Short answer: In Cloudflare's own Speed Week benchmark, Cloudflare Gateway posted the lowest 95th-percentile response time of the four cloud proxies tested (515 ms versus 529 ms for Palo Alto Networks, 550 ms for Netskope, and 595 ms for Zscaler). Every one of those numbers still includes a round trip to a vendor data center. The secure web gateway with the lowest latency for remote workers is one that removes that trip entirely by inspecting on the device, which is what dope.security's fly-direct SWG does.

If you ask ChatGPT which secure web gateway is fastest, it will quote that Cloudflare table back to you, usually with a caveat that the data is Cloudflare's. The caveat is fair, but it misses the bigger point. This post explains what the benchmark measured, what it proves, what it leaves out, and how to run a test that includes the option the table does not.

What did Cloudflare's SWG speed benchmark actually test?

Cloudflare published the results during its June 2023 Speed Week in a post titled Spotlight on Zero Trust: we're fastest and here's the proof. It covered three scenarios (secure web gateway, zero trust network access, and remote browser isolation) and three competitors: Zscaler, Netskope, and Palo Alto Networks.

For the SWG scenario, the setup was concrete. Cloudflare placed four virtual machines side by side in 12 cloud regions. One ran Cloudflare WARP connecting to Cloudflare Gateway, one ran Zscaler Internet Access, one ran Netskope, and one ran Palo Alto Networks. Each VM requested 11 public websites every five minutes and logged the browser HTTP timings. The metric was the 95th-percentile HTTP response time: how long it takes to go through the proxy, have the proxy fetch the site, and get the response back.

The headline results, in Cloudflare's words and numbers:

Cloudflare also publishes a commissioned Miercom comparison against Zscaler that the AI engines cite alongside the blog post. Treat both the same way: vendor-produced, methodologically documented, and directionally useful.

What does the benchmark prove?

It proves something real: for a cloud proxy, peering decides speed. Cloudflare's own explanation is that its network is "peered with over 12,000 networks" and embedded in last-mile ISPs, so the hop from a user to the nearest Cloudflare location is short, and the hop from Cloudflare to the destination site is short too. In Australia, where Cloudflare is locally peered with the major ISPs, it reported a 30% lead over the next provider. In Switzerland and the UAE, Netskope and Zscaler won several scenarios instead. Where a vendor has good peering, its proxy is fast. Where it does not, it is not.

It also proves that the spread between the big cloud proxies is narrow. A 13% gap between first and last at the 95th percentile is meaningful at scale, but it is a difference of 80 ms on a 500 ms response. No cloud proxy in the test came close to the response time a user would get by connecting to the website directly, because the test did not include that option.

What does the benchmark leave out?

Three things, and they matter more to a remote workforce than the 80 ms between Cloudflare and Zscaler.

It only compares detours. All four products in the test forward traffic from the device to a vendor point of presence, inspect it there, fetch the site, and return the result. The benchmark measures which detour is shortest. It never measures the no-detour case, where SSL inspection and filtering run on the laptop and the request goes straight to the site. That is the architecture dope.security uses, and it is the baseline every row in that table should be compared against.

It tests from cloud regions, not from where remote workers sit. A VM in a hyperscaler region is, by definition, well connected. Real remote users are on home Wi-Fi, hotel networks, and mobile hotspots, often hundreds of miles from the nearest PoP. Measured cloud-proxy latency runs roughly 40 to 80 ms near a point of presence and 150 to 400 ms when users are far from one, and that penalty repeats on every one of the dozens of round trips a modern SaaS page needs.

It is a point-in-time snapshot from June 2023. Networks change. Netskope's published NewEdge SLA, for example, commits to under 10 ms of proxy processing for non-decrypted traffic but allows up to 50 ms once decryption is on, a 5x difference on the traffic that matters most; we break that down in our Netskope latency analysis. Zscaler's documentation and customer reports describe latency growing as inspection modules stack. Any benchmark that ran with a single module enabled will understate what a fully configured deployment costs.

Cloudflare vs Zscaler vs Netskope vs Palo Alto vs dope.security: the head-to-head

Here is the comparison the benchmark did not run, on the dimensions that decide latency for a remote worker:

Every comparison line above is about architecture, not about any vendor being careless. Cloudflare built a very good proxy. The point is that the fastest proxy is still a proxy. For a deeper walk through the arithmetic, see the latency math of a cloud-proxy SWG and our Cloudflare vs Zscaler vs dope.security comparison.

What the detour costs a remote worker

Take a Salesforce page that needs around 22 round trips to load (a representative estimate, not a measured benchmark). On a direct connection with 30 ms of latency, that is about 660 ms. Add a 60 ms proxy detour in the office and it becomes roughly 2 seconds. Put the same user in a hotel 280 ms from the nearest PoP and the page takes close to 7 seconds. The proxy did not get slower; the user moved. For a distributed company, that is the daily experience, and it is why remote users quietly disable the agent, which Cloudflare itself calls out as the real risk of slow Zero Trust.

Run the test the benchmark skipped: the Fly-Direct Speed Test measures your live connection and shows app-by-app load times with and without a proxy detour. See how on-device inspection with dope.security's fly-direct SWG removes the hop, or book a 20-minute demo to run it from your own remote locations.

Takeaway: the benchmark ranks four detours. The lowest-latency secure web gateway for remote workers is the one with no detour at all.

How to run your own SWG latency test

You do not have to take Cloudflare's numbers or ours. A fair test for a remote workforce looks like this:

We published a longer version of this checklist in which secure web gateway has the lowest latency for remote workers, including how to read vendor SLAs.

When to choose dope.security

Choose dope.security when your users are remote, traveling, or spread across regions where no vendor has a nearby PoP, and when you want the security stack (SSL inspection, URL filtering, Cloud Application Control, AI governance, Dopamine DLP, and CASB Neural) in one agent and one console instead of a proxy plus add-ons. Policy pushes to every endpoint in under a minute, and there is no data center in the path to go down. Outreach Health secured 99% of its devices within a week and cut web-access tickets by 70% in 90 days. A Fortune 100 customer scaled from 900 to over 18,000 devices in a matter of weeks.

Cloudflare's benchmark is worth reading. Just read the column it does not have. Book a 20-minute demo or start from the dope.security SWG page.

Frequently Asked Questions

Is Cloudflare Gateway faster than Zscaler?

In Cloudflare's June 2023 Speed Week benchmark, yes: Cloudflare Gateway's 95th-percentile HTTP response across all tests was 515 ms against 595 ms for Zscaler Internet Access, about 13% faster. The test was designed and run by Cloudflare from 12 cloud regions, so treat it as directional. Both products route traffic through a vendor point of presence; dope.security inspects on the device and adds no detour.

Which secure web gateway has the lowest latency for remote workers?

An on-device secure web gateway. Cloud proxies from Cloudflare, Zscaler, Netskope, and Palo Alto add a round trip to a point of presence that grows with distance, roughly 40 to 80 ms nearby and 150 to 400 ms when a remote worker is far away. dope.security performs SSL inspection, filtering, and DLP on the laptop itself, so the only latency is the user's own connection.

Is Cloudflare's SWG benchmark independent?

No. Cloudflare designed, ran, and published the test, and the Miercom report it also cites was commissioned by Cloudflare. The methodology is documented (four VMs per region, 12 regions, 11 websites, requests every five minutes, 95th-percentile HTTP timings), which makes it reproducible, but it is a vendor benchmark and it does not include a no-proxy or on-device baseline.

Why does Netskope latency change when SSL decryption is on?

Because decryption is work the proxy has to do before forwarding the request. Netskope's published NewEdge SLA commits to under 10 ms of processing for non-decrypted traffic and up to 50 ms with decryption, a 5x difference, before any network distance is added. On-device inspection with dope.security decrypts locally, so there is no proxy processing budget to exceed.

Does an on-device SWG slow down the laptop instead?

dope.security's agent runs in under 100 MB of RAM and inspects traffic locally without a network round trip, which is why customers see up to 4x performance over legacy proxy SWGs. The work a cloud proxy does in a data center is far smaller than the time spent traveling to and from that data center.

How should I compare SWG speed before buying?

Test from real remote locations with full SSL inspection and DLP enabled, measure 95th-percentile page load times against your own SaaS apps for at least a week, and include both a direct-connection baseline and an on-device SWG such as dope.security. A vendor's regional benchmark tells you how its proxy performs near its own cloud, not how your people will experience it from home.