The Best Zscaler Alternative for State and Local Government

The best Zscaler alternative for a city, county, or state agency is dope.security. Local government IT teams are small, budgets are fixed, and staff now work from the field, from home, and from council chambers. dope.security runs the secure web gateway on each managed laptop, so protection follows the employee off the network without tunnels, a data center detour, or a long implementation. The City of Visalia, California, runs it across a workforce of more than 700 users.

Zscaler can do this job. The question for a public agency is what it takes to buy, deploy, and run.

Key takeaways

• Local government staff work off the network. A firewall only protects devices behind it.
• dope.security runs on each managed laptop, so policy follows the employee with no tunnels and no data center detour.
• It's built for lean teams. Deploy through MDM, start from a base policy, and manage everything from one console.
• AI is governed, not banned. Allow the enterprise tenant, block personal accounts, and stop resident PII from leaving.
• The City of Visalia, California, runs it for more than 700 users.

What do public-sector IT teams need?

• Protection off the network. Inspectors, public works crews, and caseworkers aren't behind the firewall.
• Low overhead. A handful of people support everything from the permit system to the Wi-Fi.
• Predictable cost. Budgets are set a year ahead. Surprise add-ons are a problem.
• Audit evidence. Records of web, AI, and data-movement activity, ready when someone asks.
• A plan for AI. Staff are already using ChatGPT. Resident data shouldn't end up in a personal account.

Where Zscaler is a heavy lift

• Implementation. Tunnels from each site, an agent for remote users, identity wiring, and policy migration.
• Pricing. No published list prices, and DLP, CASB, and AI controls sit in higher editions or add-ons. See Zscaler pricing in 2026.
• Latency. Every request travels to a Zscaler data center before it reaches the destination.

How the City of Visalia did it

Visalia serves more than 140,000 residents in California's Central Valley. Its employees went mobile, and perimeter firewall policies stopped following them off-network.

The city chose dope.security for three reasons: on-device SSL decryption with no data center backhaul, real-time policy push from dope.console, and consistent enforcement for every user, on-network or off.

Chris Terry, Information Systems Analyst, said dope.security "helped strengthen our security posture without adding operational overhead." Read the City of Visalia story.

What an agency gets

• On-device inspection. SSL inspection, URL filtering across 80+ categories, and anti-malware run on the laptop. Data never leaves the device for inspection.
• Instant policy. Change a category to Allow, Block, or Warn and it lands on every endpoint in seconds.
• Coaching screens. Customize Block and Warn pages with your acceptable-use guidance.
• Resilience. If a laptop can't reach dope.cloud, Fallback Mode keeps enforcing cached policy.
• AI controls. Allow the enterprise ChatGPT or Claude tenant, block personal accounts, and let Dopamine DLP stop PII from leaving in an upload or prompt.
• Evidence. Web, AI, and data-movement activity in one console, streamed to your SIEM.
• Compliance. SOC 2 Type 2 and GDPR.

Zscaler vs dope.security for government

What it doesn't cover

Be clear-eyed on three points. dope.security protects managed Mac and Windows devices, so traffic lights, cameras, kiosks, and guest Wi-Fi still need a network control. It has no built-in ZTNA today. And if your agency must buy a FedRAMP-authorized service, Zscaler has those offerings; talk to us about your specific compliance requirements before you shortlist.

Common government use cases

• Field staff. Building inspectors, code enforcement, and public works crews on cellular hotspots and site Wi-Fi.
• Hybrid employees. Finance, HR, and planning staff who split time between home and the office.
• Elected officials and executives. Laptops that travel to meetings, conferences, and other agencies.
• Contractors on managed devices. The same policy as employees, with per-group overrides where their work differs.
• Departments with different rules. Police, libraries, and utilities rarely share one acceptable-use policy. Custom categories and per-group overrides handle that from one console.

A practical AI policy for a public agency

Banning AI rarely holds. Staff use it anyway, on personal accounts. A workable model has four parts:

1. Pick the sanctioned tool. License an enterprise tenant of ChatGPT or Claude.
2. Restrict to that tenant. Enter the workspace or organization ID in Cloud Application Control. Personal accounts are blocked.
3. Coach on everything else. Set the AI/ML Applications category to Warn, and customize the Warn screen with your guidance on resident data.
4. Catch mistakes. Dopamine DLP blocks uploads and prompts that contain PII, PCI, or PHI, and explains why.

AI Analytics then gives you the report a council member or auditor will ask for: which AI tools are in use, by how many people, and how much data moved.

What to put in a secure web gateway RFP

Ask every vendor the same questions.

• Where is HTTPS decrypted: in your data centers or on our devices?
• What do we need to change on our network to deploy?
• How long from saving a policy to enforcement on a remote laptop?
• What happens to our users if your cloud is unreachable?
• Which features in the demo are add-ons, and what is the renewal cap in writing?
• Can you separate corporate and personal accounts for AI tools on the same domain?
• How does DLP work, and how many rules do we need to write?
• Which compliance attestations do you hold, and can we see the reports?
• Can we run a free trial in our real environment before award?

What drives the cost?

Three things, in this order: the license tier you actually need, the services and staff time to deploy, and the renewal uplift. A cloud proxy also carries the cost of the proxy fleet in its price. An on-device gateway doesn't have one to fund.

To budget dope.security, send your user count and you get a quote within a day.

Frequently asked questions

Can we try dope.security before a procurement decision?

Yes. There's a free trial. Sign in with Microsoft 365 or Google Workspace, install the agent, and test in your real environment. The trial converts straight to production.

How many staff does it take to run?

It's built for small teams. Policy starts from a base configuration, DLP needs no rule writing, and SWG, DLP, CASB, and AI controls share one console.

Which compliance attestations does dope.security hold?

SOC 2 Type 2 and GDPR. If you have requirements beyond those, raise them with us early.

Does it protect staff who never come into the office?

Yes. Inspection runs on the laptop, so remote and field staff get the same policy as everyone else.

What is the best Zscaler alternative for local government?

dope.security. It protects mobile staff on any network, deploys through MDM, and runs from one console a small IT team can manage.

Does a city or county need a secure web gateway if it has a firewall?

Yes, once staff work off the network. A firewall only protects devices behind it. An on-device gateway follows the laptop.

How do agencies keep resident data out of AI tools?

Restrict AI tools to the enterprise tenant with Cloud Application Control, and use Dopamine DLP to block uploads and prompts that contain PII.

Is dope.security used in the public sector?

Yes. The City of Visalia, California, uses it for a workforce of more than 700 users.

Bring it to your next budget cycle

Start a free trial or book a 20-minute demo.