Beyond the SSE label: where the two Zero Trust platforms actually differ
Zscaler has spent 15 years building its security cloud. Cloudflare has offered Zero Trust for only four of its 13 years. At first glance, that looks like a late start — but a new functional comparison suggests the younger platform has already moved ahead on total Zero Trust, SSE, and SASE coverage. Cloudflare has published a deep-dive comparison of 37 functional criteria against Zscaler's Zero Trust Exchange, and the results are not what the market might expect.
The speed of Cloudflare's build-out is not accidental. Its programmable Anycast network was already serving security and performance products to global web and application customers, providing years of insight into real Internet traffic. Workers, its serverless compute platform, was designed specifically for building distributed applications with security and performance baked in — not retrofitted for edge security later.
That infrastructure also meant Cloudflare could start with a blank slate on modern cloud assumptions. Zscaler's architecture was conceived in an era when assumptions about network performance and global reach were very different. As Cloudflare points out, that affects not just what each platform can do today, but how quickly each can evolve.
Below is a look at two of the five comparison groups from the full functional deep dive: services for SASE adoption and network on-ramps. The associated PDF adds footnotes (*) for context and clarity.
| Network on-ramps | Cloudflare | Zscaler |
|---|---|---|
| Clientless browser-based access | YES | YES |
| Device client software | YES | YES |
| Application connector software* | YES | YES |
| Branch connector software* | NO | YES |
| Anycast DNS, GRE, IPsec, QUIC, Wireguard tunnels* | YES | NO |
| Private network interconnect for data centers & offices | YES | NO |
| Inbound IP transit (BYOIP) | YES | NO |
| IPv6-only connection support* | YES | NO |
| Recursive DNS resolvers | YES | YES |
| Device clients and DNS resolvers freely open to public* | YES | NO |
Standard features lists, however, do not tell the whole story. Zero Trust is organization-wide, so the day-to-day experience matters as much as the checkbox count. In three areas, Cloudflare argues, the operational reality of its platform diverges significantly from Zscaler's.
Every service runs in every location
Zscaler markets itself as running the “largest security cloud on the planet,” yet its own configuration resources break the network into at least eight distinct clouds, such as zscalertwo.net and zscalerthree.net. Practically, users must log into per-product portals instead of one pane of glass, so each offering is handled like a separate product rather than one integrated cloud.
Cloudflare runs a single Anycast cloud network across more than 270 cities, compared with Zscaler's 55 cities — not all of which belong to a single cloud network. Every Cloudflare One service, along with its updates and new features, is built to run on every server in every data center, available to every customer. For administrators, that means one dashboard for ZTNA, CASB, SWG, RBI, DLP, and related services, eliminating the separate screens and manual policy alignment that often accompany a piecemeal rollout.
Throughput limits affect user experience
Security that drags down performance invites workarounds. Zscaler caps GRE tunnels at a maximum bandwidth of 1 Gbps per tunnel when the tunnel's internal IP addresses are not behind NAT. That creates a hard ceiling even if the underlying link is capable of far more.
Cloudflare says its testing of high-bandwidth applications between devices in different VPCs, connected via its Anycast IP tunnel, showed 6 Gbps of throughput in both directions. That level of capacity eases concerns about video streaming or large file sharing hitting the platform's limits. For enterprises evaluating new high-bandwidth workloads, that gap can factor into a deployment decision.
Peering and transit: the rest of the path matters
Zscaler calls itself the “fastest onramp to the Internet,” but an on-ramp is just the entrance. Traffic also has to cross the network and exit on the far side. Without strong connectivity beyond the edge, Zscaler stops at SSE and never reaches true SASE, because the networking component is not complete.
Cloudflare reports over 10,500 interconnection peers, an order of magnitude advantage over Zscaler. Rather than handing off traffic at the edge, customers can use Cloudflare's virtual backbone for transit. The network handles more than 3 trillion requests per day, allowing Argo Smart Routing to detect real-time congestion and route IP packets over the fastest reliable paths.
The services built on that foundation also reach beyond typical SSE scope. Zscaler offers SWG and ZTNA to eliminate regional data center hubs, but it does not address protection for inbound traffic across exposed cloud or on-premise applications — Web Application Firewalls, load balancing, authoritative DNS, and DDoS protection all sit outside its platform. That is exactly the space Cloudflare came from and still leads in.
The full comparison, including all 37 criteria and additional context, is available on Cloudflare's public site.
