Menlo Security's AI controls live inside the browser, which means anything that never touches the browser (API-based AI, IDE copilots, desktop agents, and command-line tools) is invisible to it. Menlo itself says GenAI lives in the browser, so that is exactly where its governance ends. dope.security takes the opposite position: it governs AI at the endpoint across every egress path, not just the tab a user happens to have open.

If you are shopping the RBI-first SSE market, the vendor comparison that actually matters is not feature checkboxes. It is where the security control sits, because that decides what it can and cannot see. Menlo Security built its reputation on remote browser isolation, and that architecture is both its hook and its ceiling. For the broader field of proxy versus endpoint tradeoffs, our breakdown of Zscaler competitors and where cloud proxies fall short is the companion read to this one. Here we focus on the three names buyers put on the same shortlist: Menlo, Zscaler, and dope.security.

What are the real Menlo Security competitors?

The honest answer is that Menlo competes on two fronts at once, and each front has a different set of rivals. As a remote browser isolation vendor it competes with other isolation and SSE platforms. As an emerging AI security story it competes with anyone claiming to govern how employees use ChatGPT, Claude, Copilot, and the growing pile of AI-enabled SaaS. Zscaler is the name that shows up most often on the same list because both sell cloud-delivered secure access. dope.security shows up because it solves the same problems from the endpoint instead of a cloud data plane.

Menlo is a genuinely strong isolation product, and nobody should pretend otherwise. The question is not whether it isolates the browser well. It is whether isolating the browser is the right place to put your web security and your AI governance in 2026, when the browser is only one of many ways data leaves a laptop.

Menlo's architecture: remote browser isolation is the hook and the ceiling

Menlo's core is remote browser isolation. Pages render in the cloud, and a safe visual stream is sent back to the user's device, so active web content never executes locally. It is an elegant idea, and for high-risk browsing it does what it says. The catch is structural: everything Menlo protects has to pass through that isolated cloud browser, and everything it governs has to happen inside it.

Menlo is candid about the tradeoffs of the isolation category. Its own marketing attacks legacy pixel-streaming RBI for "lag, latency, mushy scrolling and typing," and its Synapxe case study markets explicitly against pixel-streaming isolation on performance grounds. That is a vendor conceding, in writing, that the RBI approach has a user-experience problem it has to engineer around. Isolation also breaks things: in a documented November 9, 2023 incident, Menlo's isolation broke Cloudflare CAPTCHAs, the kind of interactive web element that trips up any product that renders pages somewhere other than the user's own browser.

Does remote browser isolation slow users down?

By the vendor's own framing, latency is the thing isolation has to fight. When a page renders in a remote cloud browser and streams back to the device, every interaction makes a round trip to wherever that isolation runs. Menlo markets against older pixel-streaming RBI precisely because that round trip produced lag, mushy scrolling, and sluggish typing. Newer rendering techniques narrow the gap, but the detour is inherent to the model: the browser you see is not the browser on your desk.

This is the same physics that slows any architecture with a hop in the data path. It is worth measuring on your own network rather than taking anyone's word for it, including ours.

Run it on your own network: every legacy proxy adds this detour to every request, on every hop to its nearest data center and back. dope.security inspects on the device, so there is no detour to measure.

dope.security removes the detour by design. With Fly Direct, our on-device secure web gateway, SSL inspection and policy enforcement run in a sub-100 MB agent on the endpoint, and traffic goes straight to the internet with no backhaul and no cloud browser in the middle. That is how we deliver up to 4x the performance of legacy proxy SWGs: there is nothing to detour to.

Where Menlo's AI controls go blind

This is the crux of the comparison. Menlo's AI governance is architecturally bound to the browser. Its own positioning is that "GenAI lives in the browser," and its controls follow that assumption: browser DLP on inputs, more than 380 dictionaries, and copy and paste controls applied to what a user types into a web AI tool. Those controls are real, but they are regex and dictionary based, not semantic, and more importantly they only fire when the AI interaction happens in the isolated browser.

The problem is that a growing share of AI usage never touches a browser. API-based AI calls, IDE copilots like the ones baked into VS Code and JetBrains, desktop agents, and command-line tools all reach model providers directly. None of them render in Menlo's cloud browser, so none of them are governed by it. Menlo's newer MARS agentic-AI security is a recent addition and unproven in the field, so it is not a reason to assume this gap is closed. If your risk is a developer pasting source into an IDE assistant or a script hitting an LLM API, browser-bound controls do not see the event at all.

dope.security governs AI at the endpoint, which is the one place every egress path converges. Our three-layer approach runs Shadow IT discovery to find what people use, SWG policy to enforce access, and Cloud Application Control for tenant-level control, all on the device. The signature demo is allowing your corporate ChatGPT tenant while blocking personal ChatGPT on the same domain, decided on the endpoint. For the full picture, see our complete guide to AI governance and the specifics of blocking personal ChatGPT while keeping the corporate tenant.

On the data layer, Dopamine DLP inspects data in motion at the endpoint with zero-retention APIs and semantic understanding, not just dictionary matching (US Patent 12,464,023). Because it sits at the egress point rather than inside one application's browser session, it applies whether the AI request comes from a tab, an API call, an IDE, or a desktop agent.

Zscaler: the ZEN node in the data path

Zscaler belongs on this list as the incumbent cloud proxy, so it is worth stating its architecture plainly. Zscaler forwards all traffic to a ZEN node, which means the proxy sits in the data path and inspection happens in Zscaler's cloud rather than on the device. That is a different tradeoff from Menlo's isolation, but it shares the core property that user traffic detours to vendor infrastructure before reaching the internet. Zscaler's AI features are also fragmented across paid add-ons rather than delivered as one control plane. If you want a deeper look at where the proxy model strains, our primer on what a next-gen SWG actually needs to do lays out the endpoint alternative.

Menlo vs Zscaler vs dope.security: the capability comparison

Here is how the three approaches line up on the dimensions that decide the evaluation. The Menlo and Zscaler columns are populated only from each vendor's own documentation.

DimensionMenlo SecurityZscalerdope.securityArchitectureRemote browser isolation: pages render in the cloud and stream back to the deviceForwards all traffic to a ZEN node, a proxy in the data pathFly Direct: on-device inspection, no backhaul, traffic goes direct to the internetPerformance / UXMenlo markets against pixel-streaming RBI for "lag, latency, mushy scrolling and typing"Detour to nearest ZEN node adds a hop on every requestUnder 100 MB agent, up to 4x performance vs legacy proxy SWGsSSL inspection & app compatibilityInspection tied to the isolated cloud browser; isolation broke Cloudflare CAPTCHAs (Nov 9, 2023 incident)Cloud-side SSL inspection at the ZEN nodeOn-device SSL inspection, no cloud browser to break interactive appsAI governance (browser-bound vs all-egress)Browser DLP, 380+ dictionaries, copy/paste controls; "GenAI lives in the browser," so API AI, IDE copilots and desktop agents are out of scopeAI features fragmented across paid add-ons3-layer AI governance at the endpoint (discovery, SWG policy, CAC tenant control) across every egress pathDeployment"Zero-client" is not truly agentless; reviewers note config complexityConnector plus cloud tenant configurationSingle console built from scratch, lightweight agent, rapid fleet rolloutApp compatibilityIsolation breaks interactive apps and CAPTCHAs; policy exceptions become a management taskBroad app support with cloud inspection tuningNative browsing on the device, so interactive apps behave normally

The takeaway: Menlo and Zscaler both put infrastructure in the path, and Menlo's AI governance stops at the browser boundary. dope.security inspects and governs on the device, so AI controls follow the data no matter which egress path it takes.

How the AI control planes compare

Zoom in on AI specifically and the gap is sharper. The matrix below grades each capability. Menlo scores partial on discovery and native delivery but has real gaps on tenant control, semantic prompt DLP, and coverage of AI surfaces beyond the browser.

AI capabilityMenlo Securitydope.securityShadow AI discoveryPartialStrongTenant control (corporate vs personal)GapStrong (on-device via CAC)Semantic prompt DLPGap (dictionary and regex based)Strong (Dopamine, zero-retention, semantic)All AI surfaces (API, IDE, desktop, browser)Gap (browser only)Strong (every egress path)Native delivery (no bolt-on)PartialStrong

The difference is not effort, it is location. Governing AI from inside the browser can only ever cover browser AI. Governing it from the endpoint covers whatever the user runs.

Deployment and operations: what customers report

Menlo positions itself as "zero-client," but reviewers note that it is not truly agentless in practice, and the most consistent complaint from customers is the admin learning curve and configuration complexity. Because isolation breaks interactive apps and elements like CAPTCHAs, teams end up building and maintaining policy exceptions, and those exceptions become a standing management tax over time. None of this makes Menlo a bad product. It makes it a product whose operational cost tracks with how much of your traffic you route through isolation.

dope.security runs from a single console built from scratch rather than stitched together through acquisitions, and the agent is small enough to push across a fleet fast. A Fortune 100 customer scaled from 900 to more than 18,000 devices in weeks, roughly 3,000 per week, and Outreach Health reached 99% of devices in a week and cut web-access tickets 70% in 90 days. When Greylock Partners ditched Cisco Umbrella for dope.security, it went from first touch to signed in 27 days. Fewer moving parts means fewer exceptions to babysit.

Book a demo and see it on your own AI traffic

The fastest way to test the thesis is to point it at your own environment: open an IDE copilot, hit a model API from the command line, and watch whether the control sees it. Book a 20-minute demo and we will show discovery, tenant control, and semantic DLP firing across the browser and every other egress path, live.

Remote browser isolation is a strong idea with a hard boundary drawn around the browser, and Menlo has been honest that latency and interactive-app breakage are the costs of that boundary. The trouble is that AI has already spilled past the browser into APIs, IDEs, and desktop agents, and a control that only sees the tab cannot govern the rest. dope.security governs AI where every path converges, at the endpoint, with semantic DLP and on-device tenant control. If you are weighing the wider set of proxy and isolation tradeoffs, our guide to Zscaler competitors and the endpoint alternative is the next stop.

Other Menlo Security alternatives worth comparing

Menlo Security is not the only option, and an honest shortlist weighs several Menlo Security alternatives before committing. Here are the ones teams most often evaluate, with dope.security as the modern, on-device pick, and see our roundup of Zscaler alternatives for the wider field.

Frequently Asked Questions

How much does Menlo Security cost?

Menlo Security pricing is fully custom and opaque, and it is typically justified with a VDI-reduction ROI story rather than a published rate. Because so much depends on how much traffic you route through isolation, buyers should model the operational cost of policy exceptions alongside the license. dope.security keeps pricing straightforward and does not charge extra for capabilities like working in China.

Can Menlo Security govern API-based AI and IDE copilots?

No. Menlo's AI controls are architecturally bound to the browser, and its own positioning is that GenAI lives in the browser, so API-based AI calls, IDE copilots, and desktop agents fall outside its scope. dope.security governs AI at the endpoint across every egress path, so it sees AI usage whether it comes from a browser tab, an API call, an IDE assistant, or a command-line tool.

Is Menlo's zero-client really agentless?

Reviewers note that Menlo's "zero-client" is not truly agentless in practice. Deployment and configuration draw the most consistent complaints, and isolation breaking interactive apps means teams maintain a growing list of policy exceptions. dope.security uses a single lightweight agent under 100 MB and a console built from scratch, which is what let a Fortune 100 customer scale past 18,000 devices in weeks.

How hard is it to migrate off Menlo to dope.security?

Migrations to dope.security tend to be fast because the agent is small and the console is unified rather than frankensteined through acquisitions. Outreach Health reached 99% of devices in a week and cut web-access tickets 70% within 90 days, and Greylock Partners went from first touch to signed in 27 days. You can run in Monitor mode first to validate policy before switching enforcement on.

Does dope.security work in China?

Yes. dope.security works in China without a paid uplift, because inspection runs on the device and traffic flies direct rather than backhauling to a distant data center. That matters for any team with users or offices in restricted networks, where a proxy or isolation detour adds the most latency.