ZIA and ZPA meet federal security requirements
Zscaler Internet Access (ZIA) holds the only FedRAMP High JAB authorization for a SASE TIC 3.0 solution. This certification allows ZIA and Zscaler Private Access (ZPA) to protect sensitive unclassified data for civilian agencies and the Department of War. The certification confirms that ZIA can securely connect government users to external applications, including SaaS applications and internet destinations, regardless of device, location, or network. Many of the 100 federal customers already using Zscaler at the Moderate level use these tools to meet Executive Order 14028 zero trust goals. These tools help agencies mitigate risks from users who bypass VPNs. They also reduce network usage costs from backhauling internet traffic through the government’s TIC. The platform establishes trust through user identity and context including location, device, and application. The Zscaler Zero Trust Exchange processes more than 240 billion daily transactions and stops over seven billion threats and policy violations per day for the largest, most demanding organizations around the globe. While the platform provides deep inspection, users sometimes find the policy configuration and navigation complex for new staff. The platform supports IT federal mission transformation by reducing costs and preventing lateral movement of threats.
Platform bundles and seat-based pricing
Zscaler sells its services through per-user platform bundles including the Essentials Platform, Zscaler Platform, and Zscaler Advanced Platform. The Essentials Platform requires a minimum of 500 subscribed users and includes ZPA for 1 user per 20 subscribed users. The Zscaler Platform provides ZPA for all users and includes 2 GB of monthly workload traffic per subscribed user. Zscaler Advanced Platform adds ZDX Advanced alongside existing modules. Enterprise buyers negotiate below the published ceilings found on the AWS Marketplace or the UK G-Cloud 15 framework. On AWS Marketplace, the Zscaler Zero Trust Platform for 50 users costs $20,000 per 12 months, while the Zscaler for Users Transformation Edition for 500 users costs $312,000 per 12 months. You should note that the discount for a 36 month contract reaches 17% but the concession disappears when the term ends.
| Module/Feature | Essentials Platform | Zscaler Platform | Advanced Platform |
|---|---|---|---|
| ZPA Coverage | 1 user per 20 users | All users | All users |
| Workload Traffic | 1 GB per user | 2 GB per user | 2 GB per user |
| ZDX Version | ZDX Standard | ZDX Standard | ZDX Advanced |
| Minimum Users | 500 | Not specified | Not specified |
ZDX is licensed by seats. It counts unique users over the previous rolling 90 days. ZDX modules vary by capability. ZDX Standard includes 3 poll intervals and 2 days of data retention. ZDX Advanced provides 15 poll intervals and 14 days of data retention. For higher needs, ZDX Advanced Plus includes 50 poll intervals and 14 days of data retention. The Sandbox API allows 3,000 files per month per customer, and Deception Advanced provides 300 customizable decoys. ZPA for legacy apps includes up to 3 VPN Service Edges for 500 users or more. Cyber Browser Isolation Advanced allows 1.5 GB of isolation traffic per user per month, while the Standard version allows 100 MB per user. Customers can buy ZDX Advanced for a subset of users on top of a bundle that includes ZDX Standard for everyone.
Market competition and user experience
Zscaler remains a top choice for large enterprises despite higher costs compared to simpler providers. Cloudflare publishes a rate of $7 per user per month, which compares to $120 per user per year for the Zscaler Essential Platform on the UK G-Cloud 15. Zscaler provides deep inline inspection that exceeds DNS-layer security. Cisco Umbrella provides DNS-layer protection for every device in hours, whereas Zscaler requires an agent on every endpoint before it inspects traffic. The Zscaler Client Connector agent manages traffic for major desktop and mobile platforms. Even with these capabilities, Zscaler Private Access logs can sometimes make it difficult to pinpoint the exact cause of access issues in complex environments. The company reported that revenue rose 25% in the fourth quarter of fiscal 2026 to $898.2 million, while net new annual recurring revenue growth accelerated to 17% excluding Red Canary. By the end of the quarter, the company had 785 customers generating more than $1 million in annual recurring revenue and 4,182 customers with more than $100,000 in ARR. Fortune 500 penetration improved to 50% from 45% a year earlier. The company also noted that demand was strong across the Americas, EMEA, and APJ regions. Does the increased inspection depth justify the higher per-user cost for your distributed workforce?
