Zscaler renewal in 90 days? Here's how teams switch without a gap

Most teams don't go looking for a Zscaler alternative because of a strategy deck. They go looking because the renewal notice landed, the ticket backlog is still there, and somebody finally said out loud: "do we actually want another three years of this?"

If that's you, the good news is that 90 days is plenty. We've watched teams go from first demo to signed contract in 27 days, and from signed contract to a few thousand devices in a week. The hard part isn't the technology. It's sequencing the work so the renewal date never becomes leverage against you.

Here's the plan at a glance, then the detail.

Day 0: find the notice date, not the end date

Every ZIA contract has two dates that matter. The end date is the one everybody knows. The auto-renew notice date is the one that decides whether you can leave.

Most enterprise SaaS agreements require written non-renewal notice 30, 60, or sometimes 90 days before the term ends. Miss it and you've re-signed by default, pilot results or not.

So before you book a single demo, pull the contract and write down the notice date. That's the date you build the plan around. If it's inside 30 days, send the non-renewal notice now and negotiate a short extension if you need one. Vendors would rather grant 60 days than lose the account outright.

Days 1 to 7: shortlist with your actual pain, not a feature matrix

Write down the three things you'd fix about ZIA if you could. Teams that come to us tend to list some version of the same ones:

The detour. Every request goes to a Zscaler data center and back. On hotel and airline Wi-Fi that shows up as latency and captive-portal failures for travelers. In certain countries it shows up as "doesn't work."

The care and feeding. PAC file changes, forwarding profiles, weekly vendor touchpoints, and engineers losing days to a single ticket. For a lean IT team, ZIA is a part-time job.

The Mac problem. SSL inspection that breaks developer tooling, so it gets switched off, which leaves an open control gap on exactly the devices that need it most.

Now shortlist against those. A Zscaler replacement that still routes through a cloud proxy fixes the console and keeps the detour. That's a lateral move. Look for architecture that's actually different: inspection on the device, traffic straight to the internet, one console. We laid out the full comparison in endpoint-based SWG vs cloud proxy SWG, and if you're sizing vendors for a company your size, the best secure web gateway for a 1,000-employee company does the head-to-head.

Days 7 to 10: get a tenant the same day

The fastest signal of how a vendor will treat you after the contract is how they treat you before it. With dope.security, you sign in with your corporate Google or Microsoft account and you have a production tenant in minutes. No sales call required.

One thing to confirm with any vendor: does the trial tenant become the production tenant? If the answer is "we'll migrate you to a new tenant at signature," you're going to rebuild your policies twice. Ours converts in place. The free trial a Fortune 100 customer started was the same tenant they scaled to over 18,000 devices.

Days 10 to 30: run a pilot on your angriest users

Don't pilot on IT. Pilot on the 15 to 20 people who complain the most about Zscaler speed. Travelers, developers, the executive whose laptop never connects on hotel Wi-Fi. If the new agent wins them over, you've got your internal champions and your business case in one move.

Push the agent through the MDM you already run (Jamf, Kandji, or Intune), sync a test group from Entra or Google Workspace, and turn SSL inspection on from day one. Add developer tools that pin their own certificates to an application bypass. Then leave it alone for two weeks and let the users talk.

While the pilot runs, send your security questionnaire. Change control for agent updates, Sev-1 escalation, fail open versus fail closed, encryption, SIEM delivery, SOC 2. Any vendor worth switching to answers all of it in writing within a couple of days. (We published our answers to the most common ones here: 11 questions security teams ask before replacing Zscaler.)

Days 30 to 45: wrap-up, quote, paper

Hold one wrap-up call with the pilot users, the security lead, and whoever owns the budget. Go criterion by criterion: speed on and off network, deployment through your MDM, policy and cloud-app controls, SIEM delivery, support responsiveness. Pass or fail each one.

Then the commercial piece. You're funding this from the existing Zscaler line, so the quote should land at or under what you pay today, with DLP and cloud app control included rather than sold as add-ons. (What an SSE costs per user in 2026 has the benchmarks if you want to sanity-check the incumbent's number.) Get the EULA and DPA into legal the same day. Redlines on a standard endpoint agreement shouldn't take more than a week.

Days 45 to 75: cut over in waves, keep ZIA as the parachute

The sequence that works:

Wave 1 is IT and security, pushed through MDM, with SSL inspection on and developer bypasses in place. Wave 2 is general staff, pushed by identity group. Wave 3 is the 24/7 teams and executives, offered through Self Service so they install on their own schedule.

Keep the Zscaler client installed but disabled until each wave signs off. Policy changes on dope.security push instantly and are reversible, so if something breaks you fix it in seconds, not in the next polling window.

Outreach Health secured 99% of their devices in one week this way. A Fortune 100 customer averaged 3,000 devices per week. Your pace is set by your change control, not by the product.

Days 75 to 90: decommission and send the notice (if you haven't already)

Pull the Zscaler client, confirm nothing's still pointing at a PAC file, and close out. If you were smart on Day 0, the non-renewal notice is already in. If not, this is your last window.

The honest version of "why bother"

Switching is work. Nobody pretends otherwise. But the work is front-loaded into about six weeks, and what you get back is permanent: traffic that flies direct instead of detouring through a data center, an agent under 100 MB of RAM that's up to 4x faster than a legacy proxy, one console instead of several, and a support team made of product engineers rather than a Tier 1 queue. The full feature-by-feature comparison is on Zscaler vs dope.security.

Your renewal is a deadline. It's also the only time you have real leverage. Use it.

Start a tenant now at dope.security, or book a 20-minute call and we'll map your renewal date to a cutover plan together.