Cloudflare launches Descaler Program to ease Zscaler exits

Cloudflare has announced the Descaler Program, a migration initiative aimed at existing Zscaler customers moving to Cloudflare One. The program combines technical tools, architectural guidance, and financial flexibility to reduce the friction commonly associated with switching SASE and Zero Trust platforms.

The program is open to enterprise organizations using Zscaler products such as ZIA or ZPA. Eligible participants must have at least 1,000 employees. Cloudflare says customers can expect to be operational on Cloudflare One within weeks, without business disruption.

Technical migration support

The technical side of the program includes three components: architecture workshops, migration tooling, and partner engagement.

Architecture workshops

Cloudflare experts work with customer teams to assess their current state and map migration paths aligned with two-to-three-year digital transformation goals. Outcomes include a custom migration plan, access to the Descaler toolkit, and dedicated Cloudflare resources to assist with the cutover.

Descaler migration toolkit

The toolkit uses extract, transform, and load (ETL) practices with documented API calls to export configurations from ZIA or ZPA, transform them to Cloudflare One-compatible formats, and import them into a new Cloudflare One account. The tooling handles settings such as application names, domains/SNI, IPs, ports, protocols, and user groups.

For example, the toolkit inspects existing ZPA application metadata before migrating it. In urgent ZIA scenarios, users can take a faster path by switching DNS for baseline protection first, then deploying WARP and a full Secure Web Gateway.

To use the toolkit, customers create a new API key in their ZIA or ZPA account. The Cloudflare team shares the toolkit, which runs locally via a system administrator. Cloudflare never receives or requests the API key itself — only the outputs generated. The toolkit performs only read and list API requests against the Zscaler account. Where configurations do not map one-to-one, Cloudflare staff and authorized partners assist with the transition.

Partner network

Customers can draw on the Cloudflare Partner Network for implementation assistance, including the Authorized Partner Service Delivery Track announced earlier this year. Additional resources such as certification training and in-house professional services are being explored for future releases.

Business-side program elements

The program also covers commercial and strategic considerations for executives:

  • ROI calculation: Cloudflare provides quantifiable assessments of potential cost and performance benefits from migration.
  • Contract escape hatch: Flexible financial options are available to help customers exit existing Zscaler agreements without waiting for renewal cycles.
  • Zero Trust roadmap assessment: The vendor-agnostic Zero Trust Roadmap resource helps leaders plan future security initiatives with input from architects and engineers.

Why customers are switching

Cloudflare identifies three primary reasons organizations choose its platform over Zscaler:

  1. User experience: Customers report easier deployment and simpler management. Cloudflare points to a unified control plane versus Zscaler's fragmented clouds and piecemeal services, which add complexity over time.
  2. Connectivity: Cloudflare says its larger network footprint runs every service in every location, delivering consistent protection worldwide.
  3. Agility: Customers value Cloudflare's rapid release cadence and flexible architecture for adopting new security standards as Zero Trust and SASE evolve.

Organizations interested in enrollment can sign up through Cloudflare's signup page, providing details about their current Zscaler deployments, challenges, and Zero Trust or SASE goals.