Zscaler beat Wall Street expectations for the fourth quarter. Revenue reached $898 million, which is a 25% increase from the $719 million reported a year ago, and its annual recurring revenue grew by 25% to reach $3.77 billion for the total fiscal year. Net new ARR growth, excluding Red Canary, hit 17% in the fourth quarter. This growth occurred as the company processed 750 billion transactions daily. Zscaler also reported that 785 customers generated more than $1 million in ARR, an 18% increase. The number of customers generating more than $100,000 in ARR grew 20% to 4,182. Zscaler reported a net loss of $3.4 million, or 2 cents per share, which is an improvement from the $17.6 million loss reported a year ago, but the company faces higher capital expenditures for memory and data center components.
AI security demands drive Zscaler adoption
AI security bookings increased by more than 50% sequentially in the fourth quarter. This surge follows a strong third quarter and follows a pattern of rising demand for protection against autonomous threats. Zscaler researchers found that critical vulnerabilities in enterprise AI systems surfaced in 16 minutes during controlled red team scans. In some extreme cases, the defense failed in a single second. Organizations face a landscape where 90% of AI applications and models exist with exposure to the internet. More than one-third of these systems contain known exploitable flaws. This threat context drove Zscaler to expand its Security for AI portfolio. The company expects its new Zero Trust Exchange for agents and Endpoint AI Security to scale in the second half of fiscal 2027.
The volume of data moving to AI models creates a massive target for attackers. Enterprise data transfers to AI/ML applications reached 18,033 terabytes in 2025, a 93% increase from the previous year. This influx includes 115 billion transactions for ChatGPT and 42 billion for Codeium. Zscaler helps companies secure this traffic by providing visibility and enforcement at the exchange level. The company reported that 70% of security for AI deals this quarter included data security solutions to address prompt injections and other risks. A Fortune 500 transportation customer signed a seven-figure upsell for these services, which grew its ARR to nearly $10 million. Another Fortune 500 semiconductor manufacturer committed to a seven-figure upsell to secure a rollout of Claude Cowork.
Netskope leads Gartner execution scores
Netskope took the top position in Gartner’s 2026 SASE Platforms Magic Quadrant. The firm earned the highest Ability to Execute score of any vendor in the report. Netskope also holds the number one ranking in the Sovereign SASE and Zero-trust SASE Platform use cases. This performance follows its recognition as a leader in SSE for five consecutive years. Cato Networks took the second place position in the SASE vendor rankings, while Palo Alto Networks fell to third place. Zscaler remains in the Leader quadrant for both SASE Platforms and SSE. Cloudflare sits in the Visionary quadrant for both categories.
You already know that Gartner rankings change every year, so I will focus on the execution scores that actually impact your procurement committee. Netskope focuses on a single-platform architecture through its Netskope One offering. This platform uses the NewEdge private network, which contains 120 data centers across 81 regions. Netskope also provides the highest number of SaaS app protections with its CASB, which covers over 70,000 applications. This depth helps Netskope maintain its lead in data protection and CASB coverage. Zscaler maintains its position through its massive installed base and scale. Zscaler secures nearly 40% of the Global 2000 and over 45% of the Fortune 500.
Architecture and performance specifications
The choice between vendors often comes down to whether a company needs an agent-based or agentless model. Zscaler and Netskope both use endpoint clients and connectors to reach private applications. Zscaler uses the Zscaler Client Connector and App Connectors. Netskope uses the Netskope Security Client and Publishers. Cloudflare provides an agentless-first model through HTML rewriting and Browser Isolation. The WARP client remains optional for non-HTTP traffic.
| Feature | Zscaler | Netskope | Cloudflare |
|---|---|---|---|
| Primary Architecture | Proxy-based | Single-pass | Agentless-first |
| PoP Count | 150+ | 120+ | Distributed |
| CASB App Coverage | Extensive | 70,000+ | Moderate |
| SASE Ranking | Leader | Leader | Visionary |
| AI Security Focus | Agentic SecOps | Skope AI | AI/PQC security |
Zscaler uses a single-pass inspection architecture through its Zscaler Enforcement Nodes. This setup reports average latency under 50ms to the nearest node. Netskope uses its NewEdge infrastructure to target sub-5ms inspection latency for common workloads. Cloudflare reported that its Gateway product was the fastest secure web gateway in 42% of tested scenarios. Cloudflare also claimed its Access product was 38% faster than Zscaler’s ZPA in worldwide tests.
Z-Flex momentum and large customer wins
Zscaler uses the Z-Flex model to facilitate multi-year commitments. This model allows customers to swap modules and bypass new procurement cycles as they expand. Z-Flex generated $770 million in total contract value in the fourth quarter, which is a 60% increase from the previous quarter. Over the full fiscal year 2026, Z-Flex reached $1.7 billion. Customers who adopted Z-Flex in fiscal 2026 saw an average ARR uplift of nearly 30%. The company reported that the number of customers adopting protection across users, branches, and clouds grew from 350 to over 950 in one year.
Large enterprise wins demonstrate the scale of the Zscaler platform. A Global 2000 financial services firm expanded to Zscaler Private Access for 120,000 users, which increased its ARR by almost 50%. A Fortune 500 life sciences company signed a seven-figure deal for 75,000 users to deploy Zero Trust SASE and AI security. A Global 2000 retailer increased its annual spend by 140% through a three-year, eight-figure agreement. A Global 2000 services customer grew its ARR by nearly 90% in a five-year, eight-figure Z-Flex deal. Will the market’s focus on AI security agents eventually cause Zscaler’s existing ZTNA revenue to stagnate?
Competitive comparison of cloud security
Netskope competes through its data protection depth and its NewEdge network. Its NewEdge network includes full-compute, full-stack edge data centers in 81 regions. Netskope’s CASB uses an API-adapter approach to discover shadow IT across thousands of apps. This allows Netskope to provide effective protection for unmanaged devices through its reverse proxy mode. Netskope also provides a unified console that manages security, networking, and observability.
Cloudflare targets the lower end of the market with lower prices and a generous free tier. Cloudflare offers a free tier for up to 50 users. Its paid tier costs $7 per user per month. This undercuts both Zscaler and Netskope on published list prices. Cloudflare grew its customer base to 332,000 paying customers by the end of 2025. This represents an increase from 295,000 customers in the previous quarter. Cloudflare also captured more than 38% of the Fortune 1000.
| Capability | Zscaler | Netskope | Cloudflare |
|---|---|---|---|
| Deployment Speed | Moderate | Moderate | High |
| Pricing Model | Per-user subscription | Modular/Negotiated | Per-user/Free tier |
| Best Use Case | Scale and ZTNA | DLP and CASB | Cost and Edge |
Enterprise deployment and scale
Zscaler operates a distributed inline security cloud that processes 750 billion transactions daily. This scale provides high-fidelity telemetry for its AI-powered security. The company’s ability to scale makes it a preferred choice for the largest global organizations. Zscaler provides ZTNA for private application access through its ZPA service. It also provides internet access through its ZIA service. These two services were architected as distinct products, so ZPA sessions do not automatically flow through ZIA inspection without separate configuration.
Netskope uses a single-pass architecture to reduce latency. This means that SWG, CASB, DLP, and threat protection all execute in one traversal of the traffic at the PoP. This design keeps latency below 5ms at most enterprise locations. Netskope’s Zero Trust Engine acts as a shared brain to analyze telemetry across users, devices, and agents. This engine allows for continuous adaptive risk and control. Netskope also provides a thin edge appliance for branch offices through its One SASE Gateway. This appliance supports edge AI services and runs SD-WAN, firewall, and IPS.
The verdict on SASE selection
Zscaler is the best choice for large enterprises that require a mature, tested-at-scale Zero Trust Exchange. Its massive installed base and ability to process 750 billion daily transactions provide a level of reliability that smaller vendors cannot match. The Z-Flex model also helps large organizations manage complex procurement cycles. Zscaler wins for organizations that need the most established ZTNA and scale.
Netskope is the best choice for organizations that prioritize deep data protection and CASB capabilities. Its NewEdge network provides low latency for AI and SaaS traffic. The number one ranking in Gartner’s SASE Platform report for execution makes it a strong candidate for security teams focused on modernizing their SASE stack. Netskope wins for organizations that need the highest level of DLP and CASB depth.
Cloudflare is the best choice for startups and companies that want the lowest cost of entry. Its $7 per user monthly price and agentless-first model provide speed and savings. Cloudflare wins for organizations that want to deploy ZTNA without heavy agent management.
