, you can also edit and fine tune the rule before even enabling it. So now.01:17:01There are guardrails available. The assistant operates within access policy framework. It does not modify security profiles, connectors or deeper system configurations. So what.01:17:21The real value you get is the speed and the consistency. You get, you can generate multiple rules from a single prompt, reduce manual errors and accelerate deployments while still maintaining the full governance in place. And lastly, let's wrap up with some common troubleshooting scenarios and the.01:17:32These are the ones I consistently see in the field. 1st is certificate and decryption issues. If the users see certificate warnings after enabling the TLS decryption, it is almost.01:17:52It always means that the secure access root certificate is missing all the times, you know? This is critical, not just for decryption but also for blocking and, you know, NO notification pages. 2nd is the policy mismatch. The traffic, if the traffic isn't behaving as expected, you need to validate your source and destination condition.01:18:04Most issues come down to misaligned policy logic. The 3rd is going to be application breakage. If the app.01:18:25If the app doesn't work through the proxy, add it to the bypass list or just add decryption settings to the, you know, do not decrypt list. Some applications simply do not tolerate inspection. So that is why it is needed. The 4th one is going to be false positives. So if legitimate traffic is blocked, you can.01:18:33Create a temporary override rule to restore the access quickly. At the same time, you can also submit a recategorization request so it is fixed properly.01:18:53And one important note here is encrypted file downloads are blocked by default. So if you use use case requires it, then you can explicitly allow it within your policy. The key takeaway here is these are the few checks that can resolve the majority of the onboarding issues and keep your pilot moving smoothly.01:19:03With that over to you Jay? Go. Gentlemen I think you did outstanding. I thought do I even learn stuff today? And I work with this stuff all the time.01:19:25I think you all The delivery of this was fantastic. Thank you. A really informative session. To the guys that have left on the call, thank you very much for sticking around. You make our jobs much easier when we speak to real people. We like speaking to our, our.01:19:42APJC customers and customers generally out there. There are real people at Cisco.01:20:02You know, even though these things are, they come through different methods, there's people behind this. We do have some upcoming webinars that we've got planned for this audience. We will be expanding to a global audience to get more people on the calls, and hopefully a little bit more interaction.01:20:09Going with, with, with everyone. But as you can see, we've got some umbrella to to secure access what that looks like. We've got coming up in 16 April. We've got troubleshooting scenarios around internet access.01:20:29So building up upon what Neeraj just spoke about now, when things start going wrong and you built out those policies, how do you go about looking into those and some, some recommendations how to fix those policies? And then we've got.01:20:46An an upgrade manager tool that we've got for our umbrella customers that are migrating to secure access DNS defense. And we'll speak you through a webinar about how that works and and what that looks like.01:21:02Once again, we're grateful to, Cisco customers, all of our Cisco customers, all of our Cisco partners, thanks for tuning in for our webinars, and with that, we'll call today complete. Thanks and have a good afternoon.01:21:17