Spotlight on Zero Trust: we're fastest and here's the proof

Why Zero Trust performance is a security issue

Zero Trust tools only protect an organization if employees actually use them. When security products add noticeable latency to everyday work, users find ways around them, and the protection evaporates. For that reason, performance isn't a nice-to-have in Zero Trust; it's a core requirement for adoption and safety.

To see how well Zero Trust vendors hold up under real-world conditions, we ran a new round of tests against our own Cloudflare Gateway and Access products, plus offerings from Zscaler, Netskope, and Palo Alto Networks. We tested three scenarios — Secure Web Gateway (SWG), Zero Trust Network Access (ZTNA), and Remote Browser Isolation (RBI) — from 12 global regions, up from four in previous rounds. The results show Cloudflare leading in most cases: fastest SWG in 42% of scenarios, 46% faster than Zscaler, 56% faster than Netskope, and 10% faster than Palo Alto Networks for ZTNA, and 64% faster than Zscaler for RBI.

SWG: speed at the funnel

A secure web gateway handles all of an organization's Internet-bound traffic. If the gateway is slow, every page load, video call, and cloud app suffers. If users notice, they may disable the gateway altogether, which is exactly the outcome security teams want to avoid.

A performant gateway needs two things: proximity to users and strong peering with the rest of the Internet. Most websites rely on CDNs to accelerate content delivery, and those CDNs are typically well-peered and embedded in last-mile networks. But forward proxy traffic has a different path: the user connects to the proxy, and the proxy connects to the destination. If the proxy isn't as well-connected as the websites themselves, user traffic can detour farther than necessary, creating a "hairpin" effect.

Cloudflare's network is embedded deep into last-mile networks and peered with over 12,000 networks. In our tests, that connectivity pays off: Cloudflare Gateway was the fastest in 42% of tested scenarios, measuring the 95th percentile HTTP response time — how long it takes a user to reach the proxy, have the proxy fetch a website, and return the response. Aggregated across all tests, Cloudflare is 2.5% faster than Palo Alto Networks, 13% faster than Zscaler, and 6.5% faster than Netskope.

Peering makes a measurable difference in regions that are harder to reach. For example, in Australia Cloudflare is 30% faster than the next-fastest provider, thanks to local peering with all major Australian Internet providers. The more local the peering, the shorter the distance requests travel on the public Internet before hitting the gateway.

To get these numbers, we placed four VMs side by side — one running Cloudflare WARP, one Zscaler's ZIA, one Netskope, and one Palo Alto Networks — in 12 cloud regions. The VMs made requests every five minutes to 11 different websites and logged HTTP browser timings. This setup gives a user-facing view of performance.

Cloudflare isn't fastest everywhere yet. The full matrix of results shows gaps in South Africa, UAE, and Brazil. The goal is to close those gaps by September.

ZTNA: faster than a VPN

Zero Trust Network Access is meant to be more secure than a VPN, but it shouldn't feel slower. Our ZTNA tests pitted Cloudflare Access against Zscaler, Netskope, and Palo Alto Networks. We hosted applications in three clouds (AWS, GCP, and Azure) across 12 locations and accessed them from 400 Catchpoint nodes worldwide. Each node performed two actions: a "new session" (log in and receive an authentication token) and an "existing session" (refresh the page and pass previously obtained credentials).

We measure these two scenarios separately because looking at a combined 95th percentile would almost always reflect new session latency. But even with that more demanding metric, Cloudflare comes out clearly ahead.

Cloudflare was faster in both US East and Singapore. In Ashburn, Virginia, Cloudflare beats Zscaler and Netskope handily; against Palo Alto Networks, the comparison is trickier. Their ZTNA product intercepts new sessions fully and returns a response from its own processors rather than forwarding users to the application's login page. That means their new-session latency doesn't measure true end-to-end performance. Only their existing-session numbers represent a true pass-through, and there Cloudflare is 10% faster.

In Singapore, Cloudflare is 50% faster than Zscaler and Netskope, and 10% faster than Palo Alto Networks for existing sessions.

Looking only at North American Catchpoint nodes close to the hosted applications, Cloudflare's advantage holds: 50% better than Netskope, 40% better than Zscaler, and 10% better than Palo Alto Networks at the 95th percentile for warm connections.

Out of 30 cloud regions with accurate data, Cloudflare was the fastest ZTNA provider in 28 — 93% of tested regions.

RBI: the browser in the cloud

Remote Browser Isolation depends even more heavily on the public Internet than other Zero Trust tools. Latency here isn't just a page delay; it makes the entire browsing experience feel wrong, which is why it only works if the connection to the isolation service is excellent.

For RBI testing, we again compared Cloudflare against Zscaler. Netskope's RBI product couldn't be tested at full fidelity because it requires an SWG client, limiting test location coverage.

Cloudflare was 64% faster than Zscaler across every scenario tested. No Cloudflare-protected endpoint had a 95th percentile HTTP response above 2105 ms; no Zscaler-protected endpoint came in below 5000 ms. Cloudflare's advantage held for both new and existing session tests across all clouds and regions.

The takeaway

Fast Zero Trust services encourage adoption and keep security transparent. Cloudflare's edge comes from its network design: deep last-mile coverage and extensive peering that minimizes the distance traffic travels between users, the proxy, and the open Internet. That's why performance is an ongoing priority — not to win benchmarks, but so customers in every region get a fast, reliable experience.