Zscaler
Capability scores
Methodology →- Authentication
- 3.5
- SSO & Federation
- 3.5
- Authorization
- 4.5
- Lifecycle & Provisioning
- 3.0
- MFA & Passwordless
- 3.5
- Governance & Audit
- 4.0
- Developer Experience
- 3.0
- Deployment Flexibility
- 3.5
- Pricing Transparency
- 2.5
- Support & Ecosystem
- 4.5
Scored 0–5 against a published rubric. Independent analysis, no vendor sponsorship.
Overview
Zscaler is the largest pure-play security service edge vendor, a public company (NASDAQ: ZS) headquartered in San Jose, whose Zero Trust Exchange platform replaces VPNs, web proxies and backhauled traffic with identity-aware access. Its fiscal 2026 Form 10-K reports about 11,000 customers, including over 40% of the Forbes Global 2000, revenue of $3,352.5 million for the year to 31 July 2026, and a cloud spread across over 200 public data centers. The core products are Zscaler Internet Access (ZIA, secure web gateway), Zscaler Private Access (ZPA, ZTNA) and Zscaler Digital Experience (ZDX), all delivered through one Client Connector agent.
Zscaler bought four companies in twelve months, per the same filing: Red Canary (managed detection and response, August 2025, $651.4 million cash), SPLX (AI security, October 2025), SquareX (browser security, February 2026) and Symmetry Systems (data and identity mapping for AI security, May 2026). The direction is clear: security operations and AI-agent traffic on top of the access platform.
What it is good at
Scale and breadth. ZPA grants access per application based on identity and context without putting users on the network, which removes the lateral movement a VPN allows. ZIA inspects TLS traffic inline for users, devices, workloads and AI agents. Policy draws on identity from your existing provider, such as Okta or Microsoft Entra ID, and the 10-K describes a single global policy engine governing access to internally managed apps wherever users sit. ZDX reuses the same agent, so adding experience monitoring needs no new endpoint software. Support and partner coverage are deep.
Where it falls short
This is enterprise-tier software with enterprise-tier pricing and a real migration programme; it is rarely right for cost-sensitive mid-market or small teams. It consumes identity rather than providing it. The acquisition pace means new modules (browser security, AI security, MDR) arrive faster than they integrate, so test what is native versus bolted on. Its corporate identity layer has also been reached: in August 2025 stolen Salesloft Drift OAuth tokens exposed Zscaler's Salesforce contact and support-case data, though Zscaler says no product or infrastructure access occurred. No Zscaler CVE brief exists in our catalog.
Pricing
Quote-based; no list prices published (checked 2026-11-05) on the Zscaler pricing page, which names Essentials Platform and Zscaler Platform bundles plus add-ons, some metered by throughput, endpoints or systems rather than users. The 10-K describes Z-Flex, flexible product selection inside a pre-negotiated spend commitment.
Best for, and who should look elsewhere
Choose Zscaler for large, global enterprises consolidating secure web gateway, VPN and ZTNA onto one proven SSE platform. Data-protection-led buyers should also test Netskope; mid-market and developer-led teams should look at Cloudflare or Tailscale. Compare Cloudflare vs Zscaler and Zscaler vs Netskope.
Bottom line
The enterprise SSE reference for global organisations replacing legacy network security, priced and scoped accordingly.
Zscaler: frequently asked questions
- How much does Zscaler cost?
- Zscaler does not publish list prices (checked 2026-11-05). Its pricing page names two platform bundles, Essentials Platform and Zscaler Platform, plus add-ons for private access, data security, branch, privileged remote access and digital experience monitoring, all quoted through sales. Some items are metered on something other than users: Zero Trust Branch is sized by encrypted throughput or endpoint count, and Privileged Remote Access Advanced by the number of RDP, VNC or SSH systems. Standard Privileged Remote Access is included with platform purchases above 500 users. Expect an enterprise quote and a multi-year term.
- What has Zscaler acquired in 2025 and 2026?
- Per its fiscal 2026 Form 10-K, four companies. Red Canary, a managed detection and response firm, closed on 1 August 2025 for $651.4 million in cash. SPLX, an early-stage AI security company, closed on 31 October 2025 for $40.6 million. SquareX, a browser security company, closed on 5 February 2026 for $112.8 million. Symmetry Systems, which maps data and identity relationships for AI security, closed on 27 May 2026 for $152.9 million. Each deal also carried restricted stock for retained staff.
- Was Zscaler affected by the Salesloft Drift breach?
- Yes, in its Salesforce instance. Zscaler said on 30 August 2025 that stolen Salesloft Drift OAuth tokens were used to access Salesforce data: business contact details, Zscaler product licensing and commercial information, and plain-text header fields from some support cases such as case number, status and subject. It said no attachments were involved and that the incident did not involve access to any Zscaler products, services or underlying infrastructure. It revoked Drift's access and rotated tokens.
- What should I check in a Zscaler zero trust evaluation?
- Map identity first: confirm how your identity provider federates into Zscaler, whether groups arrive by SCIM or just-in-time at login, and how quickly a disabled user loses ZIA and ZPA access. Then size the migration: ZIA replaces the web proxy, ZPA replaces VPN with per-application access, and both share one Client Connector agent. Ask which features sit in Essentials versus the full platform, how Z-Flex spend commitments work, and what branch or OT traffic needs separate metering.
- What are the best Zscaler alternatives?
- Netskope is the closest like-for-like SSE, stronger on inline data protection and CASB heritage. Palo Alto Networks Prisma Access suits buyers already on Palo Alto firewalls, and Cisco Secure Access suits Cisco estates. Cloudflare is the value choice, with a published $7 per user per month plan and a free tier for up to 50 users. For developer-led private access without a web gateway, Tailscale and Twingate are lighter and faster to deploy.
Zscaler comparisons
More Zero Trust vendors
All Zero Trust →- Cloudflare Zero Trust4.6/5
- Tailscale4.5/5
- Cato Networks4.4/5
- Netskope4.3/5
- Palo Alto Prisma Access4.3/5
Related on Start with Identity
- VendorAppgate
strong_contender
- VendorBanyan Security (now SonicWall Cloud Secure Edge)
strong_contender
- VendorCato Networks
top_tier
- Comparisontailscale-vs-cloudflare
Tailscale is a WireGuard mesh with identity-aware ACLs, built for engineers reaching infrastructure. Cloudflare Zero Trust is an identity-aware proxy and wider
By SWI Community Team · Last evaluated 2026-11-05
Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.