Arena: Market Conditions Before Zscaler
Security and network teams at large companies with many branches and mobile staff · 2008 · Global, mostly the United States and Europe
Changing technical requirementsHigh setup and upkeep costs
A large company in 2008 inspected employees' web traffic with proxy appliances such as Blue Coat's ProxySG and bought separate gateway boxes for jobs such as filtering email ZS26 ZS11; Websense and Secure Computing led the market ZS49. Branch offices sent internet traffic over leased lines to central data centers for inspection, and staff outside the office were covered only when connected back to the corporate network ZS1. A few hosted services, led by ScanSafe, routed customers' web traffic through their own proxies, but that market was young ZS49 ZS48. Every new user, site or security function meant more boxes to buy, size and patch, or more traffic hauled back to headquarters ZS1 ZS11.
How each step happened
Step 1 of 4 · 2008–13
The whole web gateway as one shared cloud, years before Netskope existed
Zscaler's founding bet concerned where the web security checkpoint sat. Jay Chaudhry had spent a decade selling firewalls and gateway appliances to enterprises, at SecureIT and then CipherTrust ZS8 ZS11. He set out to build 'not a blue coat type proxy' but the whole outbound gateway, so that a customer going to the internet 'shouldn't need to buy anything' ZS5. Zscaler launched in August 2008 as one multi-tenant service combining antivirus, URL filtering and data-leak controls, and said it was not 'taking existing web proxies, sticking them in a data center' ZS12. Zscaler ran and updated the service; customers paid a monthly fee per user instead of buying and sizing boxes ZS47.
The design fitted the companies whose users were most spread out. Checkpoints in about a hundred data centers meant each user reached the nearest one ZS6. Gartner's May 2012 review found large enterprises with many remote offices moving to cloud gateways to stop hauling traffic over private MPLS lines and to protect mobile workers, and named Zscaler the fastest-growing vendor with the largest footprint ZS43. By 2013 Zscaler had 4,000 enterprise customers ZS6.
Why the appliance vendors left the segment open
The appliance vendors answered with cloud services that sat beside their boxes. Cisco sold the hosted ScanSafe with its IronPort appliances from 2009, and Blue Coat's 2011 cloud service let customers 'protect their investments using on-premise appliances' ZS13 ZS14; Gartner found in 2014 that Cisco had been 'slow to integrate' the two ZS15. Selling the cloud as a replacement would have cut into the hardware that carried their revenue, so the fastest-growing segment went to Zscaler ZS43. The opening existed only against appliance companies, and it largely closed once the market moved to the cloud ZS33.
Rivals From 2008 to 2013 the real alternatives were Blue Coat and Websense appliances or Cisco's hybrid ScanSafe service ZS43 ZS15. Netskope was incorporated in October 2012 and launched in October 2013 with $21.4 million to show and control which of more than 3,000 SaaS apps employees used, not to replace the web gateway ZSB-8 ZSN-1.
Managed ServiceFounder Domain ExpertiseSubscription Pricing
Step 2 of 4 · 2009–18
Win the largest distributed companies through security chiefs and carriers
The sales motion was built alongside the product from the first year, so this step overlaps the first. Chaudhry first pitched the managers who ran firewalls and proxies, until one asked what he would do if he bought Zscaler; the service removed the equipment those managers ran ZS5. He moved to chief security officers, who could approve a network redesign, and needed only one in ten or twelve to say yes ZS5.
Partners did the network work. Carriers, system integrators and resellers supplied the tunnels, traffic forwarding and rollout, while Zscaler's sellers worked each account jointly with them ZS1 ZS2 ZS36; the top five partners carried 42% to 47% of revenue in fiscal 2016 to 2018 ZS2. Zscaler also paid customers to move, offering Websense and Blue Coat customers six months free in 2013 ZS16. By its February 2018 IPO filing it had over 2,800 customers, more than 200 of them in the Forbes Global 2000, and net retention of 122% ZS1.
Zscaler kept the gateway at the center. In 2016 it left CASB (cloud access security broker, tools that show and control employees' SaaS use) to partners such as Skyhigh ZSN-4, the job Netskope had entered through. The motion depended on scarce enterprise sellers: in 2019 sales-leadership turnover cut quarterly billings growth from 55% to 32%, and Zscaler hired Dali Rajic from AppDynamics to rebuild the process ZS30.
Rivals Netskope sold SaaS-app control that sat beside the web gateway ZSN-1. At its August 2025 IPO filing it had 4,317 customers but about 18% of the Forbes Global 2000 ZSB-8; Zscaler had passed 200 of those companies seven years earlier ZS1.
Top-Down SellingDistribution PartnershipsPenetration Pricing
Step 3 of 4 · 2016–20
The installed agent carries private access into the same accounts
Private Access was the second product, and it ran on the first. Launched in April 2016, it connected users to single internal applications without putting them on the corporate network, the job VPNs did ZS18. It used the same client agent and cloud as Internet Access, so an existing customer could switch it on without new hardware ZS36, which suited Zscaler's plan to sell existing customers more users and more suites ZS2.
In Zscaler's published case, Siemens spent ten months replacing firewalls and proxies with Internet Access, then moved remote access to Private Access and later enabled 320,000 remote users in under two weeks ZS22. In 2020 Chaudhry described a European conglomerate 'already using ZIA' that needed Private Access 'turned on by Monday morning' for more than 300,000 people. Private Access made up about 43% of new and add-on business that quarter, against about 20% before, and net retention was 119% ZS19. Companies without the agent bought more VPN capacity, which Chaudhry called 'tactical purchases' ZS19. The seats won in step 2 were where the second product sold fastest.
Rivals Netskope launched private access in June 2019 on its unified client and announced its own inline network, NewEdge, in July, aiming for 50 points of presence by the end of the year ZSN-3 ZSN-2. When remote work arrived in 2020, Zscaler's private-access product had been on installed agents for four years and Netskope's for less than one.
PlatformizationLand and Expand
Step 4 of 4 · 2020–26
The head start compounds into a larger base, contested as equals
By 2020 both sold the same kind of service; Zscaler's lead came from the years it had already spent inside the accounts. Gartner named it the only Leader in its December 2020 web gateway review ZSN-11. In fiscal 2026 Zscaler reported annual recurring revenue (ARR) of $3.8 billion, up 20% excluding the acquired Red Canary, with a 23% free cash flow margin; 785 customers paid more than $1 million a year ZSN-8 ZS20. Netskope's ARR was $899 million in August 2026, about a quarter of Zscaler's ZSN-7.
The two now compete as equals. Gartner has named both Leaders in security service edge, its category for web gateway, CASB and private access sold together, since its first report in 2022 ZSN-5. Netskope grows faster, 27% against 20%, with similar net retention, 114% against 115% ZSN-7 ZS20. Its gross margin rose five points in a year to 76%, against Zscaler's 80%, and it runs more than 120 data centers of its own ZSN-6 ZSN-8. Leaving Zscaler is also easier than its depth suggests: Cloudflare offered tools to export Zscaler policies and in 2023 reported three migrations that each took a week or less ZS45 ZS46.
Zscaler's answer has been breadth: Z-Flex contracts, which let customers swap modules without a new purchase process, reached $1.7 billion of contract value in fiscal 2026 ZS20. What it holds over Netskope is the base built in steps 1 to 3: the most spread-out multinationals, won years before Netskope launched, with private access switched on across them three years before Netskope offered it.
Acquisitions supplied part of that broader offer. Zscaler bought Avalor in March 2024 to combine enterprise security data for vulnerability analysis ZSMA-1. It also bought Airgap in April. Its fiscal 2025 annual report records purchase consideration of $256.7 million for Avalor and $124.4 million for Airgap and confirms that both technologies had been integrated into its cloud platform ZSMA-2.
Rivals Gartner's 2023 review flagged Netskope as among the most expensive options and noted pricing complaints about Zscaler as well ZSN-5. Netskope says it wins more than 80% of the deals that reach a proof of concept ZSN-6.
M&A Strategy