Cloudflare is faster than Zscaler

Why Zero Trust speed matters

Zero Trust products sit between users and the resources they need, so their performance directly shapes the employee experience. If a secure web gateway adds noticeable delay to every outbound request, or an access control product makes login feel sluggish, users notice — and worse, they may look for ways to bypass the security controls altogether. A Zero Trust suite that nobody wants to use is not protecting anything.

Slow performance is especially visible for tools that handle every request, like secure web gateways, or that gate entry to applications users depend on. For each of these categories, Cloudflare ran performance tests against Zscaler's equivalent offerings, measuring 95th percentile Time to First Byte and Response times to approximate what an end user actually experiences. Across the board, Cloudflare's Zero Trust products came out ahead: Cloudflare Gateway was 58% faster than Zscaler Internet Access (ZIA), Cloudflare Access was 38% faster than Zscaler Private Access (ZPA) worldwide, and Cloudflare Browser Isolation was 45% faster than Zscaler Cloud Browser Isolation worldwide.

Secure web gateway: Cloudflare Gateway vs. ZIA

A secure web gateway is a funnel for all Internet-bound traffic, so it must be both close to users and well-connected to the rest of the Internet. Traffic flows through a forward proxy path: the user connects to the proxy, and the proxy connects to the destination site. That means the proxy's own network position and peering determine much of the latency users will see.

In tests where an end-user client accessed five common destinations — a website hosted in Azure, a Cloudflare-protected Worker, Google, Slack, and Zoom — Cloudflare outperformed Zscaler for every endpoint. In some cases, including the Cloudflare-protected Worker, Cloudflare's 95th percentile response time was faster than the control group that used no gateway at all.

Part of the performance gap comes down to what Zscaler calls proxy latency: the time a request spends on a Zscaler machine before being forwarded. This metric excludes the time for the user to reach Zscaler and for Zscaler to reach the destination. Zscaler's SLA promises that 95% of requests will spend less than 100 ms in proxy latency. Cloudflare ran comparisons by enabling tracing to measure its own equivalent proxy latency. At the 95th percentile, Zscaler was exceeding its SLA while Cloudflare's proxy latency was 7 ms. Across the sites tested, Zscaler's proxy latency was 140–240 ms slower than Cloudflare's at the 95th percentile.

The test setup placed three VMs side by side in the cloud: one running Cloudflare WARP connecting to Gateway, one running ZIA, and one with no proxy as a control. Each VM made requests to the five endpoints every three minutes and logged HTTP browser timings.

For Zoom specifically, Zscaler's proxy latency accounted for nearly the entire difference: without it, Zscaler would have been roughly on par with Cloudflare and the control. Cloudflare's proxy overhead is small enough that using Gateway feels close to connecting directly to the public Internet.

Zero Trust access: Cloudflare Access vs. ZPA

Access control products should be transparent to users. Both Cloudflare Access and Zscaler Private Access let users cache authentication information on the provider network, which cuts down on repeated logins while securing application access. Keeping request latency low is just as important as minimizing the number of authentication prompts.

Cloudflare proved consistently faster across regions. In Tokyo, for example, Cloudflare's 95th percentile time to first byte was 22% faster than Zscaler's. The tests distinguished between two scenarios that have very different latency profiles:

• New session: the user has no cached authentication, so the Zero Trust service directs them to a login page, they authenticate against an identity provider, and are then redirected to the application.
• Existing session: the user is already authenticated and cached credentials can be reused, avoiding an extra identity provider call.

Measuring these scenarios separately avoids comparing a new Zscaler session against an existing Cloudflare session, which would unfairly skew results due to the authentication overhead. Even on existing sessions, where Zscaler might be expected to match Cloudflare more closely, Cloudflare came out ahead.

For new sessions and logins, Cloudflare's network appears to find better paths back to authentication providers. In testing, Cloudflare never took more than 2.5 seconds for a login response at the 95th percentile, while half of Zscaler's responses took about four seconds. For existing sessions, the two services were closer at lower latency buckets, but Cloudflare's response times were more consistent, with Zscaler showing a long tail of responses nearing a second.

These tests were run by Miercom, a third-party firm Cloudflare contracted. Miercom set up application instances in 14 worldwide locations and used Catchpoint nodes to simulate a browser connecting to resources protected by either Cloudflare or Zscaler. The test flow logged into the application, accessed a resource, then refreshed the page to measure the existing-session case. The full methodology is available in Miercom's report.

Browser isolation: Cloudflare vs. Zscaler

Remote browser isolation products depend heavily on network performance. The browser experience — every click, scroll, and page render — is being streamed from an isolated browser in the cloud, so any added latency is immediately noticeable. Users should not be able to tell that their browsing is being isolated; if they can, the product is too slow.

Comparing 95th percentile time to first byte, Cloudflare Browser Isolation was 45% faster than Zscaler Cloud Browser Isolation worldwide. For total response time, Cloudflare was 39% faster. As with the access tests, Miercom used Catchpoint nodes in 14 locations, connecting to both browser isolation services and measuring how quickly devices could reach applications through each product.

Performance is a Zero Trust requirement

In a traditional corporate network, IT teams could control performance directly by managing middle-mile connections between offices and resources. Zero Trust shifts that responsibility to the provider, which must deliver consistent performance over the public Internet for every user, everywhere. The quality of that job directly affects how often employees hit slow logins, sluggish gateways, or hesitant browser sessions — and how tempted they are to disable the security controls.

Real-time functions like authentication and web gateway routing need low and predictable latency. Cloudflare's results across all three product categories point to network architecture as the differentiator: deeper last-mile presence and stronger peering keep user traffic closer to its destination, which reduces both transit hops and proxy processing time. That is the difference between a security tool that slows work down and one that operates in the background, largely unnoticed.