Platform profile
Zscaler SASE review: the Zero Trust Exchange as a SASE platform
Short answer
Zscaler states its SASE offer converges networking and security into one cloud platform built on a proxy architecture with full TLS/SSL inspection, and its AI security pages name MCP and A2A brokers. It scores 6.00 and ranks 5 of 6; a backbone, PoP count and certifications are not stated on the pages we read.
By The Transit Desk · Best SASE Platforms · Published
Desk research from each vendor's own public pages.
Score on our weights
Rank 5 of 6 on our published weights
What does Zscaler offer as a SASE platform?
Source: Zscaler SASE
| What is offered | Zero Trust Exchange: ZIA, ZPA, Zero Trust Branch and Zero Trust SD-WAN |
|---|---|
| Architecture, as the vendor describes it | Zscaler describes a "proxy architecture" that "enables full TLS/SSL inspection at scale", brokering one-to-one connections. Single-pass wording is not used on the pages we read. Source: Zscaler Zero Trust Exchange |
| Network, as the vendor states it | Zscaler positions direct-to-app connectivity without backhauling traffic through data centers or stacks of appliances. A private backbone and a data center or PoP count are not stated on the pages we read. Source: Zscaler SASE |
| Management and policy | Zscaler states a "unified, cloud native platform". A single console for networking and security is not described on the pages we read. Source: Zscaler SASE |
| Vulnerability response | Not published |
| Certifications listed | Not published |
| AI security | Zscaler states AI Access Security can "Allow, block, or coach access" and classify prompt content. Its AI security page lists discovery of "models, agents, MCP servers, shadow AI", AI red teaming, and an AI Gateway that can "Secure agentic communications through MCP and A2A brokers". Source: Zscaler AI security |
| Deployment options | Zscaler lists Zero Trust Branch, Zero Trust SD-WAN, Zero Trust Cloud and Zero Trust Browser, and access to private apps "without a VPN". Self-hosted or sovereign options are not described on the pages we read. Source: Zscaler SASE |
| Assistant in the console | Not published |
| Analyst placement, as the vendor states it | Zscaler's SASE page states it was "recognized as a Leader in the 2026 Gartner Magic Quadrant reports for SASE and SSE". Source: Zscaler SASE |
| Published pricing | Not published No SASE price list on the pages we read. Pricing is not scored. |
Which SASE components does Zscaler list?
- 1. SD-WAN: Listed
- 2. SWG: Listed
- 3. CASB: Not listed
- 4. ZTNA: Listed
- 5. FWaaS: Listed
- 6. DLP: Listed
- 7. RBI: Not listed
- 8. DEM: Listed
- SD-WAN (Software-defined WAN): Listed. Zero Trust SD-WAN.
Source: Zscaler SASE
- SWG (Secure web gateway): Listed. Secure Internet Access (ZIA).
Source: Zscaler SASE
- CASB (Cloud access security broker): Not listed
- ZTNA (Zero trust network access): Listed. Secure Private Access (ZPA).
Source: Zscaler SASE
- FWaaS (Firewall as a service): Listed. FWaaS.
Source: Zscaler SASE
- DLP (Data loss prevention): Listed. Inline DLP in the AI Gateway.
Source: Zscaler AI security
- RBI (Remote browser isolation): Not listed Zero Trust Browser is listed in navigation; remote browser isolation is not described on the pages we read.
Source: Zscaler SASE
- DEM (Digital experience monitoring): Listed. ZDX digital experience.
Source: Zscaler SASE
What figures does Zscaler publish about itself?
Zscaler's own figure, describing the signals its policy decisions use.
How does Zscaler score on each criterion?
| Criterion | Weight | Score | Why |
|---|---|---|---|
| Converged architecture | 20% | 7 / 10 | States it converges networking and security into one cloud platform with a proxy architecture; single-pass is not stated. Source: Zscaler SASE |
| Global network, as the vendor states it | 15% | 5 / 10 | Describes direct-to-app connectivity; no private backbone or PoP count on the pages read. Source: Zscaler SASE |
| Component coverage | 10% | 7 / 10 | Lists six of the eight: CASB and remote browser isolation are not named on the pages read. Source: Zscaler SASE |
| Unified management and policy | 10% | 6 / 10 Lowest in set | States a unified platform; a single console is not described on the pages read. Source: Zscaler SASE |
| Vulnerability response transparency | 10% | 3 / 10 Tied lowest | No vulnerability response record is published on the pages read. Source: Zscaler Zero Trust Exchange |
| Published compliance certifications | 10% | 3 / 10 Lowest in set | No certifications are stated on the pages read. Source: Zscaler SASE |
| AI security inside the platform | 15% | 9 / 10 Tied highest | AI asset discovery including MCP servers, prompt classification, AI red teaming and an AI Gateway with MCP and A2A brokers. Source: Zscaler AI security |
| Deployment options | 10% | 6 / 10 Tied lowest | Lists branch, cloud, SD-WAN and browser options and VPN-free private access; self-hosted or sovereign options are not described. Source: Zscaler SASE |
Where does Zscaler score well, and where does it score lower?
Scores well
Highest or tied highest in set on: AI security inside the platform.
- AI security that names MCP and A2A brokers, AI asset discovery and AI red teaming.
- States full TLS/SSL inspection through its proxy architecture.
- Branch, cloud and SD-WAN offerings under one zero trust model.
Scores lower
Another platform scores higher on: converged architecture, global network, as the vendor states it, component coverage, unified management and policy, vulnerability response transparency, published compliance certifications and deployment options.
- A private backbone and a PoP or data center count are not stated on the pages we read.
- Compliance certifications, including FedRAMP, are not stated on the pages we read.
- CASB and remote browser isolation are not named on the SASE page we read, and no CVE response record is published there.
How does Zscaler compare head to head?
- Cato Networks vs ZscalerCato Networks 8.70, Zscaler 6.00
- Cisco vs ZscalerCisco 5.30, Zscaler 6.00
- Fortinet vs ZscalerFortinet 7.10, Zscaler 6.00
- Netskope vs ZscalerNetskope 8.00, Zscaler 6.00
- Palo Alto Networks vs ZscalerPalo Alto Networks 7.05, Zscaler 6.00
Bottom line
Zscaler's AI security pages name MCP and A2A brokers, AI asset discovery and AI red teaming. Network, compliance and response transparency are thin on the pages we read, which holds its total down on a question about one converged service. It ranks 5 of 6 on our weights, at 6.00.
Best for: Organizations replacing VPNs and appliance firewalls with proxy-based zero trust access and AI controls.
Further reading: Uptime, threats and signals: how to read SASE vendor numbers, SASE roundup: dated announcements on the six vendors' pages
Frequently asked questions
Does Zscaler list FedRAMP?
FedRAMP is not listed on the pages we read.
Does Zscaler describe controls for AI agents and MCP?
Yes. Zscaler states AI Access Security can "Allow, block, or coach access" and classify prompt content. Its AI security page lists discovery of "models, agents, MCP servers, shadow AI", AI red teaming, and an AI Gateway that can "Secure agentic communications through MCP and A2A brokers".
How many SASE components does Zscaler list?
6 of the eight we track: SD-WAN, SWG, ZTNA, FWaaS, DLP and DEM. Not listed on the pages we read: CASB and RBI.