Zscaler looks expensive. It always has. The stock trades at a premium to the cybersecurity peer group year after year, and the bear case writes itself: competitive pressure from Palo Alto Networks and Cloudflare, decelerating billings growth, a product that is "just a proxy" in an industry with low switching costs. The premium is a vulnerability, not a signal.
The bear case is wrong for a structural reason that gets less attention than it deserves: you cannot rip Zscaler out of an enterprise without re-architecting the entire network security stack.
Replacing a point proxy is trivial. Uninstall one endpoint agent, install another. Replacing the network security infrastructure that sits between every user and the internet, every user and every SaaS application, and increasingly between every workload and every other workload — that is a multi-year migration that no CISO, no CIO, no board will authorize unless the incumbent has materially failed. And Zscaler, by every available metric, is not failing.
The numbers are large. Zscaler's fiscal third-quarter 2026 revenue hit $850.5 million, up 25% year-over-year. Annual Recurring Revenue reached $3.525 billion, also up 25% Source. Over 3,363 customers spend $100,000 or more in ARR, and 642 customers exceed $1 million Source. Customers who spend a million dollars a year on Zscaler are not "testing a new proxy." They are running their network security on Zscaler's infrastructure. The switching cost is proportional to the spend.
The architecture explains why. Zscaler's zero trust platform routes all user traffic — every web request, every SaaS API call, every file download — through Zscaler's cloud before it reaches its destination Source. The inspection happens at Zscaler's data centers, not on the customer's network. The policy enforcement — who can access what, from which device, under which conditions — is enforced at the Zscaler layer. If you rip out Zscaler, you need to rebuild that entire inspection and policy enforcement chain. Every branch office that connects through Zscaler's zero trust exchange needs a new connectivity model. Every cloud workload that uses Zscaler's workload protection needs a new security posture. Every remote user who authenticates through Zscaler's identity proxy needs a new authentication flow.
That is not a software migration. It's a network architecture migration. The timeline for a Global 2000 enterprise to migrate off Zscaler, assuming everything goes smoothly, is eighteen to twenty-four months. The timeline assuming the usual enterprise IT realities — budget cycles, competing priorities, the fact that the network team is already over capacity — is three to five years. During that migration, the enterprise is operating a hybrid security posture with two overlapping stacks, which increases risk, not decreases it. The rational choice for a CISO whose Zscaler bill is going up is to negotiate. Never to leave.
Here's the colloquial bit: every CISO who has deployed Zscaler at scale knows what happens if you turn it off. Things break. Not because Zscaler is buggy, but because the security policies that govern application access, data loss prevention, threat detection, and compliance monitoring are all enforced through the Zscaler inspection layer. Turn off that layer and you have removed every security control between your users and the internet. Your SOC goes blind. Your compliance posture is invalidated. You have thirty seconds of "freedom" before someone realizes the entire security architecture just disappeared.
The competitive argument — that Palo Alto Networks or Cloudflare will eat Zscaler's lunch — underweights the architectural integration problem. A customer who has 642 employees spending $1 million a year on Zscaler isn't switching because a competitor launched a point product. The security stack at that scale includes identity providers, SIEM integrations, SOAR playbooks, compliance reporting pipelines, and agent deployments across tens of thousands of endpoints. All of those integrations are specific to Zscaler's API and data format. Switching to Palo Alto Networks' Prisma Access means rebuilding every one of those integrations. The product might be better. The migration cost makes the comparison irrelevant.
Zscaler's zero trust workload protection extends this moat into cloud infrastructure Source. Workload-to-workload communication in hybrid cloud environments goes through Zscaler's inspection layer. The same dependency pattern that locks in user access now locks in application traffic. If the enterprise's microservices communicate through Zscaler, replacing Zscaler means re-architecting the application networking layer, not just the security layer. The surface area of the integration — and therefore the switching cost — grows every quarter as more workloads come online.
The market leadership data supports the moat, too. Zscaler leads the SSE (Security Service Edge) market according to Dell'Oro Group's industry analysis, which ranks the company as the market leader in a category that is projected to reach $9.6 billion by 2028 Source. That's not a rounding error in the broader cybersecurity industry. That's a category Zscaler defined and still leads.
The valuation premium is not a vulnerability. It's the price of a structural moat that gets deeper every quarter, not because Zscaler is doing anything novel, but because its architecture makes leaving harder than staying. The stock has fallen 48% over the past year Source, which means the premium has compressed. The business fundamentals — 25% revenue growth, $3.5 billion in ARR, 642 customers above $1 million, net retention that implies expansion not contraction — haven't changed. The market is selling Zscaler on the assumption that cybersecurity is a commodity market with low switching costs. It isn't. It's an infrastructure market where the switching cost is measured in years, and Zscaler owns the most deeply embedded position in the most deeply embedded layer.