How to Replace Zscaler ZIA: A Migration Guide to dope.security
.jpeg)
The short answer
You can replace Zscaler Internet Access (ZIA) with dope.security, an agent-based Zscaler alternative, in days instead of months. The migration has five steps:
- Start a free production trial with your Google or Microsoft SSO
- Map your Zscaler URL categories and policies to dope.console
- Deploy the dope.endpoint agent through your existing MDM (Intune, Jamf)
- Pilot with a small group, then expand in waves
- Remove the Zscaler Client Connector, PAC files, and tunnels
Because dope.security runs SSL inspection on the device, there are no GRE or IPsec tunnels to build and no data center to route through. Real customers have secured 99% of devices in one week and migrated 2,000 machines in two days.
The hardest part of leaving Zscaler is usually deciding to. The rest is pretty quick. (Still deciding? Start with the best Zscaler alternatives in 2026.)
Why migration from Zscaler is simpler than you think
Most teams assume replacing Zscaler will be as painful as deploying it. It isn't, because the architecture is fundamentally different.
Zscaler ZIA is a cloud proxy. To use it, you steer traffic from every user and every office into Zscaler's data centers using the Client Connector, PAC files, and GRE or IPsec tunnels. All of that plumbing has to be built, maintained, and eventually torn down.
dope.security is an on-device proxy. The dope.endpoint agent does the inspection itself, right on the laptop (here's how an on-device SWG works). There's nothing to steer and nowhere to route. Install the agent, and policy is live.
| What you manage | Zscaler (cloud proxy) | dope.security (on-device proxy) |
|---|---|---|
| Traffic steering | Client Connector, PAC files, forwarding profiles | None; the agent inspects locally |
| Network tunnels | GRE or IPsec per location | None |
| Where traffic is decrypted | Zscaler data center | On the device |
| Data center dependency | Yes; outages fail over to other regions | None; traffic flies direct |
| Policy propagation | Polling delay | Instant push to every device |
| Offline enforcement | Depends on connectivity to the cloud | Fallback mode with cached policies |
| Consoles to learn | Multiple | One (dope.console) |
| Endpoint footprint | Client Connector plus cloud | Less than 100 MB RAM |
Source: dope.security vs. Zscaler.
The result: fewer moving parts to migrate, and fewer to maintain once you're done. For the privacy angle, see on-device vs. cloud SSL inspection.
How to replace Zscaler with dope.security, step by step
Step 1: Start a free production trial
Sign in at dope.security with your Google or Microsoft corporate account. No payment method, no sales call. Your trial is a real production tenant, so when you buy, nothing gets rebuilt. One Fortune 100 customer converted its trial straight to a paid account with zero reconfiguration.
Step 2: Map your Zscaler policies
Export your current ZIA URL filtering rules, allow lists, and SSL inspection bypasses. Then recreate them in dope.console:
- URL filtering: choose allow, warn, or block for each of 80+ categories (URL filtering explained)
- Custom categories: rebuild any custom URL lists from Zscaler
- Per-group overrides: apply different policies to departments or teams
- SSL bypasses: add domains for apps that use certificate pinning
- Cloud App Control: restrict ChatGPT, Claude, Google, and Microsoft 365 to your corporate tenants
Tip: this is a great moment to clean up years of policy sprawl. Most teams find rules nobody remembers writing.
Step 3: Deploy the agent through your MDM
Push dope.endpoint to Mac and Windows devices with the MDM you already use, such as Microsoft Intune or Jamf (see the Intune and Jamf MDM playbook). Step-by-step instructions live in the dope.security user manual. Deployment can be silent, with no user action required.
Step 4: Pilot, then expand in waves
Start with IT and a few friendly power users. Watch the dope.console analytics, confirm policies behave as expected, and use the SSL error notifications to spot apps that need a bypass. Then roll out by department or region.
Step 5: Decommission Zscaler
Once devices are covered, uninstall the Zscaler Client Connector, retire PAC files and forwarding profiles, and shut down GRE or IPsec tunnels. Stream dope.security logs to your SIEM so your SOC keeps full visibility. For a longer runbook, see migrating from a cloud proxy SSE to on-device.
Typical Zscaler migration timeline
| Phase | Timing | What happens | Owner |
|---|---|---|---|
| Trial and policy mapping | Day 1 to 3 | SSO trial, recreate URL categories, CAC, and bypasses | IT / Security |
| Pilot | Week 1 | Deploy to IT and a pilot group via MDM; validate | IT |
| Wave rollout | Week 1 to 3 | Expand by department or region | IT |
| Decommission Zscaler | After full coverage | Remove Client Connector, PAC files, tunnels | IT / Network |
| Optimize | Ongoing | Add Dopamine DLP, AI Analytics, CASB Neural | Security |
Timelines vary by fleet size and change control. For reference, Outreach Health secured 99% of devices in one week, and a Fortune 100 company averaged about 3,000 devices per week.
What you gain after leaving Zscaler
| Outcome | What changes | Proof point |
|---|---|---|
| Speed | No data center detour; HTTP/2 on by default | Up to 4x faster than legacy proxy SWGs |
| Fewer tickets | Less broken browsing and fewer access issues | Outreach Health: 70% fewer web access IT tickets in 90 days |
| Faster policy changes | Instant push to every device, on-network or off | Outreach Health: policy changes went from days to minutes |
| Global coverage | Works on any network, in any country | Works in China and restricted regions |
| AI governance | Allow enterprise AI tenants, block personal accounts, inspect uploads | Cloud App Control plus Dopamine DLP, one console |
| Privacy | Traffic is decrypted on the device, not in a vendor's data center | SOC 2 Type 2, GDPR compliant |
"It's not just great, it's dope." (Outreach Health)
FAQ
How long does it take to migrate from Zscaler to dope.security?
Most teams are inspecting traffic on day one and finish rollout in one to three weeks. dope.security deploys through your existing MDM, with no tunnels or appliances. One customer secured 99% of devices in a week; another migrated 2,000 machines in two days.
Do I need to rebuild my Zscaler policies from scratch?
You recreate them in dope.console, and dope.security is preconfigured out of the box, so you're tuning rather than starting from zero. URL filtering uses 80+ categories with allow, warn, or block, plus custom categories and per-group overrides.
Is dope.security a full Zscaler ZIA replacement?
Yes. dope.security covers the core ZIA secure web gateway functions: SSL inspection, URL filtering, cloud app control, anti-malware, Shadow IT discovery, and DLP. The difference is that it runs them on the device instead of in a data center. Use the Zscaler replacement buyer's checklist to confirm coverage for your environment.
Does dope.security replace Zscaler Private Access (ZPA)?
Not today. dope.security replaces ZIA, the web gateway. A Fly-Direct VPN for private app access is coming soon.
Does dope.security work with my VPN and EDR?
Yes. dope.security works out of the box with VPNs and EDRs, and the support team (staffed by product engineers) will help confirm compatibility with your environment.
Can I test dope.security before I cancel Zscaler?
Yes. Start an instant trial with Google or Microsoft SSO, no payment method required. If your account stays active, the trial extends automatically.
Ready to fly direct?
The best Zscaler alternative is the one you can deploy before your next renewal meeting. Start a free production trial today, or let our team map your Zscaler policies with you.
Start your free trial or book a 20-minute demo.
.jpeg)
.jpeg)
.jpeg)
