Quick answer: Split tunnel sends only some traffic through your VPN or cloud proxy and lets the rest go straight out. Full tunnel sends everything. Split tunnel is faster and blinder, full tunnel sees more and taxes every request, and neither is a security decision. The trade only exists because inspection lives in a data center you have to reach first. With an agent-based secure web gateway like dope.security, inspection happens on the device, so there is no tunnel to choose and nothing to give up.

Every network team has had this argument. Someone wants full tunnel for visibility. Someone else wants split tunnel because video calls are choppy and sales is complaining. Both sides are right, which is the tell that the question itself is broken. If you are having this fight in the middle of a cloud proxy evaluation, our honest comparison of Zscaler and Netskope shows how each vendor's architecture quietly makes the decision for you.

Here is the thesis, stated plainly: the split versus full tunnel debate is a symptom of where you put inspection, not a security control in its own right.

What split tunneling actually does

Split tunneling means the client decides, per destination, whether traffic goes through the tunnel or straight to the internet. Corporate apps go through. Everything else goes direct. The split is usually defined by IP range, domain list, or application name, and it is maintained by hand.

The appeal is obvious. Traffic that does not need inspection stops paying for it. Video conferencing, software updates, and streaming stay local and fast. Your concentrator or proxy carries less load, which sometimes lowers your bill.

The cost is equally obvious once you say it out loud: everything outside the tunnel is unlogged and unenforced. A user can upload a customer list to a personal cloud drive, paste source code into a consumer AI tool, or download a payload from a domain registered an hour ago, and your gateway never sees a byte of it. You did not decide that was acceptable. You inherited it from a routing table.

What full tunneling actually does

Full tunnel sends every packet through the tunnel first. Every request gets inspected, logged, and policed. Compliance teams like it because the audit trail has no holes.

The cost is latency on the whole workload, not just the risky part. Every request goes device, then point of presence, then destination, then all the way back. That detour is charged on each of the dozens of round trips a modern SaaS app makes to render a single page. A user in Singapore whose nearest inspection node is in Tokyo pays that toll thousands of times a day.

Full tunnel also concentrates risk. When the tunnel is the only path to the internet, an outage in the vendor's control plane is an outage for your workforce. Cloudflare's November 18, 2025 incident, triggered by a single oversized configuration file, took large parts of the web down for hours. Zscaler's October 25, 2022 outage came from its own internal maintenance. These are documented events, not hypotheticals, and full tunnel is what turns them into your problem.

Split tunnel vs full tunnel, side by side

The honest comparison is not which one is better. It is which set of consequences you would rather absorb, and what a third architecture does to both columns.

• Latency: split tunnel spares the excluded traffic and taxes the rest; full tunnel taxes everything; dope.security inspects on the device and adds no network detour to anything.
• Visibility: split tunnel sees only what the exclusion list happens to route through it; full tunnel sees all web traffic; dope.security sees all egress from the endpoint because it is already there when the request is made.
• Maintenance: split tunnel needs a hand-curated exclusion list that drifts every time a SaaS vendor changes IP ranges; full tunnel needs capacity planning per region; dope.security needs neither, because there is no list of what to route where.
• Failure mode: split tunnel fails open for excluded traffic; full tunnel fails closed for everyone when the cloud tier has a bad day; the dope.endpoint agent keeps enforcing cached policy on the device.
• Encrypted traffic: both tunnel models depend on a proxy terminating TLS somewhere else, which is what breaks certificate-pinned apps; dope.security terminates TLS on the device where the trust store already lives.

Why you have to choose at all

Strip away the vendor language and the reason is simple. If the thing that inspects your traffic is not on the device, the traffic has to travel to the thing. That travel is the entire cost. Split tunnel is how you avoid paying it on some traffic. Full tunnel is how you agree to pay it on all of it.

The measured numbers are not small. Cloud proxy latency runs roughly 40 to 80 milliseconds when a user sits near a point of presence and 150 to 400 milliseconds when they do not, per ThousandEyes measurements and vendor documentation. Netskope publishes its own service level target of under 10 milliseconds for traffic it does not decrypt and 50 milliseconds for traffic it does, a fivefold penalty for the exact inspection you bought the product to perform. Gartner has cited a 10 to 20 percent throughput reduction on Zscaler as inspection modules stack up. We break the arithmetic down in the cloud proxy latency math and in what backhauling actually means.

Want the number for your own connection instead of ours? The dope.security Fly-Direct Speed Test measures your real round-trip latency in the browser and shows what a legacy proxy detour would add to each app you use every day. See how Fly Direct works or book a 20-minute demo and we will run it against your fleet.

Takeaway: the detour is measurable, which means the tunnel decision is really a budget decision about latency.

How the major vendors push you one way or the other

Each legacy platform nudges the decision differently, and the nudge comes from its architecture rather than its marketing.

Zscaler

All traffic forwards to a Zscaler Enforcement Node, so the product is happiest in full tunnel. That is also where the latency stacks. Zscaler's own documentation acknowledges it cannot inspect certificate-pinned applications including Microsoft 365, WebEx, and Dropbox, which forces bypass lists that quietly recreate a split tunnel you did not design. Customers report the client hanging for up to 60 seconds on network transitions, and Zscaler publishes memory-leak guidance for its connector. The result is full tunnel in policy and split tunnel in practice.

Netskope

NewEdge is a proxy in the cloud, and the decrypted service level target of 50 milliseconds is the price of admission. Netskope's feature depth is real, but reviewers consistently describe the platform as hard to deploy and administer, and certificate-pinned bypass lists show up here too. Full inline data protection sits in a higher tier, so the tunnel question gets tangled up with a licensing question.

Cisco Umbrella

The base tier is a DNS product, so there is no tunnel to speak of and no payload inspection either. Cisco's own documentation, article 225162, states that allowing a corporate ChatGPT tenant while blocking personal accounts requires the intelligent proxy, SSL decryption, and a root certificate. The roaming client also has documented conflicts with Microsoft 365 traffic. You end up choosing between DNS-only blindness and a proxy add-on that reintroduces the detour.

Palo Alto Prisma Access

GlobalProtect is the tunnel, and Palo Alto has confirmed macOS battery drain, 100 percent CPU conditions, and reconnect loops in its own advisories. Explicit Proxy carries hard limits: no HTTP/2, stripped ALPN, and mandatory decryption. Strata Cloud Manager was impaired for roughly 28 days starting March 31, 2026. Full tunnel here means betting uptime on a control plane with a documented bad quarter.

What breaks in a split tunnel that nobody warns you about

Exclusion lists rot. A SaaS vendor adds a CDN range, and traffic you meant to inspect silently starts going direct. Nothing alerts you, because from the client's point of view the policy worked.

Personal accounts are the bigger hole. Split tunnel decisions are made by destination, and the destination for corporate ChatGPT and personal ChatGPT is the same domain. Telling them apart requires reading an HTTP header inside a decrypted TLS session. A routing rule cannot do that. Neither can DNS. This is exactly the gap we cover in blocking personal ChatGPT while keeping the corporate tenant.

The third option: stop choosing

Put the inspection where the request is born. The dope.endpoint agent runs on the device in under 100 MB of RAM, terminates TLS locally, applies URL filtering, Cloud Application Control, and Dopamine DLP on data in motion, and then lets the request fly direct to its destination. Nothing detours. Nothing is excluded, because there is no route to exclude it from.

That changes the shape of the problem rather than the size of it. You get full-tunnel visibility with better-than-split-tunnel latency, up to 4x the performance of legacy proxy secure web gateways, and one console instead of a tunnel policy plus an exclusion list plus a bypass list. Greylock Partners went from first proposal to signed contract in 27 days on exactly this argument, described in their move off Cisco Umbrella.

How to decide this week

If you are stuck with a tunnel today, three questions will tell you where you stand. First, pull your exclusion list and ask when it was last reviewed. Anything older than a quarter is a policy you no longer understand. Second, measure round-trip latency from your three largest user locations to the destination, then through the tunnel, and multiply the difference by the round trips a page like Salesforce or Workday makes. Third, test whether your current setup can allow a corporate AI tenant and block the personal one on the same domain. If it cannot, your tunnel is not doing the job you think it is.

Then ask the better question. Not split or full, but why the tunnel is there at all. Ready to see it without one? Start a free dope.security trial or read how teams migrate off a cloud proxy.

Frequently Asked Questions

Is split tunneling a security risk?

Split tunneling is a visibility risk more than an attack vector. Traffic outside the tunnel is not inspected, logged, or policed, so uploads, downloads, and AI prompts on those routes go unseen. The risk is that the exclusion list, not your security policy, decides what gets enforced. dope.security removes the question by inspecting every egress request on the device.

Which is faster, split tunnel or full tunnel?

Split tunnel is faster for the traffic it excludes and identical to full tunnel for everything else. Full tunnel is slower across the board because every request pays the detour to a point of presence and back. On-device inspection is faster than both, because the inspection step adds no network hop at all.

Does dope.security use split tunneling?

No. There is no tunnel and therefore no split. The dope.endpoint agent inspects traffic locally and sends it straight to its destination, which is what Fly Direct means. That is also why there is no exclusion list to maintain and no point of presence to be far away from.

Can a full tunnel inspect certificate-pinned apps?

Usually not. Certificate pinning breaks proxy-based TLS interception because the app refuses a certificate it did not expect, which is why Zscaler, Netskope, and others publish bypass lists for Microsoft 365, Dropbox, and similar apps. Inspecting on the device sidesteps this, because the TLS session terminates where the operating system trust store already lives. We cover the mechanics in our post on certificate pinning and SSL inspection.

Do I still need a VPN if inspection runs on the device?

You may still want one for reaching private internal resources, which is an access problem rather than an inspection problem. What changes is that you stop routing internet-bound traffic through it for security reasons. Our comparison of ZTNA and VPN covers where each still earns its place.

How does the tunnel choice affect users in China?

Badly, in both directions. Full tunnel means every request crosses a border to reach a point of presence, and several vendors sell China connectivity as a paid uplift, including Zscaler China Premium and Netskope's China SKUs. Split tunnel means those users are the least inspected people in your company. dope.security works in China without a paid uplift because inspection never leaves the laptop, as covered in cloud proxy performance in restricted regions.