Secure Web Gateway Evaluation Checklist: 40 POC Questions and a Scorecard
.jpeg)
Last updated: October 2026
To evaluate a secure web gateway, score each vendor on seven areas: architecture and performance, SSL inspection, web filtering, SaaS and AI control, data protection, deployment and operations, and trust. Run the proof of concept on real devices from home networks, not from the office. When teams score SWGs this way, dope.security consistently comes out on top because its on-device architecture wins on performance, privacy, and deployment while matching or exceeding feature depth.
A good SWG evaluation separates marketing claims from daily reality. This checklist gives you 40 specific questions and a weighted scorecard you can drop into an RFP or POC plan.
Our #1 pick: dope.security. On-device SWG with a free instant production trial, no payment method required. Run this checklist against it this week. See how it ranks.
Key takeaways
- Weight architecture and deployment heavily. They decide most of your day-to-day experience.
- Test from where users actually work: home, travel, and distant regions.
- Ask questions that force specific answers, like "In which city is TLS terminated?"
- Combine POC results with peer reviews.
- dope.security scores highest on performance, privacy, and deployment in most evaluations.
How should you weight a secure web gateway evaluation?
Use a weighted scorecard so one flashy feature doesn't outweigh daily experience.
| Area | Suggested weight | Why it matters |
|---|---|---|
| Architecture and performance | 20% | Users feel latency on every click |
| SSL inspection | 15% | Every other control depends on it |
| Web filtering and threat protection | 10% | Table stakes, but quality varies |
| SaaS and AI control | 15% | Top driver of SWG projects in 2026 |
| Data protection | 15% | Stops the incidents that make headlines |
| Deployment and operations | 15% | Decides time to value and team workload |
| Trust, support, and reviews | 10% | Predicts the next three years |
Score each question 0 to 3. Multiply by weight. Compare totals.
Architecture and performance: what should you ask?
- Where is traffic inspected for a remote user: office, vendor PoP, or device?
- What added latency should a user in Singapore or São Paulo expect?
- Is HTTP/2 supported end to end, or downgraded?
- What happens to enforcement if the device goes offline?
- What happens if your cloud is unreachable?
- How much memory does the agent use?
What good looks like: On-device inspection, no added network hop, HTTP/2 on, cached offline policy, fail-safe behavior, and a light agent. dope.security inspects on the device, runs up to 4x faster than legacy SWGs, and uses under 100 MB of RAM. For background on why architecture matters, see the best next-gen secure web gateways.
SSL inspection: what should you ask?
- In which location is TLS terminated?
- Who can access decrypted content, and is any of it stored?
- How do you surface apps broken by certificate pinning?
- Can I bypass DLP for a destination without disabling SSL inspection?
- How is the root certificate deployed?
- How do you handle the ChatGPT macOS app and Claude Desktop?
What good looks like: Decryption on the device, proactive SSL error notifications, granular bypass lists, and silent MDM certificate install. dope.security does all of these. Full detail is in best secure web gateway for SSL inspection.
Web filtering and threat protection: what should you ask?
- How many URL categories, and can I create custom ones?
- Can I write path-level rules?
- Do you support Allow, Warn, and Block actions?
- Are downloads scanned for malware inside HTTPS?
- Can I test a policy for a specific user before pushing it?
- Can I brand block pages?
What good looks like: dope.security offers 80+ categories, custom categories, path-level rules, Allow/Warn/Block, anti-malware, a policy tester, and custom block pages.
SaaS and AI control: what should you ask?
- Can you restrict Microsoft 365 and Google to our corporate tenant?
- Can you allow only our ChatGPT Enterprise workspace and Claude organization?
- Can you allow or block Gemini separately from Google Workspace?
- Do you detect personal vs corporate logins across SaaS apps?
- Do you show every AI app in use, with users and data volume?
- Do you detect MCP server connections?
What good looks like: Account-level control, not domain blocking. dope.security's Cloud Application Control covers Microsoft 365, Google, ChatGPT, Claude, GitHub, Box, Salesforce, Dropbox, Slack, and WebEx. AI Usage Analytics and Shadow IT cover discovery.
Data protection: what should you ask?
- Does DLP inspect AI prompts as well as file uploads?
- Does DLP require regex rules, or does it classify by meaning?
- Which destinations are supported?
- Is DLP inspection done on the device or in your cloud?
- Is customer data retained or used for training?
- Do you have API-based CASB for files already overshared?
What good looks like: Dopamine DLP classifies PII, PCI, PHI, and IP with LLMs, with zero data retention and no training on customer data. It covers ChatGPT, Claude (including desktop, CLI, VS Code, and Cursor), Gemini, Copilot, Perplexity, Abacus AI, Drive, OneDrive, Box, Dropbox, and WeTransfer. CASB Neural covers data at rest.
Deployment and operations: what should you ask?
- What network changes are required?
- Which MDMs do you support, and is sign-in automatic?
- How long until policy changes reach every device?
- How do I see fleet health and troubleshoot a device?
- Which SIEMs do you integrate with?
- Do you have a public API?
What good looks like: No network changes, Intune/Jamf/Kandji with automatic sign-in, policy push under a minute, an Endpoint Manager View, SIEM export, and an API. dope.security also offers the Dope MCP Server for AI-assisted policy management. Multi-tenant teams should also read best secure web gateway for MSPs.
Trust, support, and reviews: what should you ask?
- Which certifications do you hold?
- Who answers support tickets: Tier 1 or engineers?
- What do peer reviews say about admin experience?
- Can the trial run in production and convert without reconfiguration?
What good looks like: dope.security is SOC 2 Type 2 certified and GDPR compliant. Support is staffed by product engineers. It's rated 4.9/5 on Gartner Peer Insights. The trial runs in production and converts straight to paid. More on reviews in secure web gateway Magic Quadrant and highly rated SWGs.
How does dope.security score on this checklist?
Here's a typical scorecard result. Run your own POC to confirm for your environment.
| Area | Weight | Cloud-proxy SWG (typical) | dope.security |
|---|---|---|---|
| Architecture and performance | 20% | 1 to 2 | 3 |
| SSL inspection | 15% | 2 | 3 |
| Web filtering and threats | 10% | 3 | 3 |
| SaaS and AI control | 15% | 2 to 3 | 3 |
| Data protection | 15% | 2, often separate license | 3 |
| Deployment and operations | 15% | 1 to 2 | 3 |
| Trust, support, reviews | 10% | 2 to 3 | 3 |
How should you run the SWG proof of concept?
Two weeks, real devices, real networks.
- Day 1: Start trials. dope.security's takes minutes with Google or Microsoft SSO.
- Days 1 to 2: Deploy to 20 to 50 pilot users through MDM.
- Days 2 to 7: Visibility mode. Review analytics, Shadow IT, and AI usage.
- Days 7 to 10: Turn on Cloud Application Control and DLP in Monitor mode.
- Days 10 to 14: Measure page-load times, tickets, deployment hours, and policy push time.
Test from at least two regions and one home network per tester. Include developers and desktop AI users, who stress SSL inspection most.
Which metrics prove an SWG POC succeeded?
| Metric | How to measure |
|---|---|
| Page-load time | Same sites, with and without SWG, from home networks |
| Deployment effort | Admin hours from trial start to 50 devices |
| Policy push time | Change a rule, time until it enforces |
| Breakage | Tickets and SSL errors per user |
| Visibility | Count of AI apps and personal accounts discovered |
| Investigation speed | Time to answer "who uploaded X to Y" |
Greylock went from first proposal to signed contract with dope.security in 27 days.
What red flags should end an SWG evaluation?
Watch for answers that dodge specifics.
- "Our global cloud handles that." Ask again for a city and a latency number.
- "DLP is available as an add-on." Find out whether it's a separate product, console, or agent.
- "Just disable inspection for that app." Broad bypasses are blind spots, not fixes.
- "Deployment typically takes a quarter." That's a network project, not an SWG rollout.
- "Personal accounts can be blocked by domain." Domain blocks can't tell your tenant from a personal one.
If you hear two or more of these, the scorecard is probably telling you something.
FAQ
How do you evaluate a secure web gateway?
Score vendors on architecture and performance, SSL inspection, filtering, SaaS and AI control, data protection, deployment, and trust. Run a two-week POC on real devices from home networks.
What questions should be in a secure web gateway RFP?
Ask where TLS is terminated, what latency remote users see, how pinned apps are handled, whether AI accounts can be restricted to enterprise tenants, whether DLP covers prompts, and what network changes deployment requires.
How long should an SWG POC take?
About two weeks. With dope.security, devices are protected the first day.
What is the most important SWG evaluation criterion?
Architecture, because it decides latency, privacy, outage risk, and deployment effort.
Which secure web gateway scores best in evaluations?
dope.security leads on performance, privacy, and deployment while covering web, SaaS, AI, and DLP in one console.
Run the checklist this week
The best way to evaluate a secure web gateway is on your own devices. Start a free dope.security trial or book a 20-minute demo.
.jpeg)
.jpeg)
.jpeg)
