In short: Harmony SASE Internet Access, now Check Point SASE Internet Access, is a hybrid secure web gateway. The SASE agent enforces web policy and inspects traffic on the device, so users connect directly to the web without backhauling, with cloud inspection still available. It adds web and DNS filtering, malware protection, browser security and mobile protection, licensed per user.
What Internet Access does
Internet Access is the secure web gateway (SWG) part of Check Point SASE. Its job is to stop users reaching malicious or inappropriate sites, downloading malware, handing credentials to phishing pages or leaking data, whether they are in the office, at home or on hotel Wi-Fi.
What makes Check Point's approach different is where the inspection happens. A traditional cloud SWG sends every web request to a cloud point of presence to be inspected. Check Point describes a hybrid architecture with on-device and cloud inspection options: the access policy is applied directly on the device by the SASE agent, whose built-in secure web gateway inspects TLS traffic locally and runs a malware protection engine that scans files and blocks malicious ones. Traffic can then go straight to its destination. For the general concept, see our secure web gateway guide on cloud-security.cloud.
Protection features
| Feature | What it gives you |
|---|---|
| Web filtering | Allow or block websites and categories for specific users or groups |
| DNS filtering | Block domain categories and named domains (including their sub-domains) at the lookup stage, with an exclusion list for exceptions |
| Advanced threat protection | Multi-layer prevention against ransomware, zero-day attacks, advanced persistent threats and viruses, using heuristics and machine learning |
| Malware protection engine | Scans files downloaded through the browser on the device and blocks access if they are malicious |
| Browser security | Zero-phishing, corporate password reuse protection, protection from malicious search results, file sanitisation and in-browser data loss prevention |
| Mobile protection | On-device zero-phishing and ransomware prevention, and protection against malicious apps and sideloading |
| Automatic Wi-Fi security | Listed by Check Point as part of Internet Access, for users who connect from wireless networks outside the office |
The browser security capabilities overlap with Harmony Browse, Check Point's browser extension. Check Point's SASE pages also describe discovering which generative AI tools staff use. Its life cycle policy, however, records that GenAI Protect has been replaced by Workforce AI Security and is no longer included in the SASE Complete package or the SASE Browse Advanced add-on for new customers. If AI governance matters to you, we will confirm what your package covers and whether Workforce AI Security is the better fit.
On-device versus cloud inspection: when each applies
Check Point offers both inspection points. In practice the design decision usually looks like this:
| Situation | Typical approach | Why |
|---|---|---|
| Managed laptop with the SASE agent, browsing the web | On-device inspection | Traffic goes direct to the site, avoiding the extra hop through a cloud point of presence and keeping the user's real location for localised content |
| SaaS apps that only accept connections from known IP addresses | Route through a Check Point SASE gateway | Each dedicated gateway has its own static IP address for allow-listing |
| Traffic you want inspected centrally under one policy | Cloud inspection | Policy and logging are applied in Check Point's cloud rather than on the endpoint |
| Branch offices | Check Point SD-WAN, which Check Point describes as including branch-level security | Secures the site connection as well as individual users |
Check Point lists improved user privacy and compliance, and more accurate localisation, among the benefits of on-device inspection. Where a few applications break under TLS inspection, for example because they use certificate pinning, the policy can bypass them. We will help you decide which traffic is inspected where; most organisations use a mix.
No more backhauling
Many UK organisations still route remote users' internet traffic over a VPN to head office so the main firewall can inspect it. That made sense when most applications lived in the server room. With Microsoft 365, Google Workspace and other SaaS apps in the cloud, it means every Teams call and file sync travels to the office and back out again, adding delay and consuming the office internet connection.
Internet Access removes that hop. Users are protected locally, so they connect directly to the internet, and the head-office link is freed up for the traffic that genuinely needs it. Combined with Private Access for internal applications, the remote access VPN can be retired altogether.
Deployment and licensing
Internet Access is deployed through the Check Point SASE agent, which runs on Windows, macOS, Ubuntu and Fedora Linux, Android, Chromebooks and iOS. Check Point documents deployment with Microsoft Intune for Windows, Jamf Pro for macOS and other MDM tools. With a silent Intune deployment, internet protection starts as soon as the agent is installed, before the user signs in; Private Access stays locked until they authenticate. Policies are set once in the cloud console and follow the user.
Two practical points from Check Point's admin guide: running other products that also tunnel, filter or inspect traffic or DNS on the same device may not be supported, so plan to remove an old VPN client or web filter agent as you roll out; and if you run Check Point firewalls, the Internet Access policy can be managed from SmartConsole as one policy for office and remote users.
Internet Access is licensed per user, on its own or together with Private Access. Read Harmony SASE pricing for the factors that change the cost, then ask us for a quote.
How Forever Systems helps
We design the web and DNS filtering policy around your acceptable-use rules, decide which traffic is inspected on the device and which goes through a gateway, deploy the agent, and tune policy during a pilot so legitimate sites are not blocked. Afterwards we handle changes, reporting and renewals. Contact us to discuss Internet Access for your users.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Check Point SASE Internet Access?
It is the secure web gateway component of the Check Point SASE platform (formerly Harmony SASE). It protects users on the web with web and DNS filtering, threat and malware prevention, browser security and mobile protection, using both on-device and cloud inspection.
What is on-device inspection in Check Point SASE?
The SASE agent on the user's device applies the internet access policy and inspects web traffic locally, including TLS traffic, instead of sending everything to a cloud point of presence first. Traffic can then go straight to its destination, which avoids backhauling and the extra hop.
Does Harmony SASE Internet Access work without an agent?
Internet Access policy is enforced by the Check Point SASE agent, so the agent is the normal way to protect each user. For devices you cannot manage, Check Point Enterprise Browser provides controlled access to corporate apps, and branch offices can be secured with Check Point SD-WAN.
Can I run Check Point SASE alongside another web filter or VPN client?
Check Point warns that other products that also tunnel, filter or inspect traffic or DNS on the same device may not be supported and can cause connection problems. Plan to remove them as each device moves to Check Point SASE.
Is Internet Access the same as Harmony Browse?
No. Harmony Browse is a browser extension focused on in-browser protection. Internet Access protects all of a user's web traffic and includes browser security capabilities as part of a wider secure web gateway.