Cisco has several products in Market for Web content security. We need to understand their differences and positioning.Cisco has ASA CX Context-Aware Firewall, the Cisco Web Security Appliance (WSA), and ScanSafe Cloud Security service (aka Cloud web security).
These devices have some overlapping features and also has some positioning differences

Web Security Appliance (WSA)-

The Web Security Appliance is suitable for customers who want:

-A dedicated proxy or web-security gateway
-Comprehensive web content filtering
-Anti-malware scanning
-Data Loss Prevention
-Caching

ScanSafe is suitable for customers who want:

-Web security for mobile users without the need to backhaul all traffic
-Distributed enterprise with many Internet access points
-Ease of deployment to existing network

ASA CX Context-Aware Firewall is suitable for customers who want:

-Inline protection
-Full firewall capabilities with some content controls
-Visibility and control of web and non-web protocols and applications that may use non-standard ports
(eg. Skype, P2P, or Voice protocols like h323, SIP)