Direct answer: Cisco Secure Access and Zscaler Internet Access are both cloud proxies: every web request from an Umbrella refugee's laptop detours to a vendor data center before it reaches the internet, so migrating from Umbrella to either one changes whose detour you pay for, not whether you pay it. If the point of leaving Umbrella is to get full HTTPS inspection without the latency, console sprawl and per-module pricing of a cloud proxy, the third option is an on-device secure web gateway. dope.security's Fly Direct SWG inspects SSL on the endpoint, works in any country without a paid uplift and governs personal versus corporate AI accounts natively, which is why it belongs on the same shortlist as the two vendors Cisco and Zscaler would prefer you compare.

Cisco's end-of-sale bulletin for Umbrella SIG and DNS, published September 1, 2026, put a hard date on a decision that most Umbrella customers had been postponing. End of sale and end of software maintenance land on January 31, 2027. The last renewal is January 31, 2028. Support ends January 31, 2029. Cisco's migration table maps DNS Essentials and Advantage to Secure Access DNS Essentials and Advantage, and SIG Essentials to Secure Access Internet Access Essentials, while several SKUs, including the L7 Cloud Firewall, carry the line "there is currently no migration product available." We walked through the full timeline in our Zscaler vs Cisco Umbrella comparison and the companion migrate-or-switch guide. This post covers the question that follows: once you accept that Umbrella is going away, is Cisco Secure Access or Zscaler the better landing spot, and is either one actually an upgrade?

Our view is that the two vendors are closer to each other than either admits, and that the real fork in the road is architectural. Below we compare them on what Umbrella customers care about most: inspection depth, latency, reliability, pricing structure, AI governance and migration effort, with dope.security's on-device approach as the reference point throughout.

What an Umbrella customer is actually buying with Secure Access

Cisco Secure Access is the SSE platform that absorbed Umbrella's roadmap. It sells in two packages: Secure Internet Access (SIA), which covers the SWG, DNS security, cloud firewall, CASB and DLP that SIG customers already know, plus digital experience monitoring and "secure AI usage" controls, and Secure Private Access (SPA), which adds ZTNA and VPN as a service. Cisco's migration material says Umbrella DNS customers can move to Secure Access DNS Defense "for the same investment," and that most migrations complete in about an hour with the automated tool. Cisco's own flyer also encourages customers to renew into Secure Access early to lock in current pricing "before any increases at the next renewal," which tells you what Cisco expects list prices to do.

Architecturally, Secure Access is still a cloud proxy. The Cisco Secure Client (the successor to the Umbrella roaming client) tunnels traffic to a Cisco point of presence where decryption, URL filtering and DLP happen. That is the same model as Umbrella SIG, so for a DNS-only customer it is a meaningful step up in inspection depth: Cisco's own documentation (doc 225162) states that allowing a private ChatGPT tenant while blocking others requires the intelligent proxy, SSL decryption and a root certificate, none of which the DNS layer can do. For a SIG customer it is mostly a console and licensing change. Either way, the detour to a Cisco PoP remains, and the MCP and agent gateway controls Cisco announced in March 2026 live in Secure Access rather than in Umbrella, which is part of why the migration is being pushed.

Where Cisco's documentation is quiet, we stay quiet too. Cisco has not published 2026 per-user list prices for DNS Defense, SIA or SPA; the figures circulating online are partner estimates and quote-based, so treat any "Secure Access costs X per user" claim as unverified until it is on your own quote.

What Zscaler offers the same customer

Zscaler Internet Access is the category's reference cloud proxy and a 2026 Gartner SSE Magic Quadrant Leader. For an Umbrella SIG customer, ZIA is a lateral move in architecture with a deeper feature catalog: every request forwards to a Zscaler Service Edge, where the SWG, cloud firewall, sandbox, CASB and DLP modules apply policy before traffic exits to the destination. The depth is real. So is the stacking. Zscaler sells in editions, and the data protection module that makes prompt-level AI DLP possible is an add-on; AI Guard and AI Scanning are separately licensed. At Zenith Live in June 2026 Zscaler announced AI Broker for agent and MCP traffic, Endpoint AI Security and an AI Access Graph, with general availability and pricing undisclosed. The pattern is more products to license and integrate, not a gap in ambition.

On cost, Zscaler's Q4 FY26 results (September 3, 2026) showed growth shifting toward Z-Flex consumption licensing, with more than $770 million in Z-Flex total contract value in the quarter. Umbrella customers used to a per-seat SKU should read our Zscaler pricing breakdown before assuming the model maps one to one. And on reliability, Zscaler's documented history includes the October 25, 2022 outage (100 percent packet loss during internal maintenance) and the January 19, 2025 disruption; our Zscaler outage history covers the pattern in detail. The lesson is not that Zscaler is unreliable. It is that a centralized control plane is a single point of failure that your users share with every other tenant.

Head to head: Secure Access, Zscaler and an on-device SWG

Here is how the three options compare on the questions Umbrella customers ask us most. Each line stands on its own.

Cisco Secure Access

Secure Access inspects full HTTPS when traffic is tunneled through the Cisco Secure Client to a Cisco PoP, a real improvement over DNS-only Umbrella. Policy, logs and dashboards depend on the Cisco cloud; Umbrella's January 19, 2025 global disruption from a DNS failover misconfiguration (Field Notice FN74221) is the documented reminder of what a control-plane failure looks like. AI governance (tenant control for ChatGPT, prompt inspection, MCP and agent gateway) requires the full proxy path with SSL decryption; DNS Defense customers do not get it. Cisco has no mainland China data center, which matters for any team with staff or travelers there. Pricing is quote-based and Cisco is signaling increases at renewal.

Zscaler Internet Access

ZIA inspects full HTTPS at a Zscaler Service Edge, with the broadest module catalog of the three. Latency compounds as modules stack, a point customers report consistently and Zscaler's own tuning guides acknowledge. Prompt-level AI DLP needs the Data Protection add-on; newer AI products announced in June 2026 have undisclosed GA and pricing. Z-Flex consumption licensing is now the growth engine, so budget predictability depends on how carefully you negotiate the commit. China is sold as a Premium or Plus uplift. Documented outages in 2022 and 2025 show the control plane is the shared risk.

dope.security Fly Direct SWG

dope.security performs SSL inspection, URL filtering, Cloud Application Control and Dopamine DLP on the device, so traffic goes straight to its destination with no PoP in the path. The agent runs under 100 MB of RAM on Mac and Windows, and policy changes land on every endpoint in under a minute from a single console. AI governance is native rather than an add-on: discover every AI app in use, allow the enterprise ChatGPT or Claude tenant while blocking personal accounts on the same domain, and have Dopamine DLP read prompts and uploads for sensitive content before they leave the laptop. It works in China with no paid uplift because there is no data center to route through. Greylock Partners left Cisco Umbrella for dope.security in 27 days from first proposal to signed contract, and another Umbrella customer reached 2,000 machines in two days.

Does moving from Umbrella to a cloud proxy make users slower?

For DNS-only Umbrella customers, yes, and it is worth being honest about why. DNS resolution adds almost nothing to page loads because it happens once per domain and is cached. A full cloud proxy tunnels every request through a PoP, decrypts it, applies policy and re-encrypts it, then sends it on. Measured cloud-proxy overhead runs roughly 40 to 80 milliseconds when the user is close to a point of presence and 150 to 400 milliseconds when they are far from one. Netskope, to its credit, publishes an SLA that admits the gap between non-decrypted (under 10 ms) and decrypted (50 ms) traffic. Cisco and Zscaler do not publish equivalent figures, but the physics is identical. Umbrella users who move to Secure Access or ZIA often notice the difference first on video calls, SaaS apps with many small requests, and developer tooling.

On-device inspection removes the variable entirely. There is still CPU work to decrypt and classify, but it happens on the laptop at local speed, with no network detour. That is the single biggest reason teams that leave Umbrella for dope.security report that users do not notice the agent is there.

Run the Fly-Direct Speed Test on this page to measure your own round-trip latency and see what a cloud-proxy detour would add for the places your people actually work. Then compare it with how dope.security's on-device SWG inspects without the detour, or watch a short demo of the policy console.

Takeaway: the detour is the tax. Secure Access and Zscaler both charge it; an on-device SWG does not.

Which option handles AI governance better?

This is where the Umbrella migration decision has changed most since 2024. Every Umbrella customer we talk to now has a ChatGPT, Copilot, Gemini or Claude question attached to their SWG question. The specific test we recommend is simple: can you allow your corporate ChatGPT Enterprise workspace while blocking personal ChatGPT logins, on the same domain, for a user working from home? That requires inspecting or injecting an HTTP header inside decrypted TLS. DNS cannot do it. Secure Access can, but only on the full SIA proxy path with SSL decryption enabled and the root certificate deployed. Zscaler can, with the proxy plus its data protection tier. dope.security does it on the device with Cloud Application Control, and the same agent feeds AI Analytics that break usage down by personal versus enterprise-licensed account so you can see the problem before you set the policy.

Prompt-level DLP follows the same pattern. Cisco's documented response DLP for AI is ChatGPT-centric; Zscaler's prompt DLP is an add-on; dope.security's Dopamine DLP reads the prompt or the attachment on the endpoint, classifies it by meaning rather than regex, and blocks or monitors it with zero data retention (US Patent 12,464,023). If AI governance is on your list, do not let the comparison stop at "does the vendor have an AI SKU." Ask what path the traffic takes and what you have to license to turn it on.

Migration effort: the honest comparison

Cisco wins on migration tooling if you stay in the family: the automated Umbrella-to-Secure Access tool carries policy objects over, and the Secure Client is already on many Umbrella endpoints. The cost is that you inherit a quote-based renewal and a product that Cisco is still integrating from several lineages. Zscaler requires a full redeployment: new Client Connector, new policy build, new PAC or tunnel design, and typically a professional-services engagement. Customers report multi-month timelines for mid-size environments.

dope.security also requires a new agent, but the deployment surface is small. The agent installs silently via Intune or Jamf with no manual configuration, policies are category and group based rather than tunnel based, and there is no PoP topology to design. A Fortune 100 customer scaled from 900 to more than 18,000 devices in a matter of weeks at roughly 3,000 devices per week, and Outreach Health secured 99 percent of its devices within one week. For an Umbrella customer, the practical sequence is: run dope.security alongside Umbrella in monitor mode, confirm category policy parity, cut over by group, then let the Umbrella subscription lapse before the January 2028 last-renewal date.

What we would do as an Umbrella customer

If you are DNS-only and want to stay DNS-only, Secure Access DNS Defense is the path of least resistance, with the understanding that you are choosing not to inspect 95 percent of your traffic. If you have decided you need full HTTPS inspection, compare Secure Access, Zscaler and dope.security on the five questions above, and insist on a proof of concept that measures latency from a home network, tests the corporate-versus-personal ChatGPT control, and shows the real quote with every module you need included. Two of the three options will route your users through a data center to do it. One will not. Start a free dope.security trial and run the test yourself, or book a 20-minute demo.

To restate the thesis in plain terms: leaving Umbrella for Secure Access or Zscaler swaps one vendor's detour for another's, and only an on-device SWG removes the detour while giving you the inspection depth Umbrella never had.

Frequently Asked Questions

Is Cisco Secure Access just Umbrella with a new name?

No. Secure Access is Cisco's SSE platform that absorbs Umbrella's DNS and SIG functions and adds ZTNA, VPN as a service, digital experience monitoring and AI usage controls. For DNS-only Umbrella customers it is a bigger architectural change than the name suggests, because full inspection requires tunneling traffic through Cisco's cloud. dope.security delivers the same inspection depth on the device instead.

How much does Cisco Secure Access cost per user?

Cisco has not published 2026 per-user list prices for Secure Access DNS Defense, SIA or SPA; pricing is quote-based through partners, and Cisco's own migration flyer tells customers to renew early to lock in pricing before increases. Any specific per-user figure you see online is an estimate. dope.security publishes its pricing and bundles SWG, Cloud Application Control and Dopamine DLP without per-module add-ons.

Is Zscaler faster than Cisco Secure Access?

Neither vendor publishes comparable latency figures, and both use the same cloud-proxy architecture, so performance depends mostly on how close your users are to a point of presence and how many inspection modules you stack. Both add a round trip to every request. dope.security removes the round trip by inspecting on the endpoint, which is why it claims up to 4x performance over legacy proxy SWGs.

Can Cisco Secure Access or Zscaler block personal ChatGPT while allowing the corporate account?

Yes, but each needs the full proxy path with SSL decryption, and Zscaler additionally needs its data protection add-on. Cisco's documentation states that DNS-only policy cannot do tenant control at all. dope.security's Cloud Application Control does it on the device in the base product and pairs it with AI Analytics that separate personal from enterprise-licensed accounts.

Does Cisco Secure Access work in China?

Cisco has no mainland China data center, so Secure Access users in China connect to PoPs outside the country, which adds latency and can be unreliable across the Great Firewall. Zscaler sells China coverage as a Premium or Plus uplift. dope.security inspects on the device, so it works in China with no additional fee and no data center dependency.

What is the deadline for leaving Cisco Umbrella?

Cisco's end-of-sale bulletin sets end of sale and end of software maintenance on January 31, 2027, the last renewal date on January 31, 2028, and the last date of support on January 31, 2029. Customers can keep running Umbrella until support ends, but no new features or maintenance releases ship after January 2027. Most teams we talk to plan their replacement decision for the first half of 2027 so they are not negotiating under deadline pressure.