11 questions security teams ask before replacing Zscaler (with our answers)

Somewhere between "the pilot users love it" and "legal has the EULA," there's a questionnaire. The security lead sends it, the vendor answers it, and the answers decide whether the project moves or stalls.

We've answered enough of them to know they're mostly the same eleven questions. So here they are, with the answers we send, in writing, usually within 48 hours. Use them to evaluate us. Use them to evaluate anyone.

The short version first. Detail on each one below.

1. Can we control agent updates? We have change control.

Yes, and you should. Agent updates install silently with no reboot through a staged rollout: our internal dogfood tenants first, then early-access tenants, then your own designated canary endpoints, then the rest of your fleet. A failed upgrade on an individual endpoint rolls back automatically. Agent releases ship roughly monthly.

Policy changes are separate from agent updates. They push in real time over a websocket, with polling fallback several times an hour and on reconnect, and they're reversible in seconds.

2. What's the Sev-1 escalation path? Is there a phone number?

Support is 24/7 at support@dope.security, staffed by product engineers rather than a Tier 1 queue. Standard initial-response targets are one hour for Severity 1, four hours for Severity 2, and next business day for Severity 3 and 4.

For customers who need it, we put a named escalation path in writing: your account lead, our Head of Product, and our CEO, with direct mobiles. Email starts the work; the phone call makes sure it's happening.

3. What happens if your cloud is unreachable?

Browsing continues. Inspection runs on the device, not in our cloud, so a cloud outage doesn't interrupt web traffic. (This is the structural difference from a cloud proxy; endpoint-based SWG vs cloud proxy SWG goes deeper on outage behavior.) The agent keeps applying cached policy to previously visited sites. For new sites, the default is allow; if you set Fail Close, they're blocked until the cloud is reachable again.

4. What does the backend look like, and what's the SLA?

Serverless on AWS in a tri-region active/active design with cross-region data replication and automatic Route 53 failover. The SLA commits to 99.9% monthly availability. Live status is published at status.dope.security.

5. Disaster recovery: RTO, RPO, testing?

Cloud recovery uses DynamoDB point-in-time recovery, encrypted Aurora backups, and real-time cross-region replication. The DR plan is tested at least annually; the most recent test was January 2026, and the SOC 2 Type 2 audit verified it. The SOC 2 Type 2 report is available under NDA.

6. Encryption, in transit and at rest?

All communication uses TLS 1.2 or higher. Data at rest is encrypted with AES-256-GCM using AWS KMS across DynamoDB, S3, and Aurora, with secrets in AWS Secrets Manager. Asymmetric operations use RSA-PSS with SHA-256 and 2048-bit keys.

The part that matters most for a gateway: SSL decryption happens only on the device. Decrypted traffic never reaches our cloud. Each agent uses a short-lived, constrained intermediate CA, rotated every seven days. Only transaction metadata is sent to the cloud.

7. Which SIEMs and identity providers do you integrate with?

SIEM delivery is supported to AWS S3 and natively to Splunk, QRadar, Taegis, Microsoft Sentinel, CrowdStrike, Datadog, and Sumo Logic, in real time. Identity integrates with Microsoft Entra and Google Workspace for user and group sync. Deployment is supported through Jamf, Kandji, and Intune. There's an API and an open-source MCP server for teams that want to automate against the console.

One thing to plan around: console analytics can lag the SIEM feed by up to a day and show a rolling seven-day window. Your SIEM is the system of record for investigations and for anything longer than a week.

8. Where does threat intelligence come from?

Third-party URL categorization and anti-malware reputation partners. Categories refresh in the cloud every hour; malware verdicts are real-time file-hash lookups. A false positive on a suspicious or malicious categorization expires within an hour, and a miscategorized domain can be fixed immediately with an instantly pushed bypass. You can also block newly registered domains, or go stricter and block unknown and unrated domains.

9. Can our service desk disable a user without going through security?

Yes. Three roles come out of the box. Most customers give the service desk the SOC Analyst role, which lets them disable a user or an endpoint from the console without involving the security team. Disabling an endpoint is remote and needs no password or action from the user. If you need a fourth role, we build it with you.

10. What does the audit trail show?

Who did what, when. If a user uninstalls the agent, the audit log shows who and at what time. Console actions, policy changes, and endpoint disables are all logged. Diagnostics are always captured on the device and cover 24 to 48 hours depending on traffic; debug mode just makes them visible.

11. Does the trial tenant become the production tenant?

Yes. Sign in with your corporate Google or Microsoft account and the tenant you get is the tenant you keep. Policies, groups, and bypasses carry straight through to the paid account with no reconfiguration. A Fortune 100 customer took their free trial tenant to over 18,000 devices without ever migrating.

What we won't claim

Two things come up that we'd rather be straight about than oversell.

Native Okta SAML and SCIM is on the roadmap, not shipping today. Okta customers sync through Google Workspace or Entra group membership in the meantime; it works, and we'll tell you the dated commitment on a call.

Inspection across every port and protocol is a firewall question, not an SWG question. dope.security inspects web traffic on the device. If an assessor needs full-port inspection for a compliance framework, pair it with your firewall and we'll help you document the split.

Send us yours

If your questionnaire has a twelfth question, send it. The speed and completeness of the answers is itself a data point about how a vendor will treat you after the contract is signed. The questionnaire usually lands in week two of a pilot; the three-week pilot checklist shows where, and the 90-day Zscaler switch plan shows what comes after the answers check out.

Email security questions to sales@dope.security, or sign in with your corporate account at dope.security and send them from inside your pilot.