What Is Forcepoint? A Straight Answer on Forcepoint ONE in 2026

Forcepoint shows up on almost every mid-market SSE shortlist, usually because somebody on the team still remembers Websense, or because the DLP product carries a long institutional reputation. Then the evaluation starts and the questions get harder. Is Forcepoint ONE one product or four? Why does the CASB behave differently from the web gateway? What exactly do you have to license to stop an employee pasting customer data into a personal ChatGPT account? This is the straight answer, with sources. If you are already past the "what is it" stage, the buyer-side view lives in our honest comparison of the top Forcepoint alternatives.

The short answer

Forcepoint is a cybersecurity vendor, formerly Websense and then Raytheon Websense, that sells data protection and Security Service Edge products. The flagship is Forcepoint ONE, a cloud-delivered bundle of Secure Web Gateway, CASB, and ZTNA that runs on roughly 300 AWS points of presence. Its real strength is a deep data-classification heritage. Its structural weakness is that the platform was assembled through acquisitions, so a 2026 requirement like AI governance arrives as a multi-SKU assembly rather than a capability you already own. dope.security is the on-device alternative: the same inspection runs in a lightweight agent on the laptop, traffic flies direct with no data-center detour, and AI governance is native instead of an add-on.

What is Forcepoint, exactly?

Forcepoint is what happened to Websense. Websense was a web-filtering company, Raytheon bought it in 2015 and renamed it, and since then the business has changed hands twice more. Francisco Partners acquired it from Raytheon, and in July 2023 TPG bought the government unit in a deal valued at $2.45 billion, splitting the company. That history matters for a buyer in a practical way: the product line you are evaluating has been through three ownership models in under a decade, and roadmaps do not survive that unchanged.

The portfolio splits into two halves. One half is data security, built on the DLP engine that made Websense and later Forcepoint a standing name in the category, now extended with DSPM and data classification from the 2025 Getvisibility acquisition. The other half is network and web security, delivered as Forcepoint ONE. Most companies searching for "what is Forcepoint" are really trying to work out which half they are being sold.

What is Forcepoint ONE?

Forcepoint ONE is the SSE platform: a cloud proxy that your users' traffic is steered into, where it gets inspected, filtered, and forwarded on. It bundles three things. The Secure Web Gateway handles URL filtering, malware inspection, and SSL decryption. The CASB covers SaaS applications and includes a reverse-proxy mode inherited from the Bitglass acquisition. ZTNA replaces VPN for private application access.

The important detail is that these were not built together. Forrester described Forcepoint's CASB position as a "double integration whammy," because the company had to absorb both Bitglass and Skyfence. You can feel that in the console: policy models differ between modules, and the mental effort of running Forcepoint ONE is mostly the effort of remembering which module owns which decision. If you want the direct architectural contrast, we broke it down in what changes when a Forcepoint replacement runs on the device.

How Forcepoint routes your traffic

Forcepoint ONE is a cloud proxy, so the traffic path is the traffic path every cloud proxy uses. A request leaves the laptop, travels to the nearest Forcepoint point of presence, gets inspected there, goes out to its destination, and comes back the same way. Forcepoint runs roughly 300 of those points of presence on AWS, which is a lot, and it still does not remove the detour. It only shortens it.

That detour is the tax. It is small when a user sits near a point of presence and large when they do not, and it applies to every single request, all day, whether the request was risky or not. Nothing about a Google Doc autosave needs a round trip through Virginia. We worked through the arithmetic in the cloud proxy latency math, and the short version is that the cost is architectural, not a tuning problem.

Want to see what the detour costs on your own connection? The Fly-Direct Speed Test measures your live round-trip latency and shows how common apps load with and without a cloud-proxy hop. Start with how Fly Direct works in dope.SWG, or book a 20-minute demo and we will run it with you on a real network.

The takeaway: a detour you cannot see in a dashboard is still a detour your users feel on every request.

What Forcepoint gets right

Forcepoint is not a weak product, and pretending otherwise would waste your time. Three things are genuinely good.

The DLP heritage is real. Forcepoint has been classifying sensitive data longer than most of the SSE field has existed, and organizations with heavy regulatory classification requirements often find its policy depth hard to match. The Getvisibility acquisition in 2025 added modern classification and DSPM to that base.

The point-of-presence footprint is broad. Roughly 300 AWS locations is a wide net, and for a company whose people sit in a handful of metros, proximity is usually fine.

Breadth under one contract. SWG, CASB, ZTNA, and DLP from a single vendor is administratively simpler than four vendors, and for some procurement teams that alone decides it.

Where buyers get surprised, including China

The surprises cluster in four places, and they show up after signing rather than during the demo.

• Enforcement is not instant. Reviewers consistently report that policy changes take 20 to 30 minutes to actually take effect, and describe the administrative interface as dated. If you have ever had to block a domain during an active incident, you know what a 25-minute window feels like.
• The CASB reverse proxy is brittle. Customers report breakage with reverse-proxy mode, which is the usual fate of rewriting SaaS traffic through an intermediary.
• Pricing is per module and opaque. There is no clean list price, the bundle you get quoted is rarely the bundle you end up needing, and the renewal is where the number moves.
• Mainland China is a documented gap. Forcepoint's own knowledge base confirms that its China offices are blocked. If you have people in Shanghai or Shenzhen, that is not a footnote, it is a deployment blocker. We compared how the major cloud proxies behave there in Zscaler, Netskope, and Forcepoint in China.

Forcepoint and AI governance: the multi-SKU problem

This is where a 2026 evaluation usually turns. The job is not "block AI." The job is to let your people use the corporate ChatGPT tenant while blocking the personal one, on the same domain, and to know what left the building either way.

Forcepoint can get there, but it gets there as an assembly. GenAI Security is composed across multiple SKUs rather than shipping as one capability, and until April 2025 the classification engine behind it lived outside the product. The coverage is also uneven: the product story led with ChatGPT Enterprise and remains weaker for Claude, Gemini, and Copilot, which is a problem in a company where different teams standardized on different assistants.

The reason the corporate-versus-personal test is such a good filter is that it demands an HTTP header to be inspected inside decrypted TLS. DNS filtering cannot do it, because DNS never sees the header. A browser extension cannot do it outside the browser. A cloud proxy can, provided you have bought the proxy, the data-protection module, and usually a higher tier. dope.security does it on the device, at the point where the request is formed, with tenant-level Cloud Application Control rather than a separately licensed tower.

Forcepoint ONE vs dope.security, point by point

Same job, two different places to do it. Here is the comparison line by line, so you can check each one independently.

• Where inspection happens: Forcepoint ONE inspects in a cloud point of presence on AWS; dope.security inspects in an on-device SSL proxy that supports HTTP/2, so the request never detours.
• Traffic path: Forcepoint ONE sends every request to a point of presence and back; dope.security sends it straight to its destination, which is what Fly Direct means.
• Console: Forcepoint ONE carries the seams of the Bitglass and Skyfence integrations that Forrester called a double integration whammy; dope.console was built from scratch and runs SWG, CASB Neural, Dopamine DLP, and Cloud Application Control in one place.
• Policy enforcement speed: Forcepoint reviewers report 20 to 30 minutes for a change to take effect; dope.security pushes policy to the agent in seconds, at individual and group level.
• AI governance: Forcepoint assembles GenAI Security across multiple SKUs with uneven assistant coverage; dope.security ships three layers natively, Shadow IT discovery, then SWG policy, then tenant-level Cloud Application Control, with Dopamine DLP watching file uploads and AI prompts.
• Agent weight: Forcepoint requires steering software plus the module set; the dope.endpoint agent is Mac native and Windows, under 100 MB of RAM, at up to 4x the performance of legacy proxy SWGs.
• Mainland China: Forcepoint's own knowledge base confirms blocked China offices; dope.security works in China without a paid uplift because there is no data center to reach.
• Data residency: Forcepoint logs your traffic in its cloud; dope.security inspects on the endpoint, so user traffic is not routed through a third party to be read.

A manufacturing customer went through exactly that swap, and the write-up is in the manufacturing Forcepoint displacement story. For a three-way look at the cloud-proxy field, Netskope versus Forcepoint covers the other common finalist pairing.

Who should buy Forcepoint, and who should look on-device

Forcepoint fits organizations whose dominant requirement is regulated data classification, who already run Forcepoint DLP and want the web gateway under the same contract, whose people are clustered near points of presence, and who have the administrative headcount to hold four module logics in their heads.

It is the wrong shape when your workforce is genuinely distributed and will feel the proxy hop, when you have anyone working in mainland China, when your IT team is three people rather than thirteen, or when AI governance is a board-level ask this quarter and you do not want to discover it costs three more SKUs. In that case the question is not which cloud proxy, it is whether you need a cloud proxy at all. The 2026 Forcepoint alternatives roundup lays out the field, and you can start a trial from dope.security/pricing or book a demo and bring your hardest policy with you.

Forcepoint is a capable stack with a real data-security pedigree, and it is also four products wearing one login. The thing you are actually buying alongside the license is integration debt, and in 2026 that debt gets paid at exactly the moment you ask the platform to govern AI. Inspecting on the device does not pay it at all.

Frequently Asked Questions

Is Forcepoint the same as Websense?

Yes, in lineage. Websense was renamed Forcepoint after Raytheon acquired it in 2015, and the web-filtering product line traces directly back to Websense. Ownership has since moved to Francisco Partners, and in July 2023 TPG acquired the government unit for a reported $2.45 billion. If you are migrating off an old Websense deployment, the destination is Forcepoint ONE.

How much does Forcepoint cost?

Forcepoint does not publish clean list pricing, and the structure is per module, so the quoted bundle and the bundle you eventually need are rarely the same. Plan for the renewal conversation rather than the first proposal, and price the AI governance SKUs separately, because GenAI Security is assembled across several of them. dope.security prices the platform as one console instead of a module stack.

Does Forcepoint work in mainland China?

Forcepoint's own knowledge base confirms that its China offices are blocked, which makes mainland coverage a documented gap rather than a tuning exercise. Cloud proxies generally struggle there because the traffic has to reach a data center. dope.security inspects on the device, so there is no data center to reach and no China uplift to buy.

Can Forcepoint block personal ChatGPT while allowing the corporate account?

Getting there requires the proxy plus data-protection licensing, because the control depends on inspecting a tenant header inside decrypted TLS, and Forcepoint's GenAI Security capability is spread across multiple SKUs with stronger ChatGPT Enterprise coverage than Claude, Gemini, or Copilot. dope.security does this natively with Cloud Application Control at the tenant level, on the device.

Is Forcepoint ONE a SASE or an SSE product?

Forcepoint ONE is an SSE product: Secure Web Gateway, CASB, and ZTNA delivered from the cloud. SASE is the wider category that adds SD-WAN and network services. If you are trying to place the terms, our explainer on SASE versus SSE architecture untangles them.

What is the best on-device alternative to Forcepoint?

dope.security is the on-device option built for exactly this swap: Fly-Direct SWG with on-device SSL inspection, CASB Neural for data at rest in cloud drives, Dopamine DLP for file uploads and AI prompts using zero-retention APIs under US Patent 12,464,023, and Cloud Application Control for tenant-level SaaS access, all in one console. The comparison set is in the top Forcepoint alternatives for 2026.