Zero Trust Speed: Why End-to-End Latency Is the Only Metric That Matters
Cloudflare has published several deep dives into Zero Trust performance throughout 2023, each outlining a battery of tests designed to measure how quickly traffic moves through a Zero Trust proxy. Some dismiss these as marketing exercises, but the tests are not rigged to flatter the network. The network simply performs well when the tests are run.
Performance in this context is not merely a convenience issue. Poor performance is an active threat vector: if Zero Trust tools make applications painfully slow, users will disable them to get their work done. The goal is to make security invisible and fast enough that users never feel compelled to bypass it.
The fundamental question is what we should measure. Zscaler reports proxy latency, Netskope reports a decrypted latency SLA, and other providers avoid the subject altogether. At Cloudflare, we believe the only meaningful metric is end-to-end HTTP response time: the full round trip from the user's device through the Zero Trust proxy, over the Internet to the destination application, and back. Proxy latency and decrypted latency SLAs measure only what happens inside a single vendor's hardware. That is a small fraction of the user-visible delay.
Why Users Perceive Zero Trust Through Applications
Users do not interact with Zero Trust products directly. They interact with websites and applications: a private Exchange instance, a Salesforce portal, or any other hosted service. Zero Trust services operate as a forward proxy in the middle, inspecting packets for security and access policy before forwarding them to the destination. When working correctly, the proxy is completely invisible to the user.
Performance testing must therefore simulate real user behavior. We generate HTTP requests through a Zero Trust client to common enterprise websites and measure the timings. This methodology stems from work we have already done benchmarking our Developer Platform and Network, framing Zero Trust performance within a broader analysis framework that keeps the focus on user experience.
Zero Trust comes with an inherent latency disadvantage: the proxy adds an extra network hop. Maintaining connectivity with end-user ISPs, cloud providers, and transit networks requires extensive peering relationships, and on top of that there is the processing time for rule evaluation and packet inspection. This is a complex performance environment.
Some providers attempt to simplify the problem by scoping performance down to only what they control. Proxy latency and decrypted latency metrics isolate the time traffic spends on the vendor's hardware. This grants a guarantee of sorts but ignores the majority of the request time, which is spent on the wire between machines. As we demonstrated in January, on-box processing is a minor component of total round-trip time. A narrow metric is no substitute for holistic measurement.
The Network Components of True Speed
Think of Zero Trust performance like driving to a restaurant. A burger joint that serves food in one second is irrelevant if it sits 15 minutes off the highway. The fastest option is the one that is close to your route and serves quickly. Both matter, and neglecting either destroys the overall experience.
Beyond solid processing times, three network attributes define fast Zero Trust:
Last Mile Peering
Physical proximity straightens the path packets travel. In the connectivity model shown above, a direct connection is always shorter than a proxied path that forces a hairpin. A well-placed proxy minimizes that detour. With over 12,000 peered networks, we continuously invest in pushing our presence closer to users everywhere.
Cloud Peering
Proximity to users is only half the problem. Traffic must then reach its destination, which is frequently hosted in hyperscale clouds like AWS, Azure, or Google Cloud. These providers operate hundreds of locations worldwide. If a Zero Trust network is not peered with them where they offer compute, the path diverges noticeably.
We maintain peering with the major cloud providers in over 40 metros globally, keeping the handoff from our network to the destination short wherever an application might live.
Resilient Transit Paths
With good last mile and cloud connectivity, the remaining challenge is getting traffic between the two. A diverse set of internal network paths permits traffic shifting around outages and congestion, ensuring reliable private connectivity between the user edge and the application destination. We use our private backbone for this purpose, which underpins performance for all of our service scenarios.
Measuring What Counts
Our measurement methodology is simple. During Gateway tests, we configure a client that periodically connects through our Zero Trust client to a selection of websites commonly used by enterprises. We then capture HTTP timings to calculate the HTTP Response time: the full duration from the user device to our Zero Trust proxy, through inspection, onwards to the destination website, and back again.
We deliberately exclude metrics such as Largest Contentful Paint or application-specific measurements like UDP video delivery. Those depend on the destination's software stack, whether the destination uses a CDN, and the browser rendering the page. Our focus is purely on how well the Zero Trust service moves packets in both directions:
This approach measures the network delivery of responses, not the ability of a web app to load and display. If a Zero Trust proxy distorts the path, this is where the damage shows up in the numbers.
Turning performance data into action
Performance measurement isn’t just an internal exercise at Cloudflare; it’s a shared process with our users. The tools we build for visibility are the same ones we use to drive our own improvements. Our Digital Experience Monitoring (DEX) product is designed to do more than surface errors—it gives you a direct view into your Zero Trust performance so you can track user experience alongside our network telemetry.
DEX lets you run synthetic tests against specific endpoints, mirroring the methodology we use internally. In the Cloudflare dashboard, you can review HTTP Response results for those tests, turning our internal practices into a self-service tool. This visibility serves a dual purpose: you identify regressions affecting your environment, and we aggregate that data to better understand Zero Trust performance across our network and the Internet at large. The more tests you run, the sharper that collective picture becomes.
Every measurement we take and investigate is anchored to the same principle: improving these numbers translates directly to a better end-to-end experience for Zero Trust users. The metrics aren’t abstract—they’re the signal we use to find and fix what’s slowing you down.
