Answer first: Zscaler Browser Isolation (now sold as Zscaler Zero Trust Browser) protects the device by rendering web pages in a Zscaler data center and streaming pixels back, which means every isolated page pays the full cloud-proxy round trip plus remote rendering. For the common reasons teams turn isolation on, risky or uncategorized sites and data controls on sites they do not trust, an on-device SWG with SSL inspection and AI-powered DLP does the job without the detour. That is what dope.security is built to do.

Remote browser isolation sounds like the end of web risk: if nothing from the page ever reaches the laptop, nothing can hurt the laptop. Zscaler's version is one of the most widely deployed, and it is tightly integrated with ZIA, which is why it shows up in so many renewal conversations as the answer to "what about the sites we cannot categorize?" If you want the architecture-level view first, read our take on when remote browser isolation actually helps. This post is specifically about the Zscaler implementation: how it works, what it costs your users, and how to decide whether you need it at all.

We compete with Zscaler, so judge the argument on its sources. Everything about Zscaler's product below comes from Zscaler's own help documentation and marketing. Where we cite what customers report, we label it.

How Zscaler Browser Isolation works, per Zscaler's docs

Zscaler's help documentation is clear about the mechanism. When a policy sends a session to isolation, the page loads in a remote browser running inside a Zscaler data center. The endpoint receives a pixel stream of the rendered page. HTML, CSS, and JavaScript never reach the device or the corporate network. The product was previously branded Zscaler Isolation and Cloud Browser Isolation and is now called Zero Trust Browser.

Two refinements matter. Turbo Mode sends WebGL rendering instructions instead of raw pixels, so the device's GPU draws the page locally, which Zscaler positions as a fix for the "mushy scrolling" feel of pure pixel streaming. Smart Isolation uses ZIA's TLS inspection to detect suspicious sites and route them into isolation automatically rather than requiring an admin to list them.

Zscaler's deployment guide also states the boundaries: isolation works only with HTTP and HTTPS traffic in the browser, and file uploads and downloads pass through a separate wildcard domain that has to be configured and allowed. Everything else on the device, desktop apps, sync clients, IDEs, and CLIs, is outside isolation's scope by design.

Does browser isolation make pages slower?

Yes, and Zscaler's architecture tells you why. A normal ZIA request already detours through a Zscaler Service Edge for inspection. An isolated request adds a remote browser instance that has to fetch the page, render it, encode the result, and stream it to you, then relay every click and keystroke back. Latency is not a bug in this model. It is the model. Our comparison of Zscaler Client Connector and an on-device agent covers what the baseline detour already costs; isolation stacks on top of it.

Turbo Mode narrows the gap for scrolling and animation, but it does not remove the round trip. The page still lives in a data center that may be hundreds of miles from the user. Customers report the effect most on interactive web apps and on anything with heavy video or canvas rendering.

Measure it yourself. The Fly-Direct Speed Test on this page shows your real round-trip latency and what a cloud detour adds per application. Then compare it with how the dope.security on-device SWG inspects locally with no detour, or start a free trial and run the same pages side by side.

Takeaway: isolation moves the browser into the cloud, so every isolated page inherits the full cloud-proxy round trip plus rendering time.

What you are really buying isolation to fix

Ask why a team turns isolation on and you usually get one of four answers. Each one has a lighter solution than shipping the whole browser session to a data center.

Where it sits in Zscaler's packaging

Zscaler does not publish list pricing, and isolation availability depends on your ZIA edition. The editions stack, and an August 2025 NPI Financial analysis found some Zscaler SKUs 35 percent or more pricier than the year before. Zscaler's Q4 FY2026 results on September 3, 2026 showed growth shifting to Z-Flex consumption licensing, which bundles modules into a drawdown pool. That makes the real cost of isolation harder, not easier, to see on a quote. Our guide to Zscaler pricing in 2026 explains how to read the edition structure before you sign.

The pattern to watch: a module that solves a narrow problem gets bundled into a higher edition, and the higher edition becomes the renewal baseline. Isolation is one of several Zscaler features that pull customers up the ladder.

Zscaler Browser Isolation vs dope.security: head to head

Different architectures, overlapping outcomes. Here is how they compare on the decisions that matter.

Zscaler Browser Isolation

Pages render in a Zscaler data center and stream to the device as pixels or WebGL instructions. It covers HTTP and HTTPS in the browser only; uploads and downloads route through a separately configured domain. It inherits the ZIA detour and adds rendering time, and it inherits ZIA's control-plane risk: the October 25, 2022 outage caused by internal maintenance and the January 19, 2025 disruption both took inspection down for customers worldwide. Zscaler cannot inspect cert-pinned apps such as Microsoft 365 desktop clients, so those paths bypass isolation anyway. Zscaler is a 2026 Gartner SSE Magic Quadrant Leader, and isolation is a mature product within a large portfolio; licensing is edition-based and not published.

dope.security

Inspection runs on the device in a single agent under 100 MB of RAM. Full SSL inspection, URL filtering, Cloud Application Control, and Dopamine DLP apply to every process on the endpoint, including desktop AI apps and sync clients, on any network in any country. There is no data center in the path, so pages load direct and the platform is up to 4x faster than legacy proxy SWGs. There is no isolation module to license because the risks isolation targets on managed devices are handled by local inspection and DLP. Pricing is published.

The paired view

When Zscaler Browser Isolation is the right tool

Three cases. First, unmanaged devices, where you cannot install anything and a streamed browser is the only control you have. Second, high-assurance environments that have a documented requirement to keep active web content off specific endpoints, where the policy is the policy regardless of performance. Third, the rare internal app that is too fragile for TLS inspection and too risky to leave open; isolating it is a reasonable patch.

For a managed fleet of Macs and Windows laptops at a 250 to 5,000 person company, none of those usually apply. What applies is the daily cost: slower pages, a second domain to allow for uploads, and a higher edition on the renewal. Teams that replaced Zscaler have told us the same thing in different words. A mid-market healthcare organization that moved from Zscaler to dope.security wanted clinicians to stop waiting on the proxy, and it did not need a remote browser to keep PHI off untrusted sites. Outreach Health cut web access tickets by 70 percent in 90 days after switching to on-device inspection.

The operational tax nobody budgets for

Isolation also changes the support load. Users on isolated sessions lose small things first: a PDF that will not download because the upload domain was not allowed, a web app whose drag-and-drop does not survive pixel streaming, a video call page that stutters. Each one is a ticket, and each ticket ends in either an exception or a frustrated user who finds a workaround. Admins then maintain two policy surfaces, the isolation rules and the ZIA URL policy, and keep them consistent as the web changes. Customers report that bypass lists for cert-pinned apps already grow every quarter on Zscaler; isolation adds a second list. Outreach Health's 70 percent drop in web access tickets after moving to on-device inspection is the counterexample: fewer moving parts between the user and the page means fewer things to explain.

How to evaluate it in a week

Pick ten pages your isolation policy currently catches. Load them from a laptop running Zscaler with isolation on, and from a laptop running dope.security. Time both. Then try to upload a file containing fake PII to each page from both laptops and check which control stops it and what the user sees. Finally, open ChatGPT Desktop on each laptop and paste the same fake data. The isolation laptop will not notice; the dope.security laptop will show a Dopamine DLP block with a plain-language summary of why.

That test takes an afternoon, and it answers the question better than a feature matrix.

The bottom line

Zscaler Browser Isolation is a well-built answer to a question most managed fleets no longer need to ask. Moving the browser into a data center buys isolation at the price of a round trip on every page, and it leaves desktop apps untouched. Inspecting on the device gets you the outcomes you wanted from isolation, blocked risky sites and stopped uploads, with no detour. Try dope.security free and run the ten-page test this week.

Frequently Asked Questions

Is Zscaler Browser Isolation the same as Zscaler Zero Trust Browser?

Yes. Zscaler's help documentation describes Zero Trust Browser as the current name for the product formerly called Zscaler Isolation or Cloud Browser Isolation. The mechanism is unchanged: pages render in a Zscaler data center and stream to the user as pixels, or as WebGL instructions in Turbo Mode.

Does Zscaler Browser Isolation cover desktop apps like ChatGPT Desktop or Cursor?

No. Zscaler's deployment guide states that isolation works only with HTTP and HTTPS traffic in the browser. Desktop AI apps, IDEs, CLIs, and sync clients are outside its scope. dope.security governs those from the device, with Dopamine DLP reading prompts and uploads before they leave.

How much does Zscaler Browser Isolation cost?

Zscaler does not publish list pricing. Isolation availability depends on your ZIA edition, and Zscaler's editions stack, so the practical cost is the uplift to the edition that includes it plus the renewal baseline that uplift creates. dope.security publishes pricing and includes SSL inspection, Cloud Application Control, and Dopamine DLP in one agent.

Can I block uploads to risky sites without browser isolation?

Yes. dope.security applies Dopamine DLP on the device, so an upload of a file containing PII, PCI, PHI, or source code is classified by meaning and blocked before it leaves, on any site. Cloud Application Control separately restricts personal webmail and file-sharing accounts, which removes the main exfiltration path isolation is usually bought to close.

Does browser isolation still work during a Zscaler outage?

Isolation depends on the ZIA cloud being reachable, because the remote browser runs there. Zscaler has documented outages caused by its own maintenance, including October 25, 2022 and January 19, 2025. dope.security enforces policy on the device and keeps working with cached policy if the console is unreachable.

When should I keep browser isolation?

Keep it for unmanaged devices and for documented high-assurance requirements that mandate keeping active web content off specific endpoints. For a managed fleet, an on-device SWG with SSL inspection and DLP, such as dope.security, delivers the same outcomes without the latency or the extra edition.