CyberIndexBeta

Product

Cloud-delivered firewall in the Zscaler Zero Trust Exchange (Zscaler Internet Access) that inspects web and non-web traffic on all ports and protocols, including TLS decryption. Zero trust is a security strategy in which entities are granted access based on context and security posture—not assumed trust. Built on a cloud native platform, a zero trust firewall protects web and non-web traffic for all users, apps, locations, and clouds. SSE core services include secure web gateway (SWG), zero trust network access (ZTNA), cloud access security broker (CASB), and firewall as a service (FWaaS). It is available as a cloud instance.

Current Version
Cloud · no version
Market
Enterprise
Licence
Paid
Price
Quote
Record Created
2026-09-19
Last Updated
2026-10-12

Vendor

Zscaler was founded in 2007 by Jay Chaudhry on the argument that if applications and users have both left the office, the security stack should leave too. It built a global network of data centres through which customer traffic is routed, inspected and forwarded — the Zero Trust Exchange — and sells access to that network instead of appliances. It is listed on Nasdaq and is one of the largest security companies by market value. Zscaler Zero Trust Firewall, the product here, is the firewalling layer of that service: policy applied to all ports and protocols as traffic passes through Zscaler's network, with Zscaler Internet Access and Zscaler Private Access covering web traffic and application access. Nothing it sells runs on an endpoint as a scanner, so the malware detection cycles in this index do not measure it. What it competes against is the other cloud-delivered platforms and the appliance firewalls it was designed to replace. Vendor page →

Country
United States
Headquarters
San Jose, United States
Year Established
2007
Customers
11K organisations
Users
40M users
Revenue
$3.4B (2026)

Platforms

Cloudnative

Target Market

Enterprise primary

Capabilities

Stateful Inspectionkeynative
Intrusion Prevention (IPS)keynative
Intrusion Detection (IDS)Not known
SSL/TLS Inspectionkeynative
VPN Gatewaykeynative
SD-WANnative
Application Controlkeynative
High Availabilitynative
Deep Packet Inspectionnative
Central Management Consolenative

1 of 10 not yet known — not recorded, which is not the same as not supported.

Specifications

Firewall TypeCloud

4 other specifications for this category not yet known.

Pricing

PlanLicencePriced perBilledPrice
SummaryPrice on requestnot statedno recurring chargeQuote

Versions

Not known

The newest release each source names per platform, not every release the vendor has shipped. A release date is shown only where one is recorded.

Independent Tests

Not tested This product does not appear in any test run CSI holds. That is not a low score.

Certifications

FedRAMPHigh1 activeFR2227062482
FIPS 140-31 activeFIPS 140-3 #5080

Change History

This record was created 2026-09-19. Everything below is what has changed since.

  • 2026-10-12Certification addedCertified: FIPS 140-3evidence
  • 2026-10-12Certification addedCertified: FedRAMP (High)evidence
  • 2026-10-08Capability addedVPN Gateway: built inevidence
  • 2026-10-08Capability addedCentral Management Console: built inevidence
  • 2026-10-07Capability addedStateful Inspection: built inevidence
  • 2026-10-07Capability addedDeep Packet Inspection: built inevidence
  • 2026-10-07Capability addedHigh Availability: built inevidence
  • 2026-10-07Capability addedSD-WAN: built inevidence
  • 2026-10-07Capability addedDeep Packet Inspection: built inevidence
  • 2026-10-07Capability addedApplication Control: built inevidence
  • 2026-10-07Capability addedSSL/TLS Inspection: built inevidence
  • 2026-10-07Capability addedIntrusion Prevention (IPS): built inevidence
  • 2026-10-07Capability addedStateful Inspection: built inevidence
  • 2026-09-20Pricing plan addedPrice: price on requestevidence
  • 2026-09-20Platform addedRuns on Cloudevidence
  • 2026-09-19Product updatedSold to: Enterpriseevidence
  • 2026-09-19Product createdNew product, listed in Network Firewallevidence

May we count your visit? CyberIndex would like to use Google Analytics to see which pages are read. It sets cookies and sends your visit to Google. Decline and nothing is loaded — the site works the same either way. Privacy.