Zscaler (ZS)
Secures enterprise access through a distributed cloud platform built around zero trust.
Something off on this page? Send us feedback.
Zscaler inspects a company's internet traffic on the way past, deciding what each employee, office or program is allowed to reach. Most of the money still comes from the original idea: a seat for every worker, sold to retire corporate firewalls and remote-access tunnels. The growth now comes from everything that is not a seat — branches, servers, security teams, and the traffic AI tools create.
Item facts: FY2026 · year ended July 31, 2026, from filings, earnings calls and company pages.
Judgment weights, not filed revenue
The band summarizes business focus and direction. ~ marks estimates.
8 in detail · 12 more below
Zero Trust Users (Internet Access + Private Access)
The original seat-priced pair: one checks where employees go on the internet, the other lets them reach internal apps without a network tunnel. It pays the bills, and no single customer is even a tenth of sales.
Competes with Prisma Access / Prisma SASE (Palo Alto Networks) · Netskope One (Netskope) · Cloudflare One (Cloudflare)
In plain English
Think of the old arrangement: a company draws a wall around its offices, and anyone working elsewhere has to tunnel back in. Zscaler takes the wall away. Every request from an employee's laptop goes first to Zscaler's own computers, which check who is asking and what they are allowed to open, then connect them to that one thing and nothing else.
Companies pay a yearly fee for each employee, signed several years at a time. It is the oldest part of the business and still the largest — the part that funds everything newer.
Z-Flex
A way of buying rather than a thing to buy: commit a large sum up front, then switch modules on and off during the term. It is largely why signed-but-undelivered work reached about $7.4 billion, up 27%.
Competes with Platform enterprise agreements (Palo Alto Networks) · Buying each tool separately (Point security vendors)
In plain English
Not a product at all — a purchasing arrangement. A customer promises a large sum, typically spread over about four years, and in exchange can turn modules on, off or swap them mid-term without going back through the buying process each time.
Zscaler likes it because customers commit earlier and spend more: deals done this way came with average yearly spending almost thirty percent higher. The cash arrives across the years of the contract, so it piles up as work already signed long before any of it counts as sales — which is why that pile is growing faster than revenue.
Data Security Everywhere
Eight add-on tools that catch sensitive files heading out the door. Committed yearly subscriptions passed $500 million as of last spring, growing over 30%, and it is the doorway into AI work — most AI deals last quarter included it.
Competes with Netskope One data protection (Netskope) · Prisma Access data security (Palo Alto Networks)
In plain English
Every company now keeps its secrets in somebody else's software — files in cloud drives, customer lists in sales tools, and lately text pasted into chatbots. Since that traffic already passes through Zscaler, the company can read it on the way by and stop what should not leave: a payroll spreadsheet, a design file, a list of card numbers.
It sells as extra modules on top of the main subscription, some priced by how much data flows rather than by headcount. Customers keep paying because the rules only hold while the traffic keeps passing through.
Security for AI
Rules for the chatbots and self-driving programs employees now use: what they may read, where the answers may go. Small today, but bookings rose more than 50% in the final quarter, and two pieces are still in early access.
Competes with Cloudflare AI security (Cloudflare) · Built-in AI access controls (Identity software vendors)
In plain English
Staff paste work into chatbots, and companies are starting to let AI programs act on their own — opening files, calling other software, doing errands. Somebody has to decide what those programs may touch. Zscaler sits where it always has, between the user and the outside world, and applies the same kind of rules to an AI's requests as to a person's.
It is charged mostly by how much gets used rather than by headcount. The base is small, so the percentages are large: the pillar grew over 80% in the first quarter of FY2026, beating its full-year goal in that quarter alone.
Zero Trust Branch
One box per site replaces the branch firewall, the networking gear and the private line, and covers machines nobody can install software on. Committed value roughly tripled in a year — and it puts Zscaler in the hardware-buying business.
Competes with FortiSASE / Secure SD-WAN (Fortinet) · Cato SASE Cloud (Cato Networks) · Prisma SD-WAN (Palo Alto Networks)
In plain English
A shop floor, a hospital wing, a bank counter: each has traditionally kept its own stack of networking boxes plus a private line back to headquarters. Zscaler ships one appliance instead. It plugs in, sends everything to Zscaler's cloud to be checked, and also covers the equipment that cannot run security software — cameras, printers, factory machines.
The price follows sites and devices, not employees. The largest branch deal in the company's history landed last spring: an eight-figure expansion across 2,000 sites for a healthcare system, pushing out both a firewall vendor and a networking vendor.
Zero Trust Cloud (Workload Communications)
The same allow-or-deny checking applied to programs talking to programs, aimed at the rented firewalls companies run inside their cloud accounts. Roughly 4% of sales, and it leans on cloud providers that sell competing controls.
Competes with VM-Series virtual firewalls (Palo Alto Networks) · Cloudflare One / Magic WAN (Cloudflare) · Built-in cloud network controls (Amazon Web Services)
In plain English
Most of the traffic inside a large company is not people at all — it is software talking to software, a payments service calling a database, one datacenter answering another. Those conversations normally pass through firewalls the company rents inside its cloud accounts. Zscaler offers to take that job over and apply the same rules it applies to employees.
It sells in tiers, and increasingly through the cloud providers themselves: Google Cloud added a managed version last quarter, alongside one that already ran on Amazon's cloud. The awkward part is that those same providers sell controls of their own.
Agentic SecOps (Red Canary + Data Fabric)
Watching for break-ins on a customer's behalf, bought with Red Canary for $675 million and now wrapped in AI helpers that sift alarms. Red Canary alone added $144 million of FY2026 revenue and exited the year at $141 million of yearly subscriptions.
Competes with Falcon platform and MDR (CrowdStrike) · Cortex XSIAM (Palo Alto Networks)
In plain English
Somewhere in every large company a team reads security alarms all night and works out which ones are real. Zscaler bought Red Canary, a firm that does that watching for customers as a service, and has now pointed AI helpers at the job: sort the alarms, chase the suspicious ones, cut off what is clearly bad.
The claimed edge is raw material. Because company traffic already runs through Zscaler, it holds hundreds of billions of records a day to search — which is also the catch: without that stream, the approach loses what makes it different.
Zscaler Digital Experience (ZDX)
Works out why an app feels slow, using traffic the company already carries. Its paid tiers passed $100 million of twelve-month orders in early 2026, up over 80% — yet it has dropped out of management's story.
Competes with ThousandEyes (Cisco) · Digital Experience Management (Netskope)
In plain English
When a video call stutters or a work app crawls, the help desk usually cannot say whose fault it is: the laptop, the home wi-fi, the internet provider or the app itself. Because employee traffic already travels through Zscaler, it can time each leg of the journey and point at the slow one.
The basic version is included in the main subscription and the useful upgrades cost extra, which is the design: give away the diagnosis, charge for the detail. Those upgrades crossed $100 million of orders over a twelve-month stretch as of early 2026. Still selling, no longer the headline.
Zero Trust Users (Internet Access + Private Access)The original seat-priced pair: one checks where employees go on the internet, the other lets them reach internal apps without a network tunnel. It pays the bills, and no single customer is even a tenth of sales.The original seat-priced pair: one checks where employees go on the internet, the other lets them reach internal apps without a network tunnel. It pays the bills, and no single customer is even a tenth of sales.
In plain English
Think of the old arrangement: a company draws a wall around its offices, and anyone working elsewhere has to tunnel back in. Zscaler takes the wall away. Every request from an employee's laptop goes first to Zscaler's own computers, which check who is asking and what they are allowed to open, then connect them to that one thing and nothing else.
Companies pay a yearly fee for each employee, signed several years at a time. It is the oldest part of the business and still the largest — the part that funds everything newer.
Competes with Prisma Access / Prisma SASE (Palo Alto Networks) · Netskope One (Netskope) · Cloudflare One (Cloudflare)
Z-FlexA way of buying rather than a thing to buy: commit a large sum up front, then switch modules on and off during the term. It is largely why signed-but-undelivered work reached about $7.4 billion, up 27%.A way of buying rather than a thing to buy: commit a large sum up front, then switch modules on and off during the term. It is largely why signed-but-undelivered work reached about $7.4 billion, up 27%.
In plain English
Not a product at all — a purchasing arrangement. A customer promises a large sum, typically spread over about four years, and in exchange can turn modules on, off or swap them mid-term without going back through the buying process each time.
Zscaler likes it because customers commit earlier and spend more: deals done this way came with average yearly spending almost thirty percent higher. The cash arrives across the years of the contract, so it piles up as work already signed long before any of it counts as sales — which is why that pile is growing faster than revenue.
Competes with Platform enterprise agreements (Palo Alto Networks) · Buying each tool separately (Point security vendors)
Data Security EverywhereEight add-on tools that catch sensitive files heading out the door. Committed yearly subscriptions passed $500 million as of last spring, growing over 30%, and it is the doorway into AI work — most AI deals last quarter included it.Eight add-on tools that catch sensitive files heading out the door. Committed yearly subscriptions passed $500 million as of last spring, growing over 30%, and it is the doorway into AI work — most AI deals last quarter included it.
In plain English
Every company now keeps its secrets in somebody else's software — files in cloud drives, customer lists in sales tools, and lately text pasted into chatbots. Since that traffic already passes through Zscaler, the company can read it on the way by and stop what should not leave: a payroll spreadsheet, a design file, a list of card numbers.
It sells as extra modules on top of the main subscription, some priced by how much data flows rather than by headcount. Customers keep paying because the rules only hold while the traffic keeps passing through.
Competes with Netskope One data protection (Netskope) · Prisma Access data security (Palo Alto Networks)
Security for AIRules for the chatbots and self-driving programs employees now use: what they may read, where the answers may go. Small today, but bookings rose more than 50% in the final quarter, and two pieces are still in early access.Rules for the chatbots and self-driving programs employees now use: what they may read, where the answers may go. Small today, but bookings rose more than 50% in the final quarter, and two pieces are still in early access.
In plain English
Staff paste work into chatbots, and companies are starting to let AI programs act on their own — opening files, calling other software, doing errands. Somebody has to decide what those programs may touch. Zscaler sits where it always has, between the user and the outside world, and applies the same kind of rules to an AI's requests as to a person's.
It is charged mostly by how much gets used rather than by headcount. The base is small, so the percentages are large: the pillar grew over 80% in the first quarter of FY2026, beating its full-year goal in that quarter alone.
Competes with Cloudflare AI security (Cloudflare) · Built-in AI access controls (Identity software vendors)
Zero Trust BranchOne box per site replaces the branch firewall, the networking gear and the private line, and covers machines nobody can install software on. Committed value roughly tripled in a year — and it puts Zscaler in the hardware-buying business.One box per site replaces the branch firewall, the networking gear and the private line, and covers machines nobody can install software on. Committed value roughly tripled in a year — and it puts Zscaler in the hardware-buying business.
In plain English
A shop floor, a hospital wing, a bank counter: each has traditionally kept its own stack of networking boxes plus a private line back to headquarters. Zscaler ships one appliance instead. It plugs in, sends everything to Zscaler's cloud to be checked, and also covers the equipment that cannot run security software — cameras, printers, factory machines.
The price follows sites and devices, not employees. The largest branch deal in the company's history landed last spring: an eight-figure expansion across 2,000 sites for a healthcare system, pushing out both a firewall vendor and a networking vendor.
Competes with FortiSASE / Secure SD-WAN (Fortinet) · Cato SASE Cloud (Cato Networks) · Prisma SD-WAN (Palo Alto Networks)
Zero Trust Cloud (Workload Communications)The same allow-or-deny checking applied to programs talking to programs, aimed at the rented firewalls companies run inside their cloud accounts. Roughly 4% of sales, and it leans on cloud providers that sell competing controls.The same allow-or-deny checking applied to programs talking to programs, aimed at the rented firewalls companies run inside their cloud accounts. Roughly 4% of sales, and it leans on cloud providers that sell competing controls.
In plain English
Most of the traffic inside a large company is not people at all — it is software talking to software, a payments service calling a database, one datacenter answering another. Those conversations normally pass through firewalls the company rents inside its cloud accounts. Zscaler offers to take that job over and apply the same rules it applies to employees.
It sells in tiers, and increasingly through the cloud providers themselves: Google Cloud added a managed version last quarter, alongside one that already ran on Amazon's cloud. The awkward part is that those same providers sell controls of their own.
Competes with VM-Series virtual firewalls (Palo Alto Networks) · Cloudflare One / Magic WAN (Cloudflare) · Built-in cloud network controls (Amazon Web Services)
Agentic SecOps (Red Canary + Data Fabric)Watching for break-ins on a customer's behalf, bought with Red Canary for $675 million and now wrapped in AI helpers that sift alarms. Red Canary alone added $144 million of FY2026 revenue and exited the year at $141 million of yearly subscriptions.Watching for break-ins on a customer's behalf, bought with Red Canary for $675 million and now wrapped in AI helpers that sift alarms. Red Canary alone added $144 million of FY2026 revenue and exited the year at $141 million of yearly subscriptions.
In plain English
Somewhere in every large company a team reads security alarms all night and works out which ones are real. Zscaler bought Red Canary, a firm that does that watching for customers as a service, and has now pointed AI helpers at the job: sort the alarms, chase the suspicious ones, cut off what is clearly bad.
The claimed edge is raw material. Because company traffic already runs through Zscaler, it holds hundreds of billions of records a day to search — which is also the catch: without that stream, the approach loses what makes it different.
Competes with Falcon platform and MDR (CrowdStrike) · Cortex XSIAM (Palo Alto Networks)
Zscaler Digital Experience (ZDX)Works out why an app feels slow, using traffic the company already carries. Its paid tiers passed $100 million of twelve-month orders in early 2026, up over 80% — yet it has dropped out of management's story.Works out why an app feels slow, using traffic the company already carries. Its paid tiers passed $100 million of twelve-month orders in early 2026, up over 80% — yet it has dropped out of management's story.
In plain English
When a video call stutters or a work app crawls, the help desk usually cannot say whose fault it is: the laptop, the home wi-fi, the internet provider or the app itself. Because employee traffic already travels through Zscaler, it can time each leg of the journey and point at the slow one.
The basic version is included in the main subscription and the useful upgrades cost extra, which is the design: give away the diagnosis, charge for the detail. Those upgrades crossed $100 million of orders over a twelve-month stretch as of early 2026. Still selling, no longer the headline.
Competes with ThousandEyes (Cisco) · Digital Experience Management (Netskope)
Named in filings, launches and programs
- Zero Trust BrowserProductZero-trust controls inside an ordinary web browser, from the SquareX purchase that closed February 2026; now named among the main offerings.
- Zscaler Data FabricPlatformThe plumbing that pulls collected security data into one consistent shape; came with the Avalor purchase and feeds the security-operations tools.
- Symmetry Systems Access GraphProduct · RampingA map of which people can reach which data, announced May 2026; it already added to new subscriptions in the final quarter of FY2026.
- Risk360ProductTurns a company's security posture into risk figures executives can read; sold as an attachment when accounts expand.
- Unified Vulnerability ManagementProductGathers weak-spot findings from many separate tools into one worklist, built on the data fabric.
- DeceptionProductPlants decoy files and servers as bait so an intruder gives themselves away; an add-on module.
- Privileged Remote AccessProductControlled access for administrators, contractors and engineers reaching factory equipment, in standard and advanced tiers.
- Device SegmentationProductStops cameras, printers and machines talking to anything they should not; from the Airgap purchase, sold under Zero Trust Branch.
- Autonomous App Segmentation / AppProtectionProductAdd-ons to the private-access product; one customer's upgrade across 120,000 users lifted its yearly spending nearly 50%.
- Sovereign Zero Trust on STACKITCustomer programZscaler running on the German cloud of Schwarz Digits, live across Europe since July 2026 for customers that need data kept locally.
- Carahsoft channel programCustomer programThe reseller that carries Zscaler to U.S. government buyers, expanded August 2026 to cover smaller and mid-sized companies entirely through partners.
- Zero Trust Exchange for agents & Endpoint AI SecurityProduct · AnnouncedShown at the June 2026 user conference and in early access; management expects them to scale in the second half of FY2027.
Zero Trust BrowserProduct
Zero-trust controls inside an ordinary web browser, from the SquareX purchase that closed February 2026; now named among the main offerings.
Zscaler Data FabricPlatform
The plumbing that pulls collected security data into one consistent shape; came with the Avalor purchase and feeds the security-operations tools.
Symmetry Systems Access GraphProduct · Ramping
A map of which people can reach which data, announced May 2026; it already added to new subscriptions in the final quarter of FY2026.
Risk360Product
Turns a company's security posture into risk figures executives can read; sold as an attachment when accounts expand.
Unified Vulnerability ManagementProduct
Gathers weak-spot findings from many separate tools into one worklist, built on the data fabric.
DeceptionProduct
Plants decoy files and servers as bait so an intruder gives themselves away; an add-on module.
Privileged Remote AccessProduct
Controlled access for administrators, contractors and engineers reaching factory equipment, in standard and advanced tiers.
Device SegmentationProduct
Stops cameras, printers and machines talking to anything they should not; from the Airgap purchase, sold under Zero Trust Branch.
Autonomous App Segmentation / AppProtectionProduct
Add-ons to the private-access product; one customer's upgrade across 120,000 users lifted its yearly spending nearly 50%.
Sovereign Zero Trust on STACKITCustomer program
Zscaler running on the German cloud of Schwarz Digits, live across Europe since July 2026 for customers that need data kept locally.
Carahsoft channel programCustomer program
The reseller that carries Zscaler to U.S. government buyers, expanded August 2026 to cover smaller and mid-sized companies entirely through partners.
Zero Trust Exchange for agents & Endpoint AI SecurityProduct · Announced
Shown at the June 2026 user conference and in early access; management expects them to scale in the second half of FY2027.