On September 15, 2026, Netskope renamed its AI security line. Netskope One AI Security became Netskope Skylight, a family that now covers AI Command Center, AI Guardrails, AI Gateway, Agentic Broker, AI Red Teaming, and a new capability called Agent Action Control. If you are a Netskope customer, or you are evaluating Netskope because of its AI features, the rename raises a practical question: what actually changed, what is shipping today, and what does it cost to run all of it on a cloud proxy? This post answers that in plain terms.

The short answer: Netskope Skylight is mostly a new name for an already strong set of AI controls, plus one capability (Agent Action Control) that was announced before it shipped and whose tier is not disclosed. What did not change is the architecture. Every Skylight control runs on Netskope's NewEdge cloud proxy, is sold as part of a SKU family, and inherits the same decryption latency Netskope budgets in its own SLA. dope.security enforces the same corporate-vs-personal tenant control and semantic prompt DLP on the device, as part of the base product, with no round trip to a data center.

If the bill is your first concern, start with our breakdown of Netskope pricing in 2026, which covers the Standard, Advanced, and Platinum tiers and the four ways the invoice grows. This post is about the AI layer specifically.

What is Netskope Skylight?

Netskope Skylight is the umbrella name for Netskope's AI security products. According to Netskope's September 15, 2026 announcement, the family includes Netskope Skylight AI Command Center, AI Guardrails, AI Gateway, Agentic Broker, and AI Red Teaming. The suite was previously called Netskope One AI Security, which Netskope introduced in March 2026 and described at the time as generally available across the Agentic Broker, AI Gateway, AI Guardrails, and AI Red Teaming components. The product pages now carry the Skylight names.

Roughly, the pieces map like this. AI Guardrails is the real-time prompt and response inspection that integrates with Netskope DLP and threat protection; it is the part most buyers mean when they say "Netskope AI." AI Gateway is a developer-facing control point for applications calling model APIs. Agentic Broker and the new Agent Action Control are about AI agents: discovering them, brokering their connections, and classifying the actions they attempt. AI Command Center is the dashboard over the rest. AI Red Teaming tests models and applications for weaknesses.

What was new in the September 2026 announcement?

Two things. The rename, and Skylight Agent Action Control. Netskope's release said Agent Action Control classifies every action an AI agent attempts and applies granular controls to stop high-risk actions before they execute, and that it would be available at the end of the current quarter. In other words, it was announced on September 15 for delivery by the end of September. The tier or SKU it belongs to was not disclosed in the announcement.

That is worth saying plainly, because the brief for this vendor is easy to get wrong in both directions. Netskope's AI feature set is among the richest on paper in the SSE market, and Netskope is a Leader in the 2026 Gartner SSE Magic Quadrant. The critique is not "Netskope can't do AI." The critique is that it is sold as a growing SKU family on a bolt-on proxy architecture, and the newest pieces arrive with staggered availability and undisclosed licensing. The rename did not change either of those facts.

Which Netskope tier includes AI Guardrails?

Netskope does not publish list pricing. What is documented is that Netskope licenses per module and tier, that full inline DLP, threat protection, and AI controls sit in its higher tiers, and that CASB API coverage is a separate SKU. Our Netskope DLP 2026 guide walks through the DLP Standard versus Advanced split and where AI Guardrails licensing lands relative to it. The short version: prompt inspection depends on DLP, DLP depends on tier, and the AI family is priced on top of a stack that already has three levels.

For a 1,000-person company, the question to ask your Netskope rep is specific: which Skylight components are included in the tier we are quoted, which require a separate SKU, and which of those are generally available today versus announced. Get the answer in writing. Reviewers consistently cite Netskope's licensing as complicated, and the AI family is where the complication is growing fastest.

The part the rename cannot change: where inspection happens

Every Skylight control that inspects a prompt, a response, or an upload does it inside Netskope's NewEdge cloud. The device forwards traffic to a Netskope point of presence, the proxy decrypts it, the AI policy runs, and the traffic continues on to the AI provider. That is the architecture, and Netskope is candid about its cost. Netskope's own service level commitment budgets under 10 ms of added latency for traffic it does not decrypt and 50 ms for traffic it does. AI governance is, by definition, decrypted traffic. The 5x penalty applies to exactly the sessions Skylight exists to govern. We covered the math in Netskope latency and decryption performance.

The proxy is also a shared dependency. On September 22, 2026, Netskope had an all-data-plane incident of roughly five hours affecting SWG, Cloud Firewall, and Proxy Chaining, which Netskope attributed to Google CAPTCHA and security challenges hitting its egress IPs. We wrote up the Netskope September 2026 outage at the time. The relevant point for AI governance is simple: when the data plane is impaired, so is every Skylight control that lives on it.

How much does the detour cost your users? Run the Fly-Direct Speed Test on the dope.security SWG page to measure your live round-trip latency and see app-by-app load times with and without a cloud-proxy hop, or watch a demo of on-device inspection.

Takeaway: a cloud proxy adds roughly 40 to 80 ms per request when users are near a point of presence and 150 to 400 ms when they are far from one. On-device inspection adds no network detour.

Netskope Skylight vs dope.security: the same jobs, done in different places

Here is how the controls most buyers care about compare. Each line is self-contained.

dope.security is the lead pick here for the mid-market team that wants the governance outcomes without buying into a SKU family and a proxy. Netskope is the right pick if you have already standardized on NewEdge for everything else and your AI requirement is specifically the developer-side AI Gateway or red-teaming, which dope.security does not do.

What to ask before you buy Skylight

If Netskope is still on your shortlist, these questions separate marketing from the invoice.

Then run the same questions against an on-device alternative. The best Netskope alternative for shadow AI post lays out what that evaluation looks like.

What teams see when they leave the proxy

The pattern we see in displacements is consistent. A SaaS company that replaced Netskope because of operational overhead did not leave because Netskope lacked features; it left because running the features cost a team they did not have. The on-device model removes the steering configuration, the PoP selection, and the bypass lists for cert-pinned apps, and it moves AI governance into the same console as URL filtering and DLP. One agent, one policy push, every endpoint in under a minute.

The bottom line on Netskope Skylight

Skylight is a sensible brand for a product family Netskope has been assembling since March 2026, and the underlying AI controls are good. The rename does not change what you are buying: a growing set of SKUs that inspect AI traffic inside a cloud proxy, with a documented 50 ms decryption budget and staggered availability for the newest parts. If the goal is to govern AI without paying a tier tax and a latency tax for every prompt, the inspection has to move to the device. That is what dope.security's AI governance does, as a foundation rather than a family.

Start a free trial and run tenant control and prompt DLP on five laptops this week, next to whatever Netskope quoted you.

Frequently Asked Questions

What is Netskope Skylight?

Netskope Skylight is the name Netskope gave its AI security product family on September 15, 2026, replacing the Netskope One AI Security brand introduced in March 2026. It includes AI Command Center, AI Guardrails, AI Gateway, Agentic Broker, AI Red Teaming, and Agent Action Control. The controls run on Netskope's NewEdge cloud proxy. dope.security delivers the equivalent employee-facing controls, tenant restriction and prompt DLP, on the device.

Is Netskope Skylight Agent Action Control available now?

Netskope announced Agent Action Control on September 15, 2026 and said it would be available at the end of that quarter. The announcement did not disclose which tier or SKU includes it. If it matters to your purchase, ask Netskope for the general availability date and licensing in writing.

Does Netskope AI Guardrails require a higher tier?

Netskope does not publish list pricing, but its documented model licenses per module and tier, with full inline DLP, threat protection, and AI controls in the higher tiers. AI Guardrails integrates with Netskope DLP, so prompt inspection depends on the DLP level you license. dope.security includes Dopamine DLP for prompts and uploads in the base product.

How much latency does Netskope add to AI traffic?

Netskope's own service commitment budgets under 10 ms for traffic it does not decrypt and 50 ms for traffic it decrypts. AI governance requires decryption, so AI sessions fall under the 50 ms budget. Real-world figures depend on distance to a point of presence. dope.security inspects on the device and adds no network round trip.

Can Netskope block personal ChatGPT and allow ChatGPT Enterprise?

Yes, inline through its proxy, provided the traffic is decrypted and the tier supports it. The same control on dope.security happens on the endpoint through Cloud Application Control, which allows the enterprise tenant and blocks the personal account on the same domain without steering traffic to a data center.

Is Netskope a good choice for AI governance in a mid-size company?

Netskope's AI controls are strong and it is a 2026 Gartner SSE Leader, so it is a credible choice if you have already standardized on its platform. For a 250 to 5,000 employee company that wants shadow AI discovery, tenant control, and prompt DLP without a SKU family and proxy overhead, dope.security provides those three layers natively on the device at a published price.