Zscaler, Inc. (trading and profile display name: Zscaler) SASE and SD-WAN profile

Summary

Commercial reality | No public pricing; multiple independent third-party analyses converge reasonably well on per-user ranges (roughly $140-390/user/year combined ZIA+ZPA depending on tier) and describe a real risk of 30-100% cost escalation from common add-ons - directionally useful for budget conversations but not authoritative. | Table 16 | Medium (convergent third-party sourcing - stronger than a single anecdote, still not primary-sourced) | Use as a rough planning signal with buyers, always routing to a direct Zscaler quote for real numbers, exactly as advised for Cato's equivalent finding.

Use as a rough planning signal with buyers, always routing to a direct Zscaler quote for real numbers, exactly as advised for Cato's equivalent finding.

Summary

Reporting reality | Strong specifically around ZDX (network/application/user experience, AI-assisted root-cause diagnostics); weaker or unconfirmed on executive dashboards, compliance reporting, and scheduled/custom reporting, which weren't found in sources reviewed. | Table 10 | Medium | Present the ZDX strength specifically rather than imply comprehensive reporting maturity across the board - same approach used for Cato's equivalent finding.

Present the ZDX strength specifically rather than imply comprehensive reporting maturity across the board - same approach used for Cato's equivalent finding.

Summary

Security & Analytics | FedRAMP High + DoD IL5 authorisation, a Data Fabric for Security pulling from 150+ third-party sources, and deep native AI processing trillions of daily signals behind detection, remediation and digital-experience diagnostics. | ZIA and ZPA started life as related-but-separate products and still carry some of that history in licensing and console structure; higher-value DLP, analytics and AI capability is frequently gated behind Transformation/Unlimited tiers rather than the entry tier.

Summary

Large enterprise | Strong fit | NOV (27,500 users), AutoNation (large multi-site retailer) demonstrate enterprise-scale deployment | Requires internal or partner-supported operational ownership at scale | Enterprise-tier (Transformation/Unlimited) pricing likely, with meaningful cost escalation from add-ons per multiple independent third-party analyses | Well evidenced at the large end, comparable in evidence quality to Cato's Ulta Beauty story, via NOV specifically.

Summary

Firewall consolidation | Evidenced via AutoNation: 'full packet inspection firewall' replaced prior approach, eliminating unwanted P2P traffic | Existing firewall rules translated into ZIA policy | IT/security team | Not itemised | Not quantified | Policy translation errors during cutover (not specifically addressed in the source) | Not detailed | Real-world evidence exists via a named customer, though process detail (e.g. rule-migration tooling) wasn't found - same caveat applied to Cato's equivalent row.

Summary

SME | Conditional fit | Entry-level AWS Marketplace editions exist (e.g. a 50-user Business edition), but overall commercial evidence points toward mid-market/enterprise economics and per-user tier structures that reward scale | Minimal internal skills needed for the security core; branch/SD-WAN less proven at small scale | Smaller AWS Marketplace-listed editions give SMEs a concrete entry point, though pricing still climbs quickly with add-ons per third-party analysis | SMEs have a clearer self-serve entry point via Marketplace editions than was found for Cato, though the same tier-escalation caution applies once add-ons are needed.

Summary

Deployment & Ops | Massive global footprint (160+ data centres on six continents) with documented, tiered support SLAs (P1 response as fast as 15 minutes on premium tiers) and a mature Zero Trust Branch reference architecture that's largely plug-and-play hardware. | No owned private backbone - traffic relies on internet peering and cloud interconnects rather than a dedicated, SLA-backed middle mile, so performance is more exposed to public internet variability than backbone-based competitors like Cato.

Summary

When would Netify recommend looking elsewhere? (mandatory) | When a buyer specifically wants a private, SLA-backed backbone as the architectural core of their SASE deployment; when a buyer needs a large, already-proven branch/retail rollout track record at Ulta-Beauty-like scale; when a buyer needs pre-verified PCI-DSS, HIPAA, or UK/EU regulated-sector compliance out of the box; or when a buyer wants a single converged console replacing their existing security stack rather than a best-of-breed addition to it. | Synthesis of Tables 4, 7, 13, 15, 17 | Medium-High | Each trigger is tied to a specific, evidenced gap rather than a generic 'consider alternatives' hedge.

Each trigger is tied to a specific, evidenced gap rather than a generic 'consider alternatives' hedge.

Summary

Global multinational | Good fit, with coverage caveats | 160+ data centres, present in most countries, active regional expansion (e.g. Saudi Arabia) | Needs Netify/buyer to verify specific-country data-centre coverage, since named-country detail is thin outside North America, Europe and the Middle East (see Table 7) | Custom enterprise pricing | Table 7 findings | The architecture supports multinational buyers well, but - same caution as for Cato - don't assume complete country-level coverage without checking Zscaler's own current data-centre map.

Summary

Lean IT team | Good fit | Cloud-delivered, SaaS-model platform reduces on-prem hardware/patch burden; case studies (UST, Mindbody) describe reduced operational overhead | None significant for the security core; branch/SD-WAN operational maturity less proven | Support-tier upgrades (Premium, Premium Advanced) available to further reduce internal burden | Well evidenced for the security/access side; less proven for branch operations specifically, consistent with the pattern seen throughout this profile.

Summary

Commercials | Concrete, vendor-published price anchors exist via AWS Marketplace listings, giving buyers something real to plan a budget against even without a public list price. | No public list pricing; multiple independent third-party analyses describe steep step-ups between Business, Transformation and Unlimited tiers, and warn that ZDX, workload licensing and Data Protection add-ons can each add 30-100% to a baseline ZIA+ZPA quote.

Summary

Support/service reality | A credible, unusually well-documented tiered support structure (Standard through Premium Support Advanced Plus) with specific, contractual SLA figures (P1 response as fast as 15 minutes; MDR 10-minute notification) sourced directly from Zscaler's own data sheets. | Table 8 | High | One of the better-evidenced operational areas in this whole profile - genuinely strong primary-source material.

One of the better-evidenced operational areas in this whole profile - genuinely strong primary-source material.

Summary

Sector fit | US federal/public sector is by a wide margin the best-evidenced sector; retail and energy have credible single case studies; healthcare, financial services, education, hospitality, transport and manufacturing all lack the same depth of evidence found for the public-sector claim. | Table 14 | High for public sector; Medium for retail/energy; Low for other sectors | Do not extend the strong public-sector evidence into an assumption of equally strong healthcare/financial-services fit - those need separate verification.

Do not extend the strong public-sector evidence into an assumption of equally strong healthcare/financial-services fit - those need separate verification.

Summary

Regulated organisation | Strong fit for US federal/public sector specifically; conditional for other regulated sectors | FedRAMP High/Moderate, DoD IL5, GovRAMP, CJIS, CMMC Level 2 all confirmed for US government; PCI-DSS, HIPAA attestation, and UK/EU frameworks (NHS DSPT, DORA, NIS2) not confirmed | Buyer must independently verify sector-specific compliance status directly with Zscaler for anything outside US federal/public sector | Not assessed | Table 13 findings | A genuinely bifurcated picture: exceptionally strong for US federal/public sector, materially less evidenced for UK/EU-regulated sectors and for PCI-DSS/HIPAA specifically - don't let the federal strength imply blanket regulated-sector coverage.

Summary

What implementation challenges should buyers expect? (mandatory) | Expect a genuine need to map tier-to-feature detail carefully before committing, since advanced DLP, browser isolation and privileged access all appear to be gated to Transformation/Unlimited tiers rather than universally included. Expect total cost to grow meaningfully once ZDX, workload licensing and Data Protection add-ons are factored in - multiple independent analyses describe 30-100% uplifts from these. Branch-heavy buyers should expect to pilot Zero Trust Branch carefully given the thinner independent evidence base relative to the core security stack. | Tables 3, 5, 16, 17 | Medium-High | Each expectation is traceable to a specific finding elsewhere in this profile, not a generic caution.

Each expectation is traceable to a specific finding elsewhere in this profile, not a generic caution.

Summary

Scope & Boundaries | Very mature, long-standing SSE feature depth - Zscaler has been named a Gartner Secure Web Gateway Leader ten times running - spanning SWG, inline and API CASB, DLP, ZTNA and browser isolation. | Zscaler is fundamentally a security company that added branch/SD-WAN later (Zero Trust Branch, Zscaler Cellular), the reverse emphasis of a networking-first vendor - branch-heavy buyers should weigh that history against vendors built backbone-first from day one.

Summary

Procurement watch-out | Several compliance claims relevant to UK/EU buyers specifically (Cyber Essentials Plus, NHS DSPT, NIS2, DORA) were found via only a single, uncorroborated third-party review, or not found at all | UK/EU regulated-sector buyers cannot currently get a fully evidenced compliance answer from public sources alone and must request direct confirmation | Most relevant to Netify's UK healthcare, financial-services, and public-sector audiences specifically | Table 13 findings | Medium | A direct, practical follow-up item - mirrors the equivalent gap flagged for Cato, and equally important to close before this profile supports a high-stakes UK regulated-sector recommendation.

UK/EU regulated-sector buyers cannot currently get a fully evidenced compliance answer from public sources alone and must request direct confirmation

Summary

Deployment reality | Fast and well-evidenced on the security/remote-access side (Mindbody's 'five times faster than VPN' claim, NOV's rapid pandemic-era scale-up); genuinely less proven on the branch/SD-WAN side given the absence of a large-scale rollout case study. | Table 9, 17, 18 | Medium-High | Set expectations differently for the security core versus the branch/networking side - they're not equally mature.

Set expectations differently for the security core versus the branch/networking side - they're not equally mature.

Summary

MPLS to SD-WAN migration | Evidenced via Baker & Baker: MPLS contract expiry triggered adoption of SD-WAN alongside ZIA for internet/SaaS security | Existing MPLS circuits retired at contract end rather than coexisting mid-transition (in contrast to Cato's explicit coexistence capability) | IT team, per case study | Not itemised | Not quantified | Less gradual than Cato's documented MPLS-coexistence model - potentially a harder cutover point | Not detailed in sources reviewed | A real migration scenario is evidenced, but the mechanism (contract-expiry-triggered switch) is less flexible than a purpose-built coexistence feature - a fair, specific point of comparison.

Summary

Questions Netify still cannot verify | PCI-DSS and HIPAA attestation status; UK Cyber Essentials Plus and NHS DSPT/NIS2/DORA relevance; exact tier-to-feature mapping for DLP, browser isolation and privileged access; Zero Trust Branch hardware charging model; a large-scale, metric-rich branch rollout case study; and whether any Zscaler-delivered (as opposed to partner-delivered) fully-managed service exists. | Synthesis of Tables 4, 6, 13, 16 | N/A - explicitly unresolved | This list should drive the next follow-up (a direct Zscaler briefing or partner conversation) before this profile is considered fully closed out, in exactly the same spirit as the equivalent list in the Cato profile.

This list should drive the next follow-up (a direct Zscaler briefing or partner conversation) before this profile is considered fully closed out, in exactly the same spirit as the equivalent list in the Cato profile.

Summary

Cloud-first organisation | Good fit | Multi-cloud on-ramps (AWS, Azure, GCP) evidenced via Baker & Baker (Azure) specifically | None significant identified | Not itemised | Solid, evidenced by a real production deployment rather than platform-page claims alone.

Summary

Merger/acquisition integration | Referenced via the Zscaler-on-Zscaler case study describing the SPLX acquisition, where ZIA and DLP policies were deployed within five days of deal close | Not itemised beyond the five-day timeframe | Not itemised | Zscaler's own internal security team ('customer zero') | Five days from deal close to ZIA + DLP policy deployment (specific, dated) | Not itemised | Not detailed | A genuinely specific, dated, quantified M&A integration example - better evidence than Cato's equivalent row, which relied on general marketing-page positioning rather than a named scenario.

Summary

Biggest operational concern | Tier-to-feature opacity combined with documented add-on cost escalation creates real risk of buyers under-scoping their initial quote and facing a larger-than-expected bill once DLP, browser isolation, ZDX or workload licensing are actually needed. | Table 16, 19 | Medium | Netify should proactively flag this to buyers during the shortlist conversation rather than let it surface as a surprise at renewal.

Netify should proactively flag this to buyers during the shortlist conversation rather than let it surface as a surprise at renewal.

Summary

Highly distributed branch estate | Conditional fit | Zero Trust Branch exists and is architecturally sound, but lacks an equivalent to Cato's large-scale, metric-rich branch-rollout proof point (e.g. Ulta Beauty) | Zero-touch provisioning documented at the mechanism level, not proven at large operational scale in the evidence found | Site-based licensing implications not itemised | help.zscaler.com Zero Trust Branch reference architecture | This is the clearest area where Cato currently has a stronger evidence base than Zscaler - a fair, specific point to make to a branch-heavy buyer rather than assuming parity.

Summary

Compliance & Footprint | Exceptionally well-documented US federal and public-sector credentials - FedRAMP High/Moderate, GovRAMP, CJIS, CMMC Level 2 - alongside broad ISO 27001/27017/27018/27701 and SOC 2 Type II coverage. | UK- and region-specific certifications (Cyber Essentials Plus, NHS DSPT relevance) were found via only a single third-party review in this pass and are not independently confirmed on Zscaler's own compliance pages - don't assume coverage without asking directly.

Summary

Limitation | SD-WAN/branch capability (Zero Trust Branch) is real but has materially thinner independent evidence than the core security stack - no large-scale, metric-rich branch-rollout case study equivalent to Cato's Ulta Beauty story was found | Branch-heavy buyers should not assume the same maturity/proof-point depth on the networking side as on the security side | Affects highly distributed branch/retail buyers most | Table 4, 15, 17 findings | Medium-High | A fair, specific, well-evidenced gap rather than a vague impression - worth stating to buyers directly rather than softening.

Branch-heavy buyers should not assume the same maturity/proof-point depth on the networking side as on the security side

Summary

Global branch rollout | Zero Trust Branch reference architecture describes plug-and-play hardware install, but no large-scale, metric-rich branch rollout case study (comparable to Cato's Ulta Beauty story) was found in this pass | Existing branch network/Wi-Fi infrastructure to integrate or replace | Not itemised | Not itemised | Not quantified | Unproven at Cato-Ulta-Beauty-scale in the evidence available | Not detailed | The clearest, most specific gap in Zscaler's evidence base relative to Cato - worth being direct about this with buyers who need branch-rollout proof points specifically.

Summary

VPN to ZTNA migration | Evidenced via Baker & Baker and Mindbody: both explicitly describe eliminating VPNs in favour of ZPA | Existing VPN concentrator/client footprint retired | IT team | Not itemised | Mindbody: 'ZPA deploys five times more quickly than traditional VPN solutions' (customer quote) | Not itemised | Not detailed | This is Zscaler's best-evidenced migration scenario by a clear margin - two independent named customers specifically describing VPN elimination, with a concrete relative-speed claim from one of them.

Summary

Multi-vendor SASE integration | Well evidenced, in a different direction than Cato - Zscaler's strongest partner alliances (Okta, CrowdStrike) are explicitly built around being one best-of-breed component in a multi-vendor security architecture, not a single converged replacement for it | IdP and EDR already in place | Not itemised | Formal joint deployment guides and a hands-on integration lab | Not quantified | N/A | N/A | Worth stating plainly in the Netify View: Zscaler is, by design and by its strongest evidenced partnerships, genuinely well-suited to buyers wanting a best-of-breed multi-vendor stack - the reverse of Cato's positioning on this exact scenario.

Summary

Where does it fall behind competitors? (mandatory) | No owned private backbone, which is a genuine architectural gap against backbone-first SASE vendors like Cato for buyers prioritising predictable site-to-site WAN performance; SD-WAN/branch maturity and proof points are materially thinner than the security stack; and PCI-DSS/HIPAA attestations, which some competitors publish explicitly, were not found for Zscaler in this pass. | Tables 4, 7, 13, 15, 17 | Medium-High | Named specifically and evidenced, not a generic hedge - Netify can state these gaps with real confidence.

Named specifically and evidenced, not a generic hedge - Netify can state these gaps with real confidence.

Summary

Strength | Unmatched US federal/public-sector compliance depth - FedRAMP High, DoD IL5, GovRAMP, CJIS, CMMC Level 2, serving 14 of 15 US Cabinet-level agencies | Removes a major procurement blocker for US federal and regulated public-sector buyers that most SASE/SSE competitors can't clear | Best: US federal/state/local government. Less relevant: buyers with no US federal/government exposure | High | This is Zscaler's single clearest, most defensible differentiator in the entire profile.

Removes a major procurement blocker for US federal and regulated public-sector buyers that most SASE/SSE competitors can't clear

Summary

Limitation | No owned private backbone - the architecture relies on internet peering and cloud interconnects rather than an SLA-backed middle mile | Buyers wanting Cato-style predictable, backbone-based performance across a distributed estate should weigh this architectural difference directly, not assume parity | Affects distributed multi-site buyers most; less relevant to buyers whose primary need is internet/SaaS security rather than site-to-site WAN performance | Table 7 findings | High | The single most consequential architectural fact in this whole profile - should be stated plainly and early to any buyer comparing Zscaler against a backbone-first vendor.

Buyers wanting Cato-style predictable, backbone-based performance across a distributed estate should weigh this architectural difference directly, not assume parity

Summary

Questions to ask before recommending it | 1) Which Table 3 capabilities (advanced DLP, browser isolation, privileged remote access) are actually included at the buyer's target tier, versus requiring Transformation or Unlimited? 2) What would ZDX, workload licensing, and Data Protection add-ons realistically add to the buyer's total cost at their expected scale? 3) Can Zscaler confirm PCI-DSS, HIPAA, Cyber Essentials Plus, and NHS DSPT-relevant status directly, given none were independently confirmed in this pass? 4) For branch-heavy buyers specifically, can Zscaler provide a large-scale reference deployment comparable in evidence depth to what competitors can show? | Synthesis of Tables 3, 5, 13, 16, 17 | High | A direct, reusable question set for Netify's advisory conversations with buyers considering Zscaler.

A direct, reusable question set for Netify's advisory conversations with buyers considering Zscaler.

Summary

Mid-market | Good fit | Sweet spot implied by several case studies (Mindbody, UST) describing mid-sized, distributed organisations | Low - case studies show non-specialist IT teams managing rollouts successfully | Business-tier pricing likely applies; volume discounts documented above 1,000 users per third-party analysis (a reported 34-35% discount threshold) | Reasonably well evidenced by multiple mid-sized case studies.

Summary

Biggest operational advantage | Demonstrated ability to support a rapid, large-scale shift to secure remote access under real-world pressure, evidenced concretely via NOV's 27,500-user COVID-19-era pivot rather than just claimed in the abstract. | Table 15, 17, 18 | High | Directly quotable with the specific NOV figures for credibility.

Directly quotable with the specific NOV figures for credibility.

Summary

Procurement watch-out | PCI-DSS and HIPAA attestations, both explicitly confirmed for Cato in that profile, were not found for Zscaler in this research pass despite healthcare being listed as a served industry | Payment-handling and healthcare buyers should not assume compliance parity with competitors that do explicitly publish these attestations | Most relevant to retail/payments and healthcare buyers specifically | Table 13 findings | Medium | A specific, comparative finding worth surfacing directly - this is exactly the kind of vendor-to-vendor compliance gap Netify's comparison tool exists to catch.

Payment-handling and healthcare buyers should not assume compliance parity with competitors that do explicitly publish these attestations

Summary

When would Netify recommend it? (mandatory) | When a buyer needs FedRAMP High/DoD IL5-level government assurance; when a buyer's primary pain point is legacy VPN/firewall-appliance elimination and internet/SaaS/private-app security specifically; or when a buyer wants to add best-of-breed SSE into an existing security stack (particularly one already built around Okta and/or CrowdStrike, given the depth of that specific alliance). | Synthesis of Tables 12, 13, 15, 17 | High | A clear, actionable recommendation trigger set for Netify's comparison tool to apply directly.

A clear, actionable recommendation trigger set for Netify's comparison tool to apply directly.

Summary

Limitation | Commercial opacity plus documented tier-escalation risk - no public pricing, and multiple independent third-party analyses describe steep step-ups between Business/Transformation/Unlimited tiers with 30-100% cost increases from common add-ons (ZDX, workload licensing, Data Protection) | Buyers risk under-budgeting if they scope only the entry tier without accounting for the add-ons they'll likely need | Affects all buyer sizes, though the absolute cost impact is largest for large enterprises with big user/workload counts | Table 16 findings | Medium (convergent across multiple independent third-party sources) | The convergence across several independent pricing analyses makes this a reasonably confident finding despite the lack of primary-source pricing - Netify should flag the tier-escalation risk proactively rather than waiting for a buyer to discover it at quoting.

Buyers risk under-budgeting if they scope only the entry tier without accounting for the add-ons they'll likely need

Summary

Mature NetOps/SecOps team | Good fit, with a caveat | Deep, formally documented integrations (Okta, CrowdStrike) support a mature best-of-breed toolchain approach | Mature teams may find the still-separate ZIA/ZPA console history less unified than a platform designed as one product from day one | Not assessed | Table 12 findings | Worth noting candidly: Zscaler's strength is genuinely deep point-integration into an existing security stack (Okta/CrowdStrike alliance) rather than replacing that stack with a single converged console the way Cato pitches itself.

Summary

Strength | Genuinely mature, long-standing SSE stack (10x Gartner SWG MQ Leader) with a well-evidenced VPN-elimination migration story | Buyers retiring legacy VPN/proxy infrastructure get a proven, widely-adopted replacement path | Best: security-first enterprises with a VPN/firewall-appliance-heavy legacy estate. Less relevant: buyers without significant legacy VPN debt | High | Two independently named customers specifically describing VPN elimination is good, concrete evidence.

Buyers retiring legacy VPN/proxy infrastructure get a proven, widely-adopted replacement path

Summary

AI reality | A genuinely evidenced, actively-developing set of specific AI functions (Data Fabric threat correlation, ZDX AI diagnostics, agentic-AI guardrails) sits inside broader 'AI-driven' marketing language that extends further than what's independently confirmed for every claimed function. | Table 11 | Medium-High | Represent the narrower, evidenced AI feature set in buyer-facing content rather than the full marketing scope - consistent with the standard applied throughout this profile.

Represent the narrower, evidenced AI feature set in buyer-facing content rather than the full marketing scope - consistent with the standard applied throughout this profile.

Summary

Co-managed transition | Not documented as a distinct migration scenario in sources reviewed | Not itemised | Not itemised | Not itemised | Not quantified | Not itemised | Not detailed | Evidence gap - consistent with the broader finding that Zscaler doesn't appear to have a named co-managed service model (see Table 6).

Summary

Strength | Specific, current, well-evidenced AI investment - Data Fabric for Security, ZDX AI diagnostics, and a June 2026 agentic-AI security launch with 11 named Technology Alliance Partners | Buyers with active or planned agentic-AI/GenAI initiatives get security controls that are demonstrably being actively developed, not just marketed | Best: organisations rolling out GenAI/agentic AI tools who need governance controls now. Less relevant: buyers with no near-term AI-security need | Medium-High | One of the more concretely dated, named AI announcements found across this entire research pass - a genuine signal of active investment, not just AI-washing.

Buyers with active or planned agentic-AI/GenAI initiatives get security controls that are demonstrably being actively developed, not just marketed

Summary

Remote-user-heavy organisation | Strong fit, Zscaler's core strength | Client Connector, clientless access, ZDX all mature; NOV's 27,500-user remote pivot during COVID-19 is a strong, dated proof point | Requires ZDX licence for full experience visibility | User licensing is Zscaler's primary commercial model | Arguably Zscaler's single best-evidenced suitability claim in the whole profile - this is the core use case the platform was built for.

Summary

Most credible differentiator | The combination of FedRAMP High/DoD IL5 authorisation with a decade-plus-mature, independently-validated SSE stack - very few competitors clear the compliance bar and have the platform maturity to match it simultaneously. | Tables 3, 13 | High | This is the single sentence Netify's comparison engine could most confidently quote for Zscaler specifically.

This is the single sentence Netify's comparison engine could most confidently quote for Zscaler specifically.

Summary

Where does it stand out? (mandatory) | FedRAMP High/DoD IL5 government authorisation that very few SASE-class competitors clear; a decade-plus-mature SSE stack (10x Gartner SWG Leader) with well-evidenced VPN-elimination case studies; and a specific, actively-dated AI security investment (agentic AI guardrails launched June 2026 with 11 named partners). | Tables 3, 11, 13, 19 | High | These are the claims Netify can make most confidently and specifically to buyers, each backed by named, dated evidence rather than generic marketing language.

These are the claims Netify can make most confidently and specifically to buyers, each backed by named, dated evidence rather than generic marketing language.

Summary

Global fit | Architecturally global by design (160+ data centres, six continents), with genuinely better-evidenced Middle East coverage than Cato's profile showed, but named-country detail is thin outside North America, Europe and the Middle East. | Table 7 | Medium-High | Always verify buyer-specific country coverage directly rather than relying on the general 'most countries' claim.

Always verify buyer-specific country coverage directly rather than relying on the general 'most countries' claim.

Summary

Who is this genuinely best suited for? (mandatory) | Large enterprises and US federal/public-sector agencies wanting to retire legacy VPN and perimeter-firewall infrastructure and consolidate SWG, CASB, DLP and ZTNA under one security-first console - particularly where FedRAMP High or DoD IL5 authorisation is a hard requirement, and particularly for organisations whose primary need is securing internet/SaaS/private-app access rather than building out branch WAN infrastructure. | Tables 1, 13, 14, 15 (FedRAMP depth, remote-access maturity, case study evidence) | High | Buyers matching this profile can proceed with real confidence in the core security claims; buyers whose primary need is branch/SD-WAN maturity should weigh Table 4's evidence gaps carefully.

Buyers matching this profile can proceed with real confidence in the core security claims; buyers whose primary need is branch/SD-WAN maturity should weigh Table 4's evidence gaps carefully.

Summary

Overall Netify Assessment | Zscaler is the most credible, deeply-evidenced choice in this comparison set for buyers whose primary need is mature, government-grade SSE - the FedRAMP High/DoD IL5 authorisation and decade-plus-proven security stack are genuinely differentiated and well-documented. Its clearest weak points relative to a backbone-first competitor like Cato are the absence of an owned private backbone and a materially thinner evidence base for large-scale branch/SD-WAN deployment. Commercial opacity and tier-gating risk are real but at least directionally corroborated by multiple independent analyses, which is a stronger evidentiary position than a single anecdote would give. This profile is solid enough to support initial shortlist guidance for security-first and US public-sector buyers specifically, but the flagged UK/EU compliance gaps and branch-evidence gap should be closed out with Zscaler directly before use in a high-stakes procurement decision. | Whole profile | Medium-High overall | Recommend direct Zscaler engagement to close the flagged evidence gaps, mirroring the same next step recommended for the Cato profile.

Recommend direct Zscaler engagement to close the flagged evidence gaps, mirroring the same next step recommended for the Cato profile.

Summary

SSE deployment to remote users | Client Connector or clientless rollout to remote/mobile users; NOV's COVID-19-driven scale-up to 27,500 remote users is the standout evidence point | IdP integration (Okta) generally a prerequisite for user-aware policy | End-user self-install typical | Not itemised | NOV: leadership described being able to commit to supporting all 27,500 users working remotely on short notice | Not itemised | Not detailed | Genuinely strong, large-scale, real-world evidence - arguably stronger than the equivalent Cato row, since NOV's story includes both scale (27,500 users) and a clear time-pressure context (pandemic onset).