Replacing Zscaler in 2026: The Buyer's Checklist for Upgrading to On-Device SWG

Replacing Zscaler in 2026 comes down to one question: another cloud-proxy SWG vendor, or a change of architecture? This buyer's checklist scores Zscaler ZIA alternatives against eight 2026 requirements and explains why Forcepoint, Netskope, and Cisco Umbrella SIG behave much like Zscaler on most of them. We make an on-device SWG, so the list leans toward what that architecture is built for: on-device SWG (dope.SWG) is designed to meet all eight, with AI governance for ChatGPT, Claude, Gemini, and Copilot built in. If ZTNA in the same contract is one of your requirements, weigh the cloud-proxy suites accordingly.

Disclosure: dope.security makes an on-device secure web gateway and competes with vendors discussed in this post. We've linked independent sources so you can check our claims.

Why Zscaler customers are running this evaluation in 2026

Five reasons keep surfacing in renewal conversations.

Renewal pricing climbs at every cycle. Zscaler quotes routinely come in with double-digit percentage increases. The headline ZIA tier is rarely the deployed price after add-ons.

Multi-SKU SSE bundle. ZIA, ZPA, ZDX, plus Sandbox, B2B, Risk360, and Workflow Automation add-ons. The deployed price is the bundle plus add-ons.

PoP-induced latency. Every request detours through a Zscaler PoP. For hybrid and remote workers, the cost compounds.

China and APAC coverage. Cloud-proxy SSE struggles in restricted geographies. Workarounds add operational lift.

AI governance gaps. Partial tenant control across ChatGPT, Claude, Gemini, and Copilot. Endpoint DLP for prompt content is limited.

What Zscaler gets right

Before scoring alternatives, it's worth being clear about the incumbent. Zscaler was named a Leader in the 2025 Gartner Magic Quadrant for SSE and ranked No. 1 on Ability to Execute, according to ISMG; Gartner credited the leaders for early cloud-delivered security and platform unification. For large enterprises that want SWG, ZTNA and digital experience monitoring from one mature vendor, that track record counts for a lot, and few platforms match its breadth. The trade-off buyers raise most often is cost predictability: add-on modules such as Sandbox, Risk360 and ZDX are priced separately, so renewal quotes can grow beyond the headline tier.

The eight-point Zscaler replacement checklist

Score each candidate platform against these eight architectural requirements.

How each platform category scores

Cloud-proxy SWG alternatives (Zscaler ZIA, Forcepoint ONE, Netskope, Cisco Umbrella SIG, Symantec WSS)

Score: 0/3 on the structural requirements (1, 5, 7). They share the architectural ceiling that drove the alternative search in the first place. Renewal pricing tracks data center cost trajectory. AI governance ships as partial tenant control and policy-based cloud DLP. Where they score better: if integrated ZTNA or SD-WAN belongs on your checklist, these suites include it.

DNS-only alternatives (Cisco Umbrella DNS, DNSFilter, TitanHQ)

Score: Don't qualify. Zscaler customers already have HTTPS inspection. Stepping back to DNS-only loses payload visibility and kills AI prompt-content DLP.

On-device SWG (dope.SWG)

Score: designed to meet all eight. HTTPS inspection on the endpoint, tenant-level Cloud Application Control, Dopamine DLP for AI prompts and uploads, one agent and one console, Mac and Windows native, deployment in days, no PoP routing, transparent per-device pricing. Not on this list, and worth checking against your own: dope.security has no built-in ZTNA today, and it covers Mac and Windows endpoints.

Pricing trajectory: why Zscaler renewals climb

The pricing conversation is the one that gets Zscaler customers into the eval. Three structural facts shape it.

Vendor data center economics flow into renewal pricing. Cloud-proxy SSE vendors operate global PoP footprints. Power, cooling, real estate, bandwidth, and chip refresh cycles all show up in the renewal model. Rising data center costs and SASE/SSE pricing walks through the trend.

The headline tier isn't the deployed price. Zscaler ZIA Essentials looks cheap on paper. The deployed enterprise price layers in ZIA Business, Sandbox, B2B, ZPA for ZTNA, ZDX for digital experience, Risk360, and Workflow Automation. By renewal, the bundle is rarely under what the customer initially budgeted.

On-device SWG decouples pricing from infrastructure. dope.SWG runs in the agent. There's no vendor PoP fleet to pass through. dope.SWG ships at $60 per device per year, one SKU, with SWG, CAC, anti-malware, and Dopamine DLP under the same license. Detail: Zscaler real pricing comparison.

Hybrid work and the off-network scenarios where on-device wins

Cloud-proxy SWG was designed for an office-first world. In 2026, with hybrid work dominant, the PoP detour becomes the visible problem on every off-network connection.

Home and hotel wifi. Every page load goes through the vendor PoP. The detour compounds the underlying latency on slow connections. On-device enforcement runs locally with no detour.

International travel. Cloud-proxy SSE struggles in restricted geographies, notably China. Backhauled connections get throttled, deep-packet-inspected, or blocked. dope.SWG enforces on the endpoint and doesn't depend on a remote PoP.

PoP incidents. When a vendor PoP slows down or has an incident, every user feeding it slows with it. On-device enforcement isolates the failure domain to a single device.

AI governance: ChatGPT, Claude, Gemini, and Copilot

The 2026 buyer leaving Zscaler usually wants real controls around the four AI tools the workforce uses every day. Zscaler ships partial tenant control and cloud DLP for AI. dope.SWG ships purpose-built Cloud Application Control (CAC) for all four out of the box, plus Dopamine DLP on the prompt content itself.

ChatGPT (OpenAI). Allow your enterprise ChatGPT Team or Enterprise tenant; block personal accounts. Walkthrough.

Claude (Anthropic). Allow your enterprise Claude Team or Enterprise tenant; block personal Claude.ai. Walkthrough.

Gemini (Google). Tenant-level control via Google Workspace. Allow enterprise Workspace; block personal Google accounts.

Microsoft Copilot. Tenant-level control via Microsoft 365. Allow enterprise M365; block personal Microsoft and Outlook accounts.

The three-layer model: Shadow AI discovery, SWG policy, CAC tenant restriction. Combined with Dopamine DLP on prompt content. Cloud-proxy SWGs ship partial pieces; on-device SWG ships the full stack.

China and the international scenario where on-device wins

The international scenario is where on-device wins most visibly. Cloud-proxy SSE has been an ongoing pain point in China for years because backhauled connections to vendor PoPs outside the country get throttled, deep-packet-inspected, or blocked at the border. The user experience falls off a cliff. Solutions usually involve regional PoP detours, dedicated tunnels, or bypass rules, none of which scale operationally and most of which weaken the security posture they were meant to enforce.

dope.SWG enforces on the endpoint. There's no remote PoP to reach. The user's traffic flies direct from the laptop to its destination, inspected locally. China-based users get the same enforcement as users in any other geography, with no special exception list to maintain. Same goes for users in sanctioned regions or in markets where the nearest cloud-proxy PoP is in another country.

Why moving to Forcepoint, Netskope, or Cisco SIG is a sidegrade

Five structural reasons.

1. Architecture stays the same. All four are cloud-proxy SWGs.

2. Renewal cost exposure stays the same. Vendor data center economics flow into renewal pricing for any cloud-proxy SSE.

3. Geographic dead zones stay the same. China and sanctioned regions degrade the same way.

4. Multi-SKU pricing stays the same. SWG, CASB, ZTNA, DLP, and add-ons all licensed separately.

5. The trust transfer stays the same. Every cloud-proxy SWG decrypts HTTPS payloads inside the vendor's data center.

Customer evidence

Greylock Partners. Replaced a cloud-routed SWG for dope.security. 27 days first proposal to signed contract. Deployment via Intune in a phased rollout.

Outreach Health. Healthcare, 5k-10k employees, 34 offices in TX, AZ, and MA. Replaced a legacy SWG. 99% of devices secured within one week. 70% reduction in web access-related IT tickets in 90 days.

City of Visalia. 700+ user government workforce. On-device SSL decryption with no data center backhaul.

A VC firm. 2,000 machines migrated off a cloud-proxy SWG in two days.

Fortune 100 deployment. 18,000+ devices secured. The architectural case at scale.

"The Zscaler renewal came in 18% higher with no new features. We ran the eval, drew the data-plane diagrams, and realized every cloud-proxy lookalike had the same picture. [...]"
By a CISO, mid-market organization.

Teams whose renewal pain traces back to PoP infrastructure may find on-device the option worth piloting first; teams that need ZTNA in the same contract will score it differently.

The migration playbook from Zscaler to dope.SWG

Six concrete cutover steps. Real-world deployments have finished in days, not months.

Step 1: Inventory current Zscaler scope. ZIA, ZPA, ZDX, plus any add-ons (Sandbox, B2B, Risk360, Workflow Automation). PAC files, GRE tunnels, IPsec tunnels, ZApp deployments. The SKU map drives both the capability comparison and the renewal math.

Step 2: Map AI governance asks across ChatGPT, Claude, Gemini, and Copilot. For each AI tool, decide: allow only the enterprise tenant (worth choosing when you've paid for an enterprise workspace), block entirely, or allow with prompt-content DLP. dope.SWG ships out-of-the-box Cloud Application Control for all four, plus Dopamine DLP on the prompt content itself.

Step 3: Scope endpoint DLP channels. AI prompts, SaaS uploads, copy-paste, file movement to personal cloud. Meet Dopamine DLP.

Step 4: Plan MDM rollout. dope.endpoint deploys via Intune, Jamf, Kandji, or any standard MDM tooling. Pilot first, then expand by department, then full fleet.

Step 5: Phase the Zscaler cutover. Pilot in parallel with Zscaler to validate policy behavior, then expand. Remove ZApp from devices and decommission PAC files, GRE tunnels, and IPsec tunnels at the network edge.

Step 6: Reclaim the renewal. One SKU at $60 per device per year replaces multi-product Zscaler bundles. The renewal conversation gets shorter, the SKU count drops, and the spend usually drops with it.

The non-technical reason it sticks

Architecture wins the eval, but support wins the rollout. dope.security's 24/7 white glove global support team is the reason migrations finish on schedule. Phased rollout questions land on a human, not a ticket queue. For a lean security org that's already stretched, that's not a soft benefit. It's the practical reason the cutover sticks.

FAQ: replacing Zscaler

Can I replace Zscaler with Forcepoint?

You can. The architecture stays the same: cloud-proxy SWG with PoP backhaul.

What's the fastest way to replace Zscaler?

For most fleets, an agent pushed through MDM is the quickest path, because there are no PoP tunnels to re-plan. Outreach Health hit 99% device coverage in a week. A VC firm migrated 2,000 machines in two days.

Do I need to keep my DLP product when I move to on-device SWG?

Not necessarily for web and AI channels: Dopamine DLP covers endpoint DLP for AI prompts, file uploads, and SaaS movement. Check whether your current DLP also covers channels outside the web path, such as email, before retiring it.

What does on-device SWG cost compared to Zscaler ZIA?

dope.SWG is $60 per device per year, one SKU. Zscaler ZIA bundles vary by tier and add-ons.

Is dope.security a real alternative to Zscaler at enterprise scale?

Real-world references include a Fortune 100 deployment of 18,000+ devices, Outreach Health, Greylock Partners, the City of Visalia, and a VC firm 2,000-machine migration.

Related reading

• Secure Web Gateway 2026: Fly-Direct SWG
• Zscaler real pricing comparison
• Cisco Umbrella vs Zscaler
• Forcepoint vs Zscaler, Netskope, Cisco
• Rising data center costs and SSE pricing
• Greylock Partners customer story
• Meet Dopamine DLP

Try dope.SWG

dope.security/pricing or book a demo.