Zscaler
| Zscaler, Inc. | |
|---|---|
| Type | Public company |
| Traded as | Nasdaq: ZS |
| Industry | Computer security, cloud computing |
| Founded | 2007 |
| Founder | Jay Chaudhry, K. Kailash |
| Headquarters | San Jose, California, United States |
| Key people | Jay Chaudhry (Chairman and Chief Executive Officer) |
| Products | Zero Trust Exchange, Zscaler Internet Access, Zscaler Private Access |
Zscaler, Inc. is an American cloud security company based in San Jose, California. It provides cloud-delivered services that protect the network traffic, applications and data of enterprises, operating a global platform through which customer traffic is inspected before it reaches its destination. The company operates more than 150 data centres across six continents, and the majority of its customers are in the United States, though most large customers use the service across multiple countries.
Zscaler is among the principal commercial exponents of zero trust network security, an approach that abandons the assumption that traffic inside a corporate network is trustworthy and instead authenticates and authorises every connection individually. The company's central argument is that the traditional security model, in which an organisation defends a perimeter around its own premises and network, ceased to describe reality once applications moved to cloud providers and employees worked from anywhere.
History
Zscaler was founded in 2007 by Jay Chaudhry and K. Kailash and launched its cybersecurity platform in 2008. Chaudhry had previously founded and sold four security companies, among them SecureIT, CipherTrust and AirDefense, and financed Zscaler's early years substantially himself, which is why the company took comparatively little outside capital before its listing.
In August 2012 it secured US$38 million in funding. A second round led by TPG Capital raised US$100 million in August 2015. The company listed on the Nasdaq in March 2018, and the shares rose sharply on the first day of trading.
Growth through the following years was driven by the same forces that made the product necessary: the migration of enterprise applications to cloud providers, the growth of remote and hybrid working, and a succession of large breaches that discredited the perimeter model. The company's revenue passed US$1 billion in the 2023 financial year and has continued to grow at rates well above those of the wider software sector.
The Zero Trust Exchange
Zscaler's platform is marketed as the Zero Trust Exchange, announced in its current form at the company's Zenith Live conference in June 2023. It provides cyberthreat protection, data protection, zero trust connectivity and business analytics.
The architecture inverts the conventional arrangement. Rather than routing traffic from a remote worker back through a corporate network before sending it to the internet, a practice that became untenable when most applications ceased to live in the corporate network, Zscaler places its inspection points close to the user. Traffic is decrypted, inspected for threats and for data leaving the organisation, and then forwarded directly to its destination.
Zscaler Internet Access secures outbound traffic to the internet and to cloud applications. Zscaler Private Access replaces the virtual private network for reaching internal applications, connecting a specific authorised user to a specific application without placing that user on the network at all, which means a compromised device cannot move laterally to other systems.
In January 2024 the company announced Zscaler Zero Trust SASE, its first single-vendor secure access service edge offering, built on its artificial intelligence enabled security service edge platform to connect users, locations and cloud services through the Zero Trust Exchange. Secure access service edge describes the convergence of networking and security functions into a single cloud-delivered service, a category defined by industry analysts in 2019 and since adopted as the organising framework for the sector.
Acquisitions
Zscaler has grown its platform largely through a series of targeted acquisitions of small technology companies rather than through large consolidating transactions.
It acquired the artificial intelligence and machine learning technology of TrustPath in August 2018; the browser isolation company Appsulate for US$13 million in May 2019; the cloud security posture management startup Cloudneeti in April 2020; and the microsegmentation company Edgewise Networks in May 2020.
On 14 February 2023 it announced the acquisition of Canonic, an Israeli application security company focused on attacks targeting software as a service platforms. In March 2024 it acquired Avalor, an Israeli data security startup using artificial intelligence to analyse security data.
On 17 May 2025 it announced the acquisition of Red Canary, a United States provider of managed detection and response services, for an undisclosed sum, adding a human-led security operations capability to a portfolio that had previously been entirely automated. In February 2026 it announced the acquisition of the browser security company SquareX, also for an undisclosed sum, addressing the browser as the principal place where modern work and therefore modern attacks now occur.
Zero trust explained
The concept Zscaler is built on is worth setting out, because it describes a change in how computer security is conceived rather than a particular product.
The perimeter model and why it failed
For roughly three decades, enterprise security was organised around a boundary. An organisation's computers sat inside a network protected by firewalls; traffic crossing the boundary was inspected; traffic inside was largely trusted. Employees working elsewhere connected through a virtual private network, which placed them, for security purposes, inside.
The model assumed that everything valuable was inside and that inside could be defended. Both assumptions dissolved. Applications moved to cloud providers, so the valuable things were no longer inside. Employees worked from home, from client premises and from aeroplanes, so most users were not inside either. And the repeated experience of large breaches established that an attacker who obtains any foothold inside a trusted network can move laterally almost without resistance, which is how a compromised contractor's credentials or a single phished employee has repeatedly produced the loss of an entire organisation's data.
The zero trust alternative
Zero trust, a term popularised by the analyst John Kindervag in 2010 and developed in the United States federal government's guidance from 2020, replaces the boundary with a rule: never trust, always verify. Every request is authenticated and authorised individually, on the basis of the identity of the user, the state of the device, the sensitivity of the resource and the context of the request, regardless of where any of them are located.
The practical consequence for a product like Zscaler's is that a user is never placed on a network. They are connected to a single application for which they are authorised, through a broker that both parties connect outward to, so that the application is not exposed to the internet at all and the user's device has no path to anything else. An attacker who compromises the device gains access to what that user was authorised for and nothing more.
The trade-offs
The approach has genuine costs. Routing all of an organisation's traffic through a third party's inspection points creates a dependency on that provider's availability, and outages at cloud security providers have interrupted work at large numbers of organisations simultaneously. Decrypting traffic for inspection means the provider can see it, which raises questions in regulated industries and in jurisdictions with strict data protection requirements. And a security model that depends on correct identity and device assessment shifts the attack surface onto the identity system, which is why attacks on authentication providers have become among the most consequential in the field.
Competition
The market Zscaler operates in is contested by companies approaching it from several directions. Palo Alto Networks and Fortinet came from network firewalls and have built cloud-delivered equivalents. Cisco Systems and Netskope compete directly in secure access service edge. Cloudflare, which built a global network for content delivery and protection against denial of service attacks, has extended it into the same enterprise security functions and competes on the breadth of its network. Microsoft includes identity-centred security capabilities within its enterprise subscriptions, applying the same bundling pressure it exerts in other software categories.
The competitive question for Zscaler is whether a company focused exclusively on this problem can continue to outperform larger competitors for whom it is one product among many, and the acquisitions of Red Canary and SquareX indicate a judgement that breadth of capability, in security operations and in the browser, is now required as well as depth.
Assessment
Zscaler's significance is that it was early and specific about a structural change others described more vaguely. Founded in 2007, before cloud applications were dominant and well before remote working was normal, it built a product for a world in which the corporate network would no longer be where work happened. That world arrived slowly through the 2010s and then abruptly in 2020, and the company's growth follows that timing closely.
The business model is durable in a way many security products are not, because the service is consumed continuously rather than purchased as equipment, because it sits in the path of traffic and is therefore difficult to remove once installed, and because the cost of an organisation's security failing is high enough that the spending is among the last to be cut.
The risks are the ones that attach to any critical intermediary. A provider through which an organisation's entire traffic flows is a single point of failure and a concentrated target, and the same architecture that lets Zscaler inspect every connection would, if compromised, expose every connection. That is the trade the model requires, and the company's continued standing depends on being right about it.
Timeline
- 2007 Founded by Jay Chaudhry and K. Kailash.
- 2008 Platform launched.
- 2012 US$38 million raised in August.
- 2015 US$100 million raised in August in a round led by TPG Capital.
- 2018 Listed on the Nasdaq in March; TrustPath technology acquired in August.
- 2019 Appsulate acquired for US$13 million in May.
- 2020 Cloudneeti acquired in April and Edgewise Networks in May; remote working accelerates adoption sharply.
- 2023 Canonic acquired in February; Zero Trust Exchange announced in its current form at Zenith Live in June; revenue passes US$1 billion.
- 2024 Avalor acquired in March; Zscaler Zero Trust SASE announced in January.
- 2025 Red Canary acquired, announced on 17 May.
- 2026 SquareX acquired, announced in February.